A new Checkmarx study has found that 95% of CISOs feel pressure to suppress or delay compliance-related security issues when business deadlines are at stake, while the rapid growth of AI-generated code is creating new security challenges.
Nearly all developers now use AI to write code, but fewer than one in five apply security controls continuously during development, according to Checkmarx’s Future of Application Security 2026 report.
The research, based on responses from 2,350 CISOs, AppSec managers and developers across 14 countries, found that 95% of CISOs feel pressure to suppress or delay compliance-related security issues when business deadlines are at stake.
The report also highlights growing concerns around AI-generated code. Organisations with 81-100% AI-generated production code were found to be nearly three times more likely to ship software containing known vulnerabilities than organisations with 1-20% AI-generated code production, at 47% and 14% respectively.
Checkmarx found that 75% of organisations knowingly deploy vulnerable code at some point, while 93% reported experiencing a recent breach linked to their own applications. Despite this, 73% described their security posture as advanced or highly mature.
“This report points to a massive disconnect between the security crisis that organisations are facing and the incremental steps that they are taking to address it. A completely new model is required,” said Sandeep Johri, CEO of Checkmarx.
“Just like the student cannot grade their own exam, AI alone cannot secure code – and, as the research shows, it adds risk. Organisations need security that combines deterministic precision with probabilistic reasoning to identify novel exploitable patterns, while closing the gap between finding a vulnerability and fixing it with better human-guided remediation.”
