The State of AI in AppSec (2025– 2026)

Application Security (AppSec) still depends heavily on manual work. Security engineers spend countless hours reviewing code, performing design reviews, and managing coordination across development, product, and DevOps teams.

AI has the potential to change this. It can automate tedious workflows, surface insights faster, and allow AppSec teams to scale their coverage without increasing headcount.

The shows that adoption is already widespread. 77% of organizations are actively using AI in their workflows, and 81% plan to increase their use over the next year. Confidence is high, with most respondents expressing at least some trust in AI’s capabilities.

Fastly 2025 AppSec survey

At the same time, oversight is limited. A third of respondents say that half or more of AI-identified issues are acted on without human review.

Many proof-of-concepts have failed to move past the experimentation stage. Tools that looked promising in early demos often fell apart in production.

Proven AI Use Cases in AppSec for 2026

AI is showing real, measurable impact in three AppSec workflows.

1. AI-powered security design reviews

Tools like Seezo SDR are already helping financial services and healthcare companies scale their security design reviews. One financial services client, for example, increased coverage from just 10% of features to 80%, significantly lowering the risk of missing critical security gaps.

These tools augment security architects rather than replace them, allowing teams to analyze more features in less time. AI can also highlight potential architectural risks early, helping teams fix issues before code is written, which is far more cost-effective than post-release remediation.

2. AI-powered triage for SAST and SCA results

AI-powered triage is another strong use case. Modern AppSec programs often produce thousands of findings from static analysis (SAST) and software composition analysis (SCA).

LLMs can analyze scanner output, prioritize true positives, and filter out noise, reducing manual review time.

Companies like Snyk and Semgrep have started integrating AI-based triage directly into their products. It’s not a replacement for scanning, but it’s a clear productivity boost that shortens review cycles.

3. Empowering AppSec engineers with AI tools

AI can make engineers more productive, and in 2026, it’s the easiest way to bring AI into AppSec programs. Chatbots like ChatGPT, Gemini, Claude AI, and code generation tools like Cursor or Claude Code help engineers research vulnerabilities, automate documentation, and write or fix code faster.

When rolling out these tools, there are a few things to keep in mind. AI models should run where your sensitive data lives. If your code or architecture diagrams are inside your network, the models should be too. For example, running Cursor with Claude via AWS Bedrock on your own deployment and keys ensures data privacy and compliance.

AI outputs should support engineers, not replace them. Treat results as suggestions or drafts, and remember that engineers are still responsible for accuracy, completeness, and risk decisions.

Used thoughtfully, they can cut down repetitive work, speed up investigations, and free engineers to focus on higher-value security tasks.

Like AI-powered triage for SAST and SCA, they don’t replace expertise but make teams faster and more effective.

The goal is to enable AppSec teams, not to outsource critical thinking to a model.

Promising but Emerging Areas

AI is moving fast, but not every new tool lives up to the hype. Two areas to watch closely in 2026:

Automated penetration testing

Vendors like Horizon3 and X-Bow are building AI-driven penetration testing systems that mimic manual testers, and even established tools like BurpSuite are starting to add AI capabilities. PortSwigger's research shows how AI can help document and summarize pentest findings more efficiently, making it easier for teams to act on results.

Early benchmarks look promising, but real-world results are still mixed.

Challenges include:

Reproducibility: AI-generated attack paths can vary across runs, making results hard to validate. Contextual Understanding: AI struggles with business-logic vulnerabilities and environment-specific setups that human testers navigate intuitively. Cost: High compute and token requirements make continuous deployment expensive. Integration: Many tools function as black boxes, limiting CI/CD integration and evidence tracking for compliance.

These tools are best used to augment human testers, accelerating reconnaissance and generating hypotheses, while humans handle verification and remediation. Treat this as an area for experimentation, not replacement.

2. LLM-powered static analysis

Challenges include:

Explainability: Findings are often difficult to trace to specific code paths or patterns.

Consistency: Results can vary across runs, complicating CI/CD integration and regression testing.

Scalability: Large codebases require significant compute and can introduce scanning delays.

There are 3 kinds of companies worth watching closely in this space

Code-generation platforms like Claude Code are building their own security review tooling as part of the broader developer workflow.

Established SAST vendors such as Snyk and Semgrep are layering AI intelligence AI capabilities on top of traditional rule-based scanning.

LLM-native security startups like Dryrun and Corgea are rethinking static analysis entirely, using language models to reason about code semantics rather than syntax rules.Consistency, explainability, customization, and compute requirements remain key challenges. Expect major movement in 2026, but these areas should be treated as pilots to support human testing, not replace it. The winning model is not clear yet.

How Not to Use AI in AppSec

AI adoption often stumbles because teams treat it as a black box. Here are three common mistakes and why they matter.

Removing humans from the loop

AI can process large volumes of data quickly, but it lacks organizational context and the reasoning behind a security decision. Relying only on AI findings risks overwhelming developers with false positives and irrelevant alerts, which leads to alert fatigue and disengagement.

Human review provides judgment, prioritization, and trust. AppSec programs succeed when findings are accurate and actionable, and precision is always more valuable than volume.

Ignoring cost visibility

While token costs are falling, “invisible” AI usage can quietly balloon budgets. For example, running large language models on every pull request or pipeline step can rack up thousands in monthly costs if left unchecked. AppSec leaders are accountable not only for risk reduction but also for predictable spend.

Monitoring token usage per request or per tool integration provides transparency and helps teams balance coverage with efficiency. AI should amplify security, not become another source of financial unpredictability.

Overpromising outcomes

It’s tempting to pitch AI as a quick fix: “Turn it on and your AppSec problems go away.” But AI doesn’t replace broken processes, weak governance, or poor developer engagement. In reality, it works best as an accelerator inside a healthy program.

For example, using AI to triage findings, generate remediation guidance, or accelerate threat modeling makes strong workflows even stronger. But if those workflows are absent, AI just automates the chaos. Treat AI as a force multiplier, not a silver bullet.

Conclusion

AI is definitely changing how AppSec teams work, but adoption is still uneven. Security design reviews and triage are ready for prime time, while pen testing and AI-driven static analysis are still finding their footing.

The next 12 months will decide which tools and practices define AppSec automation for the decade ahead.

At Seezo, we focus on practical adoption: applying AI where it delivers measurable value while keeping humans accountable. Seezo’s Security Design Review (SDR) platform helps teams scale architecture reviews safely and efficiently, without losing context or control.

Move beyond experimentation. Explore to see how teams are applying AI to real design reviews today.

Book a Seezo walthrough

Have questions or want to learn more about how Seezo can help your team? Reach out to us directly: hi@seezo.