In the realm of software development, AI is proving to be a game-changer. Chris Wysopal, chief security evangelist at Veracode, shared insights into how giants like Google and Microsoft have harnessed AI to generate 30% of their code, thereby boosting developer productivity by 50%. However, this leap in efficiency is not without its challenges. As more AI-generated code emerges, the potential for increased vulnerabilities also grows. Despite maintaining similar security quality to human-written code, the sheer volume of code being produced means more vulnerabilities could arise over time.
To counter these security concerns, AI-based remediation offers a promising solution. By leveraging a large language model (LLM) trained on secure code examples, this approach identifies and rectifies vulnerabilities in AI-generated code. Essentially, the LLM acts as a corrective force, distinguishing between poor and exemplary code to enhance security. Wysopal emphasizes that while AI accelerates code production, it also necessitates vigilant security measures to manage the vulnerabilities that accompany this rapid development.
Veracode’s State of Software Security report highlights a significant improvement in addressing software flaws, with a 20% increase in the last five years alone. This progress is attributed to advancements in security tools and the growing proficiency of development teams. Additionally, Wysopal underscores the influence of regulatory and market pressures on software security, which are driving better practices and more robust solutions.
In a recent interview at the RSAC Conference 2025, Wysopal elaborated on several critical topics. He discussed the rising impact of regulations, strategies for efficiently managing vulnerability backlogs, and the challenges associated with third-party open-source vulnerabilities, which tend to take longer to resolve than issues in first-party code. These discussions underscore the complex landscape of software security in the age of AI.
As a co-founder of Veracode and a former vice president of R&D at the security consultancy @stake, Wysopal brings extensive experience and insight to the field. His work at Veracode focuses on promoting strong security practices and enhancing the company’s industry presence. With a background as an original vulnerability researcher at The L0pht hacker think tank, Wysopal has long been at the forefront of highlighting the risks of insecure software, making significant contributions to the industry’s understanding and management of software vulnerabilities.