Application security has quickly become a massive priority among enterprise security initiatives. AppSec is currently racing towards a head-on collision with the rapid rise of AI, and in particular Generative AI (GenAI). The question is – how will AppSec change in the face of AI, and how will your partners harness it?

When looking at any developing technology, the two questions that a security professional should ask are the same: How can that help us? And how will it hurt us? GenAI is, in a sense, a new automation technology. It can provide incredible efficiencies for AppSec and development teams. However, it can also create and expose security vulnerabilities, and become a powerful tool for malicious actors. 

Recognizing these challenges and opportunities, we are focusing on building the AI-powered AppSec platform of the future - both to empower you and your teams with AI, and to protect you from it. This post offers a deep look at our vision, highlighting our dual focus on streamlining the developer experience and safeguarding against emerging AI-powered threats.

Making AppSec Easier for Developers

The cornerstone of our strategy revolves around our dedication to improving developer efficiency. We are committed to enhancing the overall experience that developers have with application security, making their jobs easier and apps more secure. 

Most developers don’t have much experience with application security; therefore, they often do not have the knowledge to quickly remediate a vulnerability. Coming up with a solution can be difficult and time-consuming. Checkmarx has typically addressed this through Codebashing, our interactive security learning and development program. The addition of the GenAI-based Guided Remediation feature to our platform allows developers to quickly interpret, and act on, security scan results, drastically reducing the time between spotting and addressing vulnerabilities.

Making AppSec easier for AppSec teams with AI

One of the core challenges in the field of AppSec lies in its very nature. AppSec is, by definition, the intersection of two different disciplines: application development and security. Every application is different. Despite the use of open-source software, the variations in codebases are endless. This can lead to low accuracy results from many AppSec tools. Therefore, these tools should be tuned and customized for each application they interact with to properly find vulnerabilities with a low rate of false positives. Many AppSec teams don’t have the skillset to do this in the first place, and for those that do it can still take time and energy from both AppSec and development teams. Clearly, there are multiple roles here for AI to play.

First, there is an opportunity for GenAI to address the skills and resource gap in AppSec teams. At Checkmarx, we’ve just unveiled new GenAI features in the platform to alleviate the need for security professionals to spend hours mastering intricate query languages. Through the Checkmarx One platform, you can now generate custom security queries with ease, ensuring better security outcomes and a more user-friendly experience.

The increasing number of necessary AppSec tools, combined with the proliferation of new applications and microservices-style codebases, has led to a glut of vulnerability data coming from different sources in different formats. This creates a major challenge for AppSec and development teams in prioritizing where to focus their efforts. This presents a massive opportunity for AI to sift through this data, correlate the results, and present AppSec teams with reliable guidance on where to prioritize. 

AI’s Role in the Evolution of Software Supply Chain Security

Historically, any major change in architecture, technology, and tooling has introduced new vulnerabilities and new threats from malicious actors. AI is no different. When added to the developer workflow, AI introduces potential new vectors for attackers to take advantage of. This is leading to new threats, particularly in the emerging field of software supply chain security.

We are at the forefront of identifying and countering these AI-specific threats, with examples such as:

• AI Hallucinations: These are false data points or patterns that AI models might "perceive" due to adversarial inputs or misinterpretations, which can be exploited by malicious actors.
• Prompt Injections: Threat actors can manipulate AI models by introducing or “injecting” specially crafted prompts, tricking the system into undesired behaviors or outputs.
• AI Secret Leakage: There's a potential risk of AI models inadvertently revealing confidential information they were trained on, offering a goldmine for cybercriminals.

It's crucial for developers and AppSec teams to understand that generated code isn't inherently safer than open-source code. Many code generation tools rely on open-source materials, which can have their own set of vulnerabilities. Recognizing the risks of external code sources, we aim to guide developers through the complexities of using code from open-source platforms and AI-generated systems. By collaborating with large language models such as ChatGPT, we empower developers to securely leverage AI code generation tools to scrutinize their generated code. This proactive approach helps in identifying potential vulnerabilities, especially in code sourced from open-source materials.

So, what now?

In the complex realm of application security, our AI-driven approach stands out as both innovative and essential. By enhancing developer skills and providing tools to combat emerging threats, we are not only shaping the present but also envisioning a safer future for application security. 

To hear more about Checkmarx’s AI vision and strategy, join us at our upcoming Deep Dive Webinar, AI-Powered AppSec, on November 7, 2023.