{"id":20363,"date":"2026-09-01T19:07:41","date_gmt":"2026-09-01T16:07:41","guid":{"rendered":"https:\/\/lamdabroking.com\/?p=20363"},"modified":"2026-09-09T16:31:03","modified_gmt":"2026-09-09T13:31:03","slug":"ai-code-security-governance","status":"publish","type":"post","link":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/","title":{"rendered":"AI Can Write Code. It Does Not Replace Secure Development Governance"},"content":{"rendered":"<p dir=\"ltr\"><span style=\"font-weight: 400;\">The short answer has three components: a written tool policy, automated security scanning that applies to every line regardless of who wrote it, and human peer review before anything merges to the main branch. An organisation that puts all three in place improves its underwriting terms and strengthens its position if a claim ever arrives.<\/span><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Key Takeaways<\/span><\/h2>\n<ul dir=\"ltr\">\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Language models are trained on public code repositories, so they reproduce old patterns carrying known weaknesses. An academic study published in 2025 found that around thirty percent of code snippets generated by autocomplete tools contained security weaknesses.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The risk grows when the request to the model is framed around functionality alone. Studies published in 2025 found that roughly 45% of code generated by language models chose the insecure option, and tests published in 2025 produced code with XSS flaws in 86% of cases and Log Injection flaws in 88%.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Secret leakage is the most immediate expression of the problem. Industry data from 2026 indicates that AI-assisted commits leak secrets at double the baseline rate, meaning live keys sitting inside an active repository.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The insurance consequence touches three lines: <a href=\"https:\/\/lamdabroking.com\/en\/tech-eo-hi-tech-professional-liability-insurance\/\">technology professional liability<\/a>, <a href=\"https:\/\/lamdabroking.com\/en\/cyber-insurance\/\">cyber<\/a>, and <a href=\"https:\/\/lamdabroking.com\/en\/directors-and-officers-insurance\/\">directors and officers<\/a>. Underwriters now ask direct questions about code review and automated scanning, and the answers drive pricing, exclusions and the handling of a claim.<\/span><\/li>\n<\/ul>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Working Code and Safe Code: Where the Exposure Begins<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Code that compiles and passes functional tests can still carry a decade-old security weakness. Language models are trained on public repositories, forum answers and tutorial examples that were never meant to run in production, and they reproduce the patterns they saw. An academic study published in 2025 found that around thirty percent of code snippets generated by autocomplete tools contained security weaknesses across several CWE categories.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The gap opens at an identifiable point: how the task is defined. A developer who asks the model for a function that takes user input and returns a result gets exactly that. When the prompt drops the requirement for validation, output encoding and disciplined error handling, the model takes the short path. Studies published in 2025 found that roughly 45% of code generated by language models chose the insecure option even where a safer alternative existed. In tests published in 2025, models produced code with XSS flaws in 86% of cases and Log Injection flaws in 88% when security was not explicitly requested. Those numbers describe the default behavior of the tool, not an isolated failure. Responsibility for writing the requirement, and for checking it, stays with the organization.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The code runs, the developer is satisfied, and the weakness lands in the main branch with nobody stopping to ask how it will read in a forensic report.<\/span><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Four Risk Vectors Worth Mapping Before the Next Renewal<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The risk in using AI coding tools runs along four separate tracks, and each track needs a different control. Mapping them properly is the basis for any conversation with an underwriter, with an enterprise client, or with the CPA firm performing the examination behind a SOC 2 report.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Weaknesses Born of Training Patterns<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">A model produces what it saw most often, not what is correct today. SQL injection, weak cryptography, careless permission handling and dependencies with known vulnerabilities keep appearing in the output because they are common in public code. Basic static analysis catches a large share of this family, provided it runs on every pull request rather than on release builds alone.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Secrets Leaking Into Commits<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">AI tools tend to produce working code with credentials embedded, because that is how the example they learned from looked. Industry data from 2026 indicates that AI-assisted commits leak secrets at double the baseline rate. The code runs, the developer moves on, and the live key stays in repository history even after the line is deleted. A secret scanner that reads history, paired with a fast rotation procedure, shortens the exposure window from months to hours.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Poisoned Rules Files<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">During 2025 researchers documented an attack family in which malicious instructions are injected into the configuration rule files that coding assistants read before generating code. The instruction hides in invisible Unicode characters, and the tool produces backdoored code without the developer noticing any change in behaviour. GitHub subsequently added warnings for hidden characters. This is an attack surface with no direct equivalent in traditional code review, which is why rule files belong under version control and deserve the same peer review as code.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Prompt Injection at Runtime<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The OWASP Top 10 for LLM Applications 2025 places prompt injection at the head of the risk list. When AI-generated code processes external inputs without adequate validation, hostile input can steer system behaviour in ways a security-aware developer would have blocked. The risk is structural rather than incidental, and it calls for deliberate trust boundaries between system components.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Research tracking from 2026 documents a sharp rise in disclosed vulnerabilities attributable to AI-generated code. That trend line explains why underwriting questionnaires grew longer over the past year.<\/span><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Vibe Coding: A Production System Nobody Read<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The riskiest pattern right now is production systems built by people who cannot read code. Founders, product managers and operations teams use prompt-based platforms to build tools that touch customer data, and push them live within days. The platforms themselves are powerful; the gap sits between a product that works and a product that can be insured.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Whoever built the system cannot assess whether permissions are too open, whether data is encrypted at rest, whether activity is logged, or whether events can be reconstructed at all. When an incident occurs, the forensic investigator finds no logs, no technical owner and no record of decisions. The coverage question then becomes a question of representations: what was told to the underwriter about the development environment, and what is actually running in production.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">A product built over a weekend and pushed live without a security review is a liability event waiting for its trigger.<\/span><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Where Technical Risk Meets the Policy<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Most policy wordings determine cover by the nature of the act and by the exclusions, not by the identity of whoever typed the code. What changed is the reasonableness question: when an investigation shows that a well-known weakness reached production without a basic scan, an argument opens about reasonable security practice that shapes the outcome of the claim. The broker (LAMDA Broking) and legal counsel review policy wordings against the clauses of the enterprise client contract, in order to identify the broad artificial intelligence exclusions that have entered wordings in recent years.<\/span><\/p>\n<p dir=\"ltr\"><b>Scenario mapped to insurance line and to the core question in a claim:<\/b><\/p>\n<table dir=\"ltr\">\n<tbody>\n<tr>\n<td><b>Scenario<\/b><\/td>\n<td><b>Relevant insurance line<\/b><\/td>\n<td><b>What a claim will examine<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">A product weakness originating in AI-assisted code causes loss to a business client<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Technology professional liability<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Whether a documented code review process exists, and whether it covers AI output<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">That same weakness is exploited to reach a customer database<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Cyber<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Whether a basic static scan would have identified the weakness before release<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">A live access key left in a commit is used to reach the production environment<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Cyber, sometimes professional liability as well<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Time of discovery, presence of a secret scanner in the pipeline, and key rotation policy<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Representations to investors or an enterprise client about development controls that did not exist<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Directors and officers<\/span><\/td>\n<td><span style=\"font-weight: 400;\">The gap between the representation and the operational record, and how the board exercised oversight<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">A component supplied by a third party and built with AI tools degrades service availability<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Cyber, alongside indemnity clauses in the supplier contract<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Allocation of contractual responsibility and the force of limitation of liability clauses<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">What Underwriters Ask Before a Renewal<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Underwriting questionnaires have moved from general declarations to operational questions that can be proven or disproven with a document. An underwriter who receives a vague answer prices the uncertainty, and will sometimes add an exclusion or make renewal conditional on remediation. The table below sets out the questions that keep recurring and the difference between an answer that weakens a submission and one that holds up.<\/span><\/p>\n<p dir=\"ltr\"><b>Common underwriting questions and the quality of the answer:<\/b><\/p>\n<table dir=\"ltr\">\n<tbody>\n<tr>\n<td><b>Underwriter question<\/b><\/td>\n<td><b>Answer that weakens the submission<\/b><\/td>\n<td><b>Answer that holds up<\/b><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Is there an approved policy for AI tools in development?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">No document, each team decides for itself<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Written policy, list of approved tools, and a named owner reviewing it quarterly<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Does AI-assisted code go through peer review?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Only when the developer feels it is needed<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Every merge to the main branch requires a second reviewer, recorded in the pull request<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">Which security scans run in the pipeline?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">There is a scanner, its scope is unclear<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Static analysis, dependency analysis and secret scanning on every pull request, blocking merge on a severe finding<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">What permissions do automated coding agents hold?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">The agent has access to the whole repository and the cloud environment<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Least privilege, isolated environments, and no direct access to production<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">What share of code shipped to production is AI-assisted?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Not measured<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Measured monthly through commit tagging, reported to management<\/span><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-weight: 400;\">How is a weakness discovered after release handled?<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Fixed when a complaint arrives<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Remediation procedure with severity-based target times, and records kept for underwriting and claims<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Regulation, Standards and Client Contracts<\/span><\/h2>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The demands reaching technology companies today arrive from three directions at once: regulation, standards and commercial contracts. The third is moving fastest, because enterprise procurement in the United States and Europe already asks for documentation of the software development lifecycle and of how AI tool output is validated. A company that assembles that documentation for one client tends to find it is also ready for the underwriter.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">In the United States, the 2023 SEC disclosure rules require public companies to describe the board&#8217;s oversight of cyber risk. The proposed disclosure requirement regarding cyber expertise among board members was dropped from the final rule, so the focus rests on the oversight process rather than on board composition. For private companies with institutional investors the expectation is substantively similar: a documented discussion, metrics, and a remediation plan.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Europe is building an additional layer. The EU AI Act imposes transparency and risk management duties on certain uses, NIS2 and DORA require security controls and supplier management across broad sectors, and the Cyber Resilience Act will require software manufacturers to demonstrate proactive vulnerability management towards the end of 2027. An organization using AI coding tools will need to show that output is tested and validated before release.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">All of these rule sets converge on the same operational requirement: documentation showing what was tested, when, and with which tool.<\/span><\/p>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">In Israel, Amendment 13 to the Privacy Protection Law widened the enforcement powers of the Privacy Protection Authority and raised the price of an incident that flows from negligent controls. At the same time, the speed at which Israeli companies adopt AI coding tools is a genuine competitive advantage and also a source of a governance gap against enterprise clients abroad. An Israeli company entering enterprise procurement in the United States or Europe meets contractual demands for software development lifecycle documentation it did not always prepare in advance. The gap usually surfaces late, once a deal is already on the table and the signing window is short. On the standards side, a SOC 2 report is an attestation report issued by an independent CPA firm against AICPA criteria for a defined period, rather than a certificate anyone holds. Keeping that documentation current removes the scramble entirely.<\/span><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Common Mistakes<\/span><\/h2>\n<ul dir=\"ltr\">\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Treating a pass on functional testing as security approval.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Writing the AI policy into a general document with no owner, no review date and no enforcement in the pipeline, then discovering at renewal that the underwriter wants operational evidence rather than good intentions.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Granting automated coding agents broad permissions in the cloud environment to save configuration time.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Assuming the tool vendor carries responsibility for the output, without reading terms of use that place it on the user.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reporting development controls to an enterprise client that exist in a slide rather than in the code.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Treating a SOC 2 report as a certificate, and missing that it is an external firm&#8217;s attestation over a defined period and over controls the organisation itself defined.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reading the policy wording only after an incident, once definitions and exclusions can no longer be changed.<\/span><\/li>\n<\/ul>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Professional Checklist<\/span><\/h2>\n<ol dir=\"ltr\">\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Define a list of approved AI development tools, and name an owner who reviews it quarterly.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Write a usage policy setting out what may be fed into the tools, which repositories are off limits, and what follows a breach.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Integrate static analysis into every pull request, and configure a merge block on high severity findings.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Run automated secret scanning across the full commit history rather than the current change alone.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Require human peer review before any merge to the main branch, even when the code looks clean.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Tag AI-assisted commits so you can measure volume and prioritise testing.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Reduce coding agent permissions to least privilege, and keep them away from the production environment.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Place tool rule files under version control, and review them exactly as you review code.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Run dynamic testing and periodic penetration tests against features built at speed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Document a vulnerability remediation procedure with severity-based target times, and retain the records for three years.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Register every system built outside the development team, and test it before any external exposure.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Align the representations in client contracts with what actually exists in the development pipeline.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Bring the underwriting questionnaire to the development team two months before renewal, not a week before expiry.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Test cyber and professional liability wordings against a scenario involving a weakness in AI-assisted code.<\/span><\/li>\n<\/ol>\n<p dir=\"ltr\"><b>AI tools generate code faster than most organizations can review it, so the quality of insurance cover is now determined by the development process the organization can prove on paper.<\/b><\/p>\n<h2 dir=\"ltr\"><span style=\"font-weight: 400;\">Frequently Asked Questions<\/span><\/h2>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Does using AI coding tools harm our ability to buy cyber cover?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">Use of the tools by itself does not block cover. What moves the needle is the quality of the controls around them: a written policy, automated scanning and documented peer review. An organization presenting orderly documentation usually receives terms similar to one that uses no such tools at all. An organisation declaring widespread use without controls may face an exclusion, a higher retention, or remediation as a condition of renewal.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Does a professional liability policy respond to loss originating in AI-assisted code?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">In most wordings cover turns on the definition of the professional act and on the exclusions, not on who wrote the code. The point that needs checking is whether the wording carries a broad artificial intelligence exclusion introduced in recent years, and how it sits against the product the company sells. Reviewing the wording alongside the enterprise client contract is how you confirm the scenario falls within cover.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">How does a SOC 2 report relate to AI use in development?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">SOC 2 is an attestation report issued by an independent CPA firm against AICPA criteria, rather than a certification. Where an organisation uses AI tools in development, the controls examined in the report should include the process applied to tool output: tool approval, code review, permission management and pipeline scanning. A gap between what the report describes and what happens in practice is an exposure in its own right, with clients and with underwriters alike.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">What is expected of the board here?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The 2023 SEC disclosure rules require public companies to describe the board&#8217;s oversight of cyber risk. The proposed disclosure requirement regarding cyber expertise among board members was dropped from the final rule. For private companies with investors and enterprise clients the expectation is substantively similar: a discussion recorded in the minutes, metrics presented to management, and a remediation plan with dates attached.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Can we simply ban AI tools and close the risk?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">A blanket ban produces undeclared use and makes hiring developers harder, so it almost always swaps a visible risk for a hidden one. The approach that works is controlled approval: a list of sanctioned tools, clear rules on sensitive data fed into them, and limited permissions for automated agents. Measurable control beats a prohibition nobody can enforce, both in underwriting and in daily management.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">What happens when a product manager builds a system on a prompt platform and ships it?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">The system enters the corporate environment with no security review and no technical owner. In that scenario a simple weakness can end up exposed to the open internet together with access to customer data, often with no activity logging that would allow anyone to reconstruct events. The practical fix is a central register of every system built outside the development team, testing before external exposure, and a classification of what data may run on such platforms.<\/span><\/p>\n<h3 dir=\"ltr\"><span style=\"font-weight: 400;\">Is there a measurable rise in AI-related litigation?<\/span><\/h3>\n<p dir=\"ltr\"><span style=\"font-weight: 400;\">A 2026 report found that the number of AI-related lawsuits in the United States grew by 978% between 2021 and 2025. Alongside that, research tracking from 2026 documents a sharp rise in disclosed vulnerabilities attributable to AI-generated code. Those two lines explain why underwriting questionnaires have grown longer and why underwriters now ask for operational evidence instead of general statements about policy.<\/span><\/p>\n<p dir=\"ltr\"><i><span style=\"font-weight: 400;\">The above is general information only and does not constitute insurance, legal or other professional advice. Terms of cover, exclusions and duties are set by the specific policy wording and by applicable law. Each case should be assessed on its own facts against the policy wording and with a qualified adviser.<\/span><\/i><\/p>\n","protected":false},"excerpt":{"rendered":"<p>AI coding tools deliver real productivity, and in the same breath they push security weaknesses into the development pipeline faster than legacy controls were designed to catch them. A 2024 developer survey found that roughly 97% of the enterprise developers polled were using AI tools to write code at work, so the management question moved long ago from whether to use them to how to control them. <\/p>\n","protected":false},"author":9,"featured_media":20345,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[91],"tags":[],"class_list":["post-20363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-insurance"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI Generated Code: Security Risks and Development Governance<\/title>\n<meta name=\"description\" content=\"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Generated Code: Security Risks and Development Governance\" \/>\n<meta property=\"og:description\" content=\"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/\" \/>\n<meta property=\"og:site_name\" content=\"Lamda - High Tech Insurance\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/lamda.ins\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-01T16:07:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-09T13:31:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1672\" \/>\n\t<meta property=\"og:image:height\" content=\"941\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oded Oded\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oded Oded\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/\"},\"author\":{\"name\":\"Oded Oded\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#\\\/schema\\\/person\\\/a5b8f4894f9fd6a7a2f3742ba5688174\"},\"headline\":\"AI Can Write Code. It Does Not Replace Secure Development Governance\",\"datePublished\":\"2026-09-01T16:07:41+00:00\",\"dateModified\":\"2026-09-09T13:31:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/\"},\"wordCount\":2869,\"publisher\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Untitled-design-2.jpg\",\"articleSection\":[\"AI Insurance\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/\",\"url\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/\",\"name\":\"AI Generated Code: Security Risks and Development Governance\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Untitled-design-2.jpg\",\"datePublished\":\"2026-09-01T16:07:41+00:00\",\"dateModified\":\"2026-09-09T13:31:03+00:00\",\"description\":\"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#primaryimage\",\"url\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Untitled-design-2.jpg\",\"contentUrl\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/Untitled-design-2.jpg\",\"width\":1672,\"height\":941,\"caption\":\"\u05de\u05d4\u05dd \u05e1\u05d9\u05db\u05d5\u05e0\u05d9 \u05d4\u05d0\u05d1\u05d8\u05d7\u05d4 \u05d1\u05e7\u05d5\u05d3 \u05e9\u05e0\u05d5\u05e6\u05e8 \u05d1-AI\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/ai-code-security-governance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber insurance\",\"item\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/cyber-insurance\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AI Can Write Code. It Does Not Replace Secure Development Governance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/\",\"name\":\"Lamda - High Tech Insurance\",\"description\":\"Risk and Finance Management\",\"publisher\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#organization\",\"name\":\"Lamda - High Tech Insurance\",\"url\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/lamdaLogo-2.svg\",\"contentUrl\":\"https:\\\/\\\/lamdabroking.com\\\/wp-content\\\/uploads\\\/2022\\\/12\\\/lamdaLogo-2.svg\",\"width\":237,\"height\":102,\"caption\":\"Lamda - High Tech Insurance\"},\"image\":{\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/lamda.ins\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/lamda-risk-and-capital-management\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/#\\\/schema\\\/person\\\/a5b8f4894f9fd6a7a2f3742ba5688174\",\"name\":\"Oded Oded\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g\",\"caption\":\"Oded Oded\"},\"url\":\"https:\\\/\\\/lamdabroking.com\\\/en\\\/author\\\/oded\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI Generated Code: Security Risks and Development Governance","description":"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/","og_locale":"en_US","og_type":"article","og_title":"AI Generated Code: Security Risks and Development Governance","og_description":"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...","og_url":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/","og_site_name":"Lamda - High Tech Insurance","article_publisher":"https:\/\/www.facebook.com\/lamda.ins","article_published_time":"2026-09-01T16:07:41+00:00","article_modified_time":"2026-09-09T13:31:03+00:00","og_image":[{"width":1672,"height":941,"url":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg","type":"image\/jpeg"}],"author":"Oded Oded","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oded Oded","Est. reading time":"16 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#article","isPartOf":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/"},"author":{"name":"Oded Oded","@id":"https:\/\/lamdabroking.com\/en\/#\/schema\/person\/a5b8f4894f9fd6a7a2f3742ba5688174"},"headline":"AI Can Write Code. It Does Not Replace Secure Development Governance","datePublished":"2026-09-01T16:07:41+00:00","dateModified":"2026-09-09T13:31:03+00:00","mainEntityOfPage":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/"},"wordCount":2869,"publisher":{"@id":"https:\/\/lamdabroking.com\/en\/#organization"},"image":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#primaryimage"},"thumbnailUrl":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg","articleSection":["AI Insurance"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/","url":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/","name":"AI Generated Code: Security Risks and Development Governance","isPartOf":{"@id":"https:\/\/lamdabroking.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#primaryimage"},"image":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#primaryimage"},"thumbnailUrl":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg","datePublished":"2026-09-01T16:07:41+00:00","dateModified":"2026-09-09T13:31:03+00:00","description":"AI coding tools ship code fast, and weaknesses with it. A guide to secure development governance, the questions underwriters now ask, and...","breadcrumb":{"@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#primaryimage","url":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg","contentUrl":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2026\/09\/Untitled-design-2.jpg","width":1672,"height":941,"caption":"\u05de\u05d4\u05dd \u05e1\u05d9\u05db\u05d5\u05e0\u05d9 \u05d4\u05d0\u05d1\u05d8\u05d7\u05d4 \u05d1\u05e7\u05d5\u05d3 \u05e9\u05e0\u05d5\u05e6\u05e8 \u05d1-AI"},{"@type":"BreadcrumbList","@id":"https:\/\/lamdabroking.com\/en\/ai-code-security-governance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/lamdabroking.com\/en\/"},{"@type":"ListItem","position":2,"name":"Cyber insurance","item":"https:\/\/lamdabroking.com\/en\/cyber-insurance\/"},{"@type":"ListItem","position":3,"name":"AI Can Write Code. It Does Not Replace Secure Development Governance"}]},{"@type":"WebSite","@id":"https:\/\/lamdabroking.com\/en\/#website","url":"https:\/\/lamdabroking.com\/en\/","name":"Lamda - High Tech Insurance","description":"Risk and Finance Management","publisher":{"@id":"https:\/\/lamdabroking.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/lamdabroking.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/lamdabroking.com\/en\/#organization","name":"Lamda - High Tech Insurance","url":"https:\/\/lamdabroking.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lamdabroking.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2022\/12\/lamdaLogo-2.svg","contentUrl":"https:\/\/lamdabroking.com\/wp-content\/uploads\/2022\/12\/lamdaLogo-2.svg","width":237,"height":102,"caption":"Lamda - High Tech Insurance"},"image":{"@id":"https:\/\/lamdabroking.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/lamda.ins","https:\/\/www.linkedin.com\/company\/lamda-risk-and-capital-management\/"]},{"@type":"Person","@id":"https:\/\/lamdabroking.com\/en\/#\/schema\/person\/a5b8f4894f9fd6a7a2f3742ba5688174","name":"Oded Oded","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b963c1df1f438ebca5af4999ce87b49df17e02ee8c0229a090b47e0993913bb1?s=96&d=mm&r=g","caption":"Oded Oded"},"url":"https:\/\/lamdabroking.com\/en\/author\/oded\/"}]}},"_links":{"self":[{"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/posts\/20363","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/comments?post=20363"}],"version-history":[{"count":4,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/posts\/20363\/revisions"}],"predecessor-version":[{"id":20368,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/posts\/20363\/revisions\/20368"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/media\/20345"}],"wp:attachment":[{"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/media?parent=20363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/categories?post=20363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lamdabroking.com\/en\/wp-json\/wp\/v2\/tags?post=20363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}