By Ilias Kalouptsoglou, ITI CERTH
Software development is undergoing a profound transformation. Generative Artificial Intelligence (GenAI) and AI-powered coding assistants such as GitHub Copilot, ChatGPT, Cursor, Claude, and other emerging tools are increasingly supporting developers in generating code, completing functions, identifying errors, and accelerating everyday programming tasks.
The benefits are clear. Developers can write software faster, automate repetitive programming activities, and receive assistance with technologies or programming languages with which they may be less familiar. As these capabilities advance, AI-generated and AI-assisted code is becoming a common part of modern software development.
But this transformation also raises an important question: Are we securing software at the same pace at which we are generating it?
Application Security in the Age of AI-Generated Code
Application security has always been a fundamental part of developing trustworthy software. Vulnerabilities introduced during software development can eventually be exploited by attackers, potentially affecting the confidentiality, integrity, or availability of applications and the systems that depend on them.
The growing use of AI-assisted code generation makes this challenge even more important. AI coding tools can significantly increase development speed, but generated code is not necessarily secure code. AI-generated suggestions may contain insecure programming patterns, insufficient input validation, incorrect security mechanisms, or other weaknesses. Developers therefore still need to understand, review, test, and secure the code that becomes part of an application.
Moreover, the productivity gains offered by GenAI can substantially increase the amount and speed of software production. More code being produced more quickly means that security assessment mechanisms must also be able to operate at greater speed and scale. Application security therefore needs to evolve alongside AI-assisted software development.
From AI-Generated Code to AI-Assisted Security
Interestingly, AI is not only creating new challenges for application security. It also offers promising capabilities for addressing them. Traditional vulnerability detection techniques, including static and dynamic analysis, remain essential elements of secure software development. AI-based techniques can complement these approaches by learning from large amounts of source code and vulnerability information and by analysing code with greater awareness of its surrounding context.
Recent advances in machine learning, Large Language Models (LLMs), and models specifically designed for source code create opportunities for security tools that can assist developers in identifying vulnerable code, understanding why it may be insecure, and ultimately determining how it could be repaired.
This leads to an important direction (i.e., self-healing direction) for modern application security: using AI not only to help generate software, but also to help secure it.
Vulnerability Discovery and Repair in SECASSURED
This challenge is addressed within the Horizon Europe SECASSURED project, which develops AI-based security services for assurance-driven security engineering. SECASSURED aims to strengthen security throughout the system lifecycle and software supply chain, supporting the secure integration of software, hardware, AI, and third-party components. Rather than treating security assessment as a one-time activity performed at the end of development, the project promotes continuous, assurance-driven security engineering.
Within this framework, secVDR (Vulnerability Discovery and Repair) focuses specifically on application security.
secVDR investigates AI-based mechanisms for analysing source code to identify potential software vulnerabilities. The approach supports vulnerability detection across different programming languages, classification of detected vulnerabilities into recognised vulnerability categories (e.g., Common Weakness Enumeration), and localisation of vulnerabilities within the source code at line-level. Beyond detection, secVDR also investigates AI-assisted vulnerability repair, generating candidate patches and validating whether proposed modifications successfully address the identified security weakness without introducing new problems.
The objective is not to remove developers or security experts from the process. Instead, AI can provide additional capabilities that help them identify and address vulnerabilities earlier and more efficiently as part of the software development lifecycle.
Securing the Next Generation of Software
AI is changing how software is created. The question is no longer whether AI will become part of software development, but how we can ensure that increasingly AI-driven development remains secure and trustworthy.
Faster code generation must therefore be accompanied by faster and more effective security assessment. AI-based vulnerability discovery and repair represents a promising step in this direction. By combining established application-security practices with advances in AI and code-oriented models, developers can gain new tools for identifying vulnerabilities earlier, understanding them more effectively, and accelerating their remediation.
Through secVDR and the broader SECASSURED framework, we are exploring how these capabilities can contribute to continuous, assurance-driven security engineering across the software lifecycle.
As AI helps us write more software, we also need AI and other advanced security technologies to help us make that software more secure.
AI-assisted code generation → secVDR Vulnerability Discovery and Repair → more secure software
