Four Steps for CISOs to Keep AI-Generated Code Secure and Compliant

The argument over whether generative AI belongs in software development is, by the account of this SecurityBrief Australia piece, finished. After roughly two years of fast adoption, AI-generated code is an established part of enterprise development. The question now facing chief information security officers is how to keep software secure and compliant as generative AI, and increasingly autonomous AI agents, write a larger share of it.

The backdrop is familiar. Generative AI became broadly accessible with the release of ChatGPT in November 2022, followed quickly by other large language models, and developers started using it for code almost immediately. The productivity gain was obvious from the start. Some early studies concluded that AI-generated code was as secure as human-written code, or even more so.

That did not settle the matter, because human developers make mistakes too. The article locates the real risk in how often, and how quickly, errors could propagate into production software. Outcomes depend heavily on deployment and governance. Developers with strong security skills working inside a clearly defined framework can use AI to produce more accurate, secure code from the outset. Organisations that adopt the tools without safeguards risk introducing vulnerabilities at unprecedented scale, and could end up with a growing backlog of flaws, rising remediation costs and greater compliance exposure.

For CISOs, that shifts the job. The priority is moving away from controlling whether AI coding tools get adopted and toward setting the architectural principles, governance controls and development practices that allow them to be used securely. Alongside this, organisations are also embracing Model Context Protocol (MCP), which adds to the risks to be managed.

The piece points to a four-phase roadmap from Gartner. Phase one is to address cybersecurity debt. Phase two is to strategically expand existing cybersecurity controls. Phase three is to extend controls to AI-specific requirements. Phase four is to develop a forward-looking plan for securing future AI use. The article stresses that this is a starting point organisations can adopt now, not a final destination.

On the practical side, developers need clear guidance. A list of trusted LLMs and a list of appropriate tools is described as a good starting point, with the tools focused on foundational security best practices and on the observability and traceability of developer security skills. Organisations should also check the security efficacy of the AI tools they choose. Developers should be able to use them for developer-led threat modelling, not only for generating code, which can keep many errors out of the pipeline.

Governance matters just as much. A lack of visibility and oversight can breed shadow AI and the spread of insecure code, so the article recommends tooling that gives deep observability into which AI tools and MCPs are in use. On the people side, an ongoing learning program can build safe use of AI early in the software development lifecycle. CISOs can offer hands-on, real-world secure coding training, track how developers acquire skills, and watch their commits to see how well they apply them daily, including how well they check AI output. Benchmarks can set the required skills and measure progress.

Tools such as GitHub Copilot and Cursor are becoming embedded across industries. That, the article argues, reinforces the case for making security a fundamental part of the lifecycle rather than an afterthought. The markers to watch are trusted-LLM lists, developer skills benchmarks, and visibility into the AI tools and MCPs in use.