{"id":26246,"date":"2026-09-23T11:00:45","date_gmt":"2026-09-23T19:00:45","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/23\/ai-coding-puts-secure-by-design-in-the-spotlight-2\/"},"modified":"2026-09-23T11:00:45","modified_gmt":"2026-09-23T19:00:45","slug":"ai-coding-puts-secure-by-design-in-the-spotlight-2","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/23\/ai-coding-puts-secure-by-design-in-the-spotlight-2\/","title":{"rendered":"AI coding puts Secure by Design in the spotlight"},"content":{"rendered":"<div class=\"rich-text_richText__UyrDZ\" data-anchor-headings=\"true\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<div class=\"callout-block_highlight__zUB32\" data-accent-bar=\"true\" data-background=\"highlight-gray\" data-component=\"callout-block\">\n<p class=\"callout-block_heading__sSD7c\" data-subtitle=\"lg\">Key takeaways<\/p>\n<div class=\"rich-text_richText__UyrDZ\" data-component=\"rich-text\" data-reader-view=\"false\">\n<div class=\"payload-richtext\">\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">Same old flaws, bigger stakes: ~40% of CISA&#8217;s exploited-vulnerability catalog traces back to well-understood, preventable weaknesses (memory safety, input validation, injection).<\/li>\n<li class=\"\" value=\"2\">Attackers aren&#8217;t chasing zero-days: CVE disclosures more than doubled year over year, but exploited vulnerabilities grew only 20% \u2014 known gaps are still the target.<\/li>\n<li class=\"\" value=\"3\">AI raises the urgency: it speeds up vulnerability discovery and exploit development, shrinking the window before flaws get found and weaponized.<\/li>\n<li class=\"\" value=\"4\">Test the finished product: per Sa\u0161a Zdjelar (ex-RL Chief Trust Officer, now Nvidia CSO), software needs to be evaluated fully assembled \u2014 like crash-testing a car, not just its parts.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p>AI could soon amplify the consequences of the software industry\u2019s failure to eliminate longstanding coding flaws \u2014 a failure that has defied years of pushing Secure by Design, a proactive application security (AppSec) approach that emphasizes incorporating security considerations throughout the software development lifecycle.\u00a0<\/p>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently analyzed vulnerability data from 2024 and 2025 and found that software continues to be plagued by many of the same basic weaknesses that have persisted for years, and in some cases decades.<\/p>\n<p>CISA identified memory safety and improper input validation as among the most prevalent weaknesses across both Common Vulnerabilities and Exposures (CVEs) and other vulnerabilities in its Known Exploited Vulnerabilities (KEV) Catalog. Injection flaws, including SQL injection, cross-site scripting, and command injection, also featured prominently, as did path traversal and missing authentication.\u00a0<\/p>\n<p>About 4o% of the vulnerabilities in CISA\u2019s KEV Catalog in 2024 stemmed from a handful of what it called \u201cstubborn weaknesses\u201d and well-understood design errors that CISA has described as preventable through Secure by Design practices. The agency noted in its report:<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cThreat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed. Resolving fundamental issues would eliminate a significant portion of today\u2019s most common compromises.\u201d<\/em><\/p>\n<p>In the age of AI, Secure by Design is more important than ever. Here\u2019s why.<\/p>\n<p><strong>[ Webinar: <\/strong><a href=\"https:\/\/www.reversinglabs.com\/webinar\/secure-by-design\"><strong>Secure by Design \u2014 Why Trust Matters for Risk Management<\/strong><\/a><strong> ]<\/strong><\/p>\n<h2 id=\"ai-sets-its-sights-on-softwares-old-flaws\">AI sets its sights on software\u2019s old flaws<\/h2>\n<p>Improving the software industry\u2019s track record on the elimination of longstanding software weaknesses is more urgent now that AI is rapidly accelerating vulnerability discovery and exploit development, said Ted Miracco, CEO of Approov.\u00a0<\/p>\n<p>AI is also making software attacks cheaper by speeding up tasks such as reverse engineering, vulnerability discovery, API mapping and scraping, and the creation of exploit and automation scripts. That means organizations can\u2019t count on vulnerabilities remaining hidden from bad actors until a patch is ready, Miracco said.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cCISA\u2019s findings reinforce the need to move from treating vulnerabilities as isolated defects to addressing the underlying architectural and engineering practices that allow them to recur.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/tedmiracco\/\"><span style=\"text-decoration:underline\">Ted Miracco<\/span><\/a><\/p>\n<p>For him, Secure by Design should involve the eradication of entire classes of vulnerabilities while reducing the attack surface so that no vulnerability can result in an operational compromise.<\/p>\n<p>That will require a new incentive structure for the software industry, said Yasir Zahid, cybersecurity leader and founding member of Secure.com.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cSoftware ships fast, security reviews happen late, and finding a flaw after release is cheaper in the short term than preventing it at design. So teams stay stuck reacting to individual findings instead of eliminating whole flaw classes at the source.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/yasir-zahid-11805584\/\"><span style=\"text-decoration:underline\">Yasir Zahid<\/span><\/a><\/p>\n<p>Zahid said input validation failures aren\u2019t just a result of developers not knowing about them; rather, the systems they work in don\u2019t enforce safe defaults or catch unsafe patterns before code merges.<\/p>\n<h2 id=\"why-ai-is-a-powerful-incentive-for-secure-by-design\">Why AI is a powerful incentive for Secure by Design<\/h2>\n<p>Zahid said that reordering incentives will require two immediate changes:<\/p>\n<ul class=\"list-bullet\">\n<li class=\"\" value=\"1\">Development tools should make secure coding practices the default so that memory-safe languages, parameterized query libraries, and input-validation frameworks are the easiest path for developers, not additional steps they have to take.\u00a0<\/li>\n<li class=\"\" value=\"2\">Procurement and contracting practices need to demand greater accountability, with vendors demonstrating their Secure by Design practices and assuming greater responsibility for exploitable flaws in the products they ship.\u00a0<\/li>\n<\/ul>\n<p style=\"padding-inline-start:40px\"><em>\u201cRight now, the cost of a vulnerability lands on the customer, not the producer.\u201d<\/em><br \/><em>\u2014<\/em>Yasir Zahid<\/p>\n<p>CISA\u2019s analysis shows that, for the moment at least, the AI-sparked growth in vulnerability discovery has not quite translated into a corresponding expansion of the threat landscape. For instance, the CVE list more than doubled between FY2024 and FY2025 from 14, 234 CVEs to 30,517 CVEs. But the KVE Catalog, which lists exploited flaws, grew only by about 20% over the same period, indicating that attackers concentrated on a relatively small set of vulnerabilities.\u00a0<\/p>\n<p>CISA found that attackers generally aren\u2019t relying on exotic techniques or cutting-edge zero days to compromise organizations. Instead, they are scanning for and exploiting known vulnerabilities and basic security weaknesses that organizations often fail to patch, properly configure, or retire in time.<\/p>\n<p>That concentration of exploited vulnerabilities could become harder to manage if AI-enabled vulnerability discovery expands the pool of flaws that defenders must assess and prioritize.\u00a0<\/p>\n<h2 id=\"is-secure-by-design-the-new-baseline\">Is Secure by Design the new baseline?<\/h2>\n<p>Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, takes it as a warning that CISA states in the report that it is establishing the baseline before AI-enabled vulnerability discovery scales up. <em>\u201c<\/em>At AI speed, organizations still prioritizing by Common Vulnerability Scoring System (CVSS) scores instead of CISA\u2019s newer Stakeholder-Specific Vulnerability Categorization (SSVC) framework won\u2019t keep up,\u201d he said.<\/p>\n<p>The persistence of some vulnerability classes among the top 10 for nearly two decades suggests the industry has been able to absorb the cost of repeatedly discovering and patching flaws that could have been prevented in the first place, Krell said. But AI threatens to change that equation.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cWhen discovery and exploitation scale faster than remediation can respond, eliminating weakness classes during development stops being a security ideal and becomes an operational necessity.\u201d<\/em><br \/><em>\u2014<\/em><a href=\"https:\/\/www.linkedin.com\/in\/jacob-krell\/\"><span style=\"text-decoration:underline\">Jacob Krell<\/span><\/a><\/p>\n<p>The parties who are in the best position to drive change are the buyers of software, not developers or security teams, he said, adding that CISA\u2019s Secure by Demand Guide already lays this out. Enterprise customers and federal agencies can ask vendors which vulnerability classes they\u2019ve eliminated and what the road map looks like for the rest. If they made those questions a hard requirement in every software contract, vendors would treat memory safety road maps as competitive differentiators instead of slide deck promises, he said. \u201cThe lever exists, but buyers aren\u2019t pulling it,\u201d he said.<\/p>\n<h2 id=\"why-the-standards-need-to-evolve\">Why the standards need to evolve<\/h2>\n<p>CISA\u2019s report also raises questions about what Secure by Design should look like in the age of AI, when AI systems and AI agents can act autonomously, often with very permissive privileges.<\/p>\n<p>Ryan McCurdy, vice president at Liquibase, said that Secure by Design also needs to be extended beyond considering vulnerabilities in code. \u201cAs AI agents gain access to databases and other production systems, they can make changes that create real risk without exploiting a vulnerability at all,\u201d he said. <\/p>\n<p>When agents can change permissions, remove a constraint, expose sensitive data, or make a destructive schema alteration using completely valid commands, the focus has to cover both what AI can do and what it can generate, he said.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cOrganizations need to know what changed, whether it was authorized, and whether it meets policy before that change becomes part of a production system.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/ryanmccurdy\/\"><span style=\"text-decoration:underline\">Ryan McCurdy<\/span><\/a><\/p>\n<p>Data integrity is another important Secure by Design concern in the AI era, Aproov\u2019s Miracco said. AI systems are only as trustworthy as the data and inputs they receive, and if attackers use spoofed, manipulated, or unauthorized clients to inject data into backend systems, they can potentially influence downstream analytics, business decisions, or AI models, he said.\u00a0<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cSecure by Design therefore needs to encompass not only confidentiality and availability, but also the integrity and provenance of data entering critical systems.\u201d<\/em><br \/><em>\u2014<\/em>Ted Miracco<\/p>\n<h2 id=\"how-ai-can-bolster-secure-by-design\">How AI can bolster Secure by Design<\/h2>\n<p>James McQuiggan, a security awareness advocate at KnowBe4, said some of the challenges to adopting Secure by Design and Secure by Default principles for AI may be addressed in turn with AI. That\u2019s because AI significantly enhances Secure by Design by automating threat modeling, security testing, and predictive analysis, allowing systems to be built with a deeper understanding of potential risks, he said.<\/p>\n<p>McQuiggan said AI-powered code analysis can help developers identify and fix vulnerabilities early, ensuring that security is embedded from the ground up, as well as enabling more resilient designs that potentially mitigate risks before they become exploits.<\/p>\n<p>Meanwhile, AI can strengthen Secure by Default by adjusting security settings based on real-time threat intelligence, ensuring optimal protection without user intervention.<\/p>\n<p style=\"padding-inline-start:40px\"><em>\u201cAI-driven automation ensures security remains effective over time, preventing misconfigurations and enhancing overall system resilience.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/jmcquiggan\/\"><span style=\"text-decoration:underline\">James McQuiggan<\/span><\/a><\/p>\n<h2 id=\"why-trust-is-no-longer-acceptable-for-appsec\" style=\"text-align:left\">Why trust is no longer acceptable for AppSec<\/h2>\n<p style=\"text-align:left\">Katie Norton, a DevSecOps and software supply chain security analyst with IDC, said baking security into products is a good idea that is reflected in CISA\u2019s Secure by Design initiative, but those benefits do not mean that companies can stop investing in security tools.<\/p>\n<p style=\"text-align:left\">In fact, assuming a product is safe because it has security baked in will be able to secure itself against threats \u201cis a huge red flag,\u201d Norton said.\u00a0That&#8217;s especially true in the AI coding era.<\/p>\n<p style=\"text-align:left;padding-inline-start:40px\"><em>\u201cThat kind of complacency can be just as risky as ignoring security altogether. Security is adversarial by nature, and attackers are constantly looking for creative ways around even the most carefully designed controls. So, while I\u2019m enthusiastic about products that bake in security, I\u2019m skeptical we\u2019ll ever reach a point where we trust the thing to secure itself without external checks.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/katie-d-norton\/\" rel=\"noopener noreferrer\" target=\"_blank\">Katie Norton<\/a><\/p>\n<p style=\"text-align:left\">Software delivery can no longer depend on trust, said Ryan McCurdy, vice president of marketing at Liquibase, because attackers can compromise trusted infrastructure and use it to make malicious changes look legitimate.<\/p>\n<p style=\"text-align:left;padding-inline-start:40px\"><em>\u201cKnowing where a change came from is important, but it doesn\u2019t tell you whether the change itself is safe. The source of the change isn\u2019t what determines risk.\u201d<\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/ryanmccurdy\/\"><span style=\"text-decoration:underline\">Ryan McCurdy<\/span><\/a><\/p>\n<p style=\"text-align:left\">Attestation answers a question about origin. Deciding whether a release is safe to ship or consume takes analysis of the final, assembled artifact using binary-level inspection tools that will catch malware, tampering, and behavior changes that a clean provenance record will never surface.<\/p>\n<p style=\"text-align:left\">Sa\u0161a Zdjelar, chief security officer at Nvidia and former chief trust officer at ReversingLabs, said Secure by Design has helped mature industry conversations about software security. But there&#8217;s still a lot of work needed considering lessons from recent high-profile supply chain attacks. \u201c3CX and SolarWinds have more to do with malware implants and integrity issues than traditional vulnerabilities,\u201d he said.<\/p>\n<p>Those types of software supply chain weaknesses can&#8217;t be found through traditional application security testing (AST) tools or software composition analysis (SCA), Zdjelar said, &#8220;because that&#8217;s just not what they\u2019re designed for.&#8221; Secure by Design is still too wedded to traditional AST and SCA without encouraging better context of how software is compiled and deployed, he said.<\/p>\n<p>For Secure by Design to deliver on it&#8217;s promise, Zdjelar said, organizations need more holistic tools that work for producers and consumers of software \u2014\u00a0akin to how vehicle crash testing evolved. <\/p>\n<p style=\"text-align:left;padding-inline-start:40px\"><em>\u201c[You] wouldn&#8217;t crash-test a radio volume knob and a windows up-down button and a seatbelt separately and a rear car seat separately and a visor separately. You crash-test the vehicle when it&#8217;s been fully assembled so that you know how the system as a whole operates or will perform in that type of environment.\u201d <\/em><br \/>\u2014<a href=\"https:\/\/www.linkedin.com\/in\/sasazdjelar\/\" rel=\"noopener noreferrer\" target=\"_blank\">Sa\u0161a Zdjelar<\/a><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key takeawaysSame old flaws, bigger stakes: ~40% of CISA&#8217;s exploited-vulnerability catalog traces back to well-understood, preventable weaknesses (memory safety, input validation, injection).Attackers aren&#8217;t chasing zero-days: CVE disclosures more than doubled year over year, but exploited vulnerabilities grew only 20% \u2014 known gaps are still the target.AI raises the urgency: it speeds up vulnerability discovery and exploit development, shrinking the window before flaws get found and weaponized.T<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26246","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26246"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26246\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26246"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}