2024年预测：人工智能与网络安全-将颠覆变为机遇

GartnerResearch

Predicts2024:AI

&Cybersecurity—TurningDisruptionIntoanOpportunity

JeremyD’Hoinne,AvivahLitan,NaderHenein,MarkHorvath,AkifKhan,RobertsonPimentel,BartWillem-sen,DennisXu,WilliamDupre

4December2023

Gartner

Predicts2024:AI&Cybersecurity—TurningDisruptionIntoanOpportunity

Published4December2023-IDG00800663-27minread

ByAnalyst(s):JeremyD'Hoinne,AvivahLitan,NaderHenein,MarkHorvath,AkifKhan,RobertsonPimentel,BartWillemsen,DennisXu,WilliamDupre

Initiatives:CyberRisk;MeetDailyCybersecurityNeeds

GartnerpredictsthatAIwilldurablydisruptcybersecurityin

positiveways,butalsocreatemanyshort-termdisillusions.

Securityandriskmanagementleadersneedtoacceptthat2023wasonlythestarterforgenerativeAI,andprepareforits

evolutions.

Overview

KeyFindings

■GenerativeAI(GenAI)isthelatesttechnologyinalonglineofproclaimeddisruptivetechnologiespromisingtofulfilltheongoingdesirefororganizationstodrasticallyincreaseproductivitymetricsforallteamsviaautomationoftasks.

■Today,mostGenAIfunctionsbuiltintosecurityproductsarefocusedonadding

naturallanguageinterfacestoexistingproductstoimproveefficiencyandusability,butpromisesoffullautomationstarttoappear.Pastattemptstofullyautomate

complexsecurityactivities,includingusingmachinelearningtechniques,haverarelybeenentirelysuccessfulandcanbeawastefuldistractiontoday,andwithshort-termdisillusions.

■GenAIisatpeakhype,drivingveryaggressivepredictionsbasedonthestateofthetechnologytoday.Thisleadstounrealisticdisruptionclaims,butalsoignoresnextstepsinGenAIevolution,suchasmultimodalmodelsandcompositeAI.

■TheinitialforaysbycybersecurityvendorsintogenerativeAIofferonlyalimited

glimpseofthetechnology'spromiseandmightnotbethebestindicationofwhatthefuturecouldbe.

Gartner,Inc.|G00800663Page1of23

Recommendations

Securityandriskmanagement(SRM)leadersinchargeofdevelopingcybersecurityroadmapshould:

■ConstructamultiyearapproachforprogressivelyintegratingGenAIfeaturesand

productswhentheyaugmentsecurityworkflows.Startwithapplicationsecurityandsecurityoperations.

■EvaluateefficiencygainsintandemwiththecostofGenAIimplementations,and

refineyourdetectionandproductivitymetricstoaccountfornewGenAIcybersecurityfeatures.

■PrioritizeinvestmentsinAIaugmentationoftheworkforce,notjusttaskautomation.Prepareforshort-termincreasedspendandlong-termskillrequirementschanges

duetoGenAI.MonitorpotentialshiftinattacksuccessduetoGenAI.

■Accountforpotentialprivacychallengesandbalanceexpectedbenefits,withrisksassociatedwithcumulativecostinthevaluationoflarge-scaleGenAIadoptioninsecurity.

StrategicPlanningAssumptions

By2028,multiagentAIinthreatdetectionandincidentresponsewillrisefrom5%to70%ofAIimplementationstoprimarilyaugment,notreplacestaff.

Through2025,generativeAIwillcauseaspikeofcybersecurityresourcesrequiredto

secureit,causingmorethana15%incrementalspendonapplicationanddatasecurity.

By2026,40%ofdevelopmentorganizationswillusetheAI-basedautoremediationofinsecurecodefromASTvendorsasadefault,upfromlessthan5%in2023.

By2026,attacksusingAI-generateddeepfakesonfacebiometricswillmeanthat30%ofenterpriseswillnolongerconsidersuchidentityverificationandauthenticationsolutionstobereliableinisolation.

By2028,theadoptionofgenerativeaugmentswillcollapsetheskillsgap,removingtheneedforspecializededucationfrom50%ofentry-levelcybersecuritypositions.

Gartner,Inc.|G00800663Page2of23

Analysis

WhatYouNeedtoKnow

PredictionsarestatementsofGartner’spositionsandactionableadviceaboutthefuture.ThisresearchhighlightsGartnerPredictsrelevantforsecurityandriskmanagement

leaderswhohavetonavigateaggressiveclaimsthatGenAIisdisruptingcybersecurity.

Pastexperiencesleadtoskepticismgivenprevious“AIwashing,”whichcausedexpensiveinvestmentsthatdidn’tdeliverexpectedresults.

In4WaysGenerativeAIWillImpactCISOsandTheirTeams,Gartnergivesrecommendationsonareasofimmediatefocusforsecurityleaders:

■ManagetheconsumptionofhostedandembeddedGenAIapplications.

■UpdateapplicationsecuritypracticestoAIapplications,usingAItrust,riskandsecuritymanagement(AITRiSM)technologies.

■AssessthefirstwaveofGenAIannouncementsfromcybersecurityproviders,andputaplantointegratenewfeaturesandproductswhentheyaremoremature.

■AcknowledgethatmaliciousactorswillalsouseGenAIandbepreparedforunpredictablechangesinthethreatlandscape.

Excessivehypedamagesourperceptionoftimeandbalance,butroadmapplanningrequiresthatcybersecurityleadersfactorinallpossibilities,withoutastrongfactbasethatbalancescybersecurityrealitieswithGenAIhopesorpromises(seeFigure1).

Gartner,Inc.|G00800663Page3of23

Figure1:BalancingCybersecurityRealitywithGenAIHopes

Thecybersecurityindustryhaslongbeenobsessedwithfullyautomatedsolutions.ThehypesurroundingGenAIalreadyledtounrealisticpromises,potentiallydamagingthecredibilityoflonger-termimprovementscomingfromfuturefeaturesandproducts.

2023wastheyearofGenAIannouncements,2024shouldbetheyearofminimumviableproducts;2025mightbethefirstyearofGenAIintegrationinsecurityworkflowsdeliveringrealvalue.

AsstatedintheHypeCycleforGenerativeAI,2023,“Severalinnovationshaveafive-to10-yearperiodtomainstreamadoption.”Thisisthecasefor“autonomousagents”and

Gartnerbelievesthatcybersecurityleadersfocusingonhumanaugmentationwillachievebetterresultsthanthosejumpingtooquicklyonsolutionspromisingfullautomation.

Intheshorterterm,we’llobserveexpansionsofcybersecurityusecasesfromexperimentsofmultimodalGenAI(i.e.,learningfrommorethantextcontent)andwillimproveour

abilitytomeasureproductivitygains(seeInnovationInsight:MultimodalAIExplained).

Gartner,Inc.|G00800663Page4of23

StrategicPlanningAssumptions

StrategicPlanningAssumption:By2028,multiagentAIinthreatdetectionandincident

responsewillrisefrom5%to70%ofAIimplementationstoprimarilyaugment,notreplacestaff.

Analysisby:JeremyD’Hoinne,DennisXuKeyFindings:

■MorethanathirdofthefirstwaveofannouncementsonGenAIincybersecurityrelatetosecurityoperationactivities.Toutedcapabilitiesrangefrombasic

interactivehelppromptstonewdedicatedproductannouncementsaimedat

becomingtheprimaryinterfaceforincidentresponseandpostureassessments.

■Fullautomationofthreatdetection,alerttriageandincidentresponsesarethe“reachthemoon”objectivesofmanythreatdetection,investigationandresponse(TDIR)

initiatives.

■HistoryoftenrepeatsandGenAIsparksthesameoverly-optimistichopesforsecurityoperations,similartowhatunsupervisedmachinelearningdidforthreatdetection

morethanfiveyearsago.

■Conversely,teamswithahighermaturitymightimprudentlydismissgenerativecybersecurityAI,basedontheearlyandimmatureimplementationsoflarge

languagemodels(LLMs)intheformof“SOCassistants”prompts.

Near-TermFlag:

Through2024,lessthanathirdofgenerativecybersecurityAIimplementationwillleadtosecurityoperationproductivityimprovementsforenterprises,generatingmorespend.

By2026,theemergenceofnewapproaches,suchas“actiontransformers,”combinedwithmorematureGenAItechniqueswilldrivesemiautonomousplatformsthatwillsignificantlyaugmenttasksexecutedbycybersecurityteams.

MarketImplications:

Buildingstrongsecurityoperationsisdifficult,evenforlargerandwell-funded

organizations.Pickingtherightmixoftools,servicesandinternalstaffwillsufferif

cybersecurityteamsinvesttimeontoolsthatdon’tdelivertotheirpromiseofautomation.Gartner,Inc.|G00800663Page5of23

We'veobservedthispreviouslywhenimplementationsofunsupervisedmachinelearningforthreatdetectionpromisedtowipeoutfalsepositivesandenableautomatedresponse.Ittookyearsforthetoolstomature,andforsecurityoperationteamstotunethemand

narrowdownautomatedblockingtothefewusecaseswhereitworked.WithLLMstoday—andautonomousagents,multimodalandfoundationmodelsinthefuture—

organizationsfaceasimilarchallenge.EarlyclaimsofGenAIawesomenessdivert

expectationsfromincrementalimprovementsandteamaugmentationtolesslikelybigshiftsinautomation,skillrequirementsandstaffversustoolbalance.

Gartneranticipatesshort-termGenAIdisillusions,especiallyin

2024,whereexternalpressuretoincreasesecurityoperation

productivitywillcollidewithlowmaturityfeaturesandfragmentedworkflows.

Symptomsofill-preparedGenAIintegrationwillinclude:

■AbsenceofrelevantmetricstomeasureGenAIbenefits,combinedwithpremiumpricesforGenAIadd-ons.

■DifficultiestointegrateAIassistantsinexistingcollaborationworkflowwithinthesecurityoperationteams,orwhenpartneringwithathird-partysecurityoperationprovider.

■Quicklygrowing“promptfatigue:”toomanytoolsofferinginteractiveinterfacetoqueryaboutthreatsandincidents.

Withtime,newAIapproaches—combinedwithothernon-AItechniqueswhererelevant—mightbringsecurityoperationsclosertoautonomousdecisionsforidentifiedusecases.EmergingAItechniquessupportingthispromiseinclude:

■Multiagentsystems(MAS):TypeofAIsystemscomposedofmultiple,independentbutinteractiveagents.

■Actiontransformers:Modelsthatlearnfromhumanactions.

■Autonomousagents:Self-promptingagentsthatcantakeactionsbasedonLLMsrecipes.

Gartner,Inc.|G00800663Page6of23

Althoughthemythoffullyautomatedresponseandself-healingorganizationsmight

nevertrulyturnintoreality,Gartnerbelievesthatthecombinationofothertechniqueswithmultiagentapproacheswillhaveabigimpactonsecurityoperationsandsecurityin

general.Deploymentsaimedatbothaugmentinghumantasksandaddingprecisionandspeedtohumaninvestigationswillbemoreeffectivethansingle-techniqueAIanalyticsdrivingfullyautonomousresponses,suchasautomatedcontainmentfortheforeseeablefuture.

Recommendations:

■NavigatethechaosofnewlyannouncedGenAIfeaturesinsecurityproductsby

introducingbusinessvalue-drivenAIevaluationframeworks,whichmeasureimpactontangiblemetricssuchasspeed,accuracyandproductivity.

■RunGenAIpilotsprimarilyforincidentresponseandexposuremanagementusecasesthatarenotrealtimeinnature.Setrealisticshort-termobjectives,suchasfalsepositivereductionoropportunitiestoextendstaffrecruitmenttoslightlylessspecializedprofiles.

■Protectthesecurityoperationteamasmuchaspossiblefrommandatesoriginatingoutsideofthesecurityteamtofullyautomateresponseandvulnerabilitytreatmentprocess.Thiswillhelpavoidresistancewhenyouneedtoimplementpromising

GenAItechniqueslater.

■Belucidaboutsecurityproviders’strategytouseGenAIasaclaimeddifferentiatortopromotelargeplatformsleadingtovendorlock-in.

■Don’tneglectproviderevaluationrequirementstoaddressprivacy,copyright,traceabilityandexplainabilitychallenges.

RelatedResearch:

4WaysGenerativeAIWillImpactCISOsandTheirTeamsHypeCycleforArtificialIntelligence,2023

HypeCycleforGenerativeAI,2023

Busting4MythstoUnlockMoreCybersecurityValue

Gartner,Inc.|G00800663Page7of23

StrategicPlanningAssumption:Through2025,generativeAIwillcauseaspikeof

cybersecurityresourcesrequiredtosecureit,causingmorethana15%incrementalspendonapplicationanddatasecurity.

Analysisby:AvivahLitan,JeremyD’HoinneKeyFindings:

■GartnerresearchshowsthatmostenterpriseshavenotyetformalizedacceptableusepoliciesforGenAI,sosecurityandriskmanagersdonotyethaveaframeworkforinstitutingtechnicalcontrols.1

■Integratinglargelanguagemodels(LLMs)andothertypesofmodels,suchas

foundationmodelsinenterpriseapplications,bringnewrisksinthreecategories:contentanomalies,dataprotectionandAIapplicationsecurity.

■Almost90%ofenterprisesarestillresearchingorpilotingGenAI,andmostofthosehaveyettoputAITRiSM(trustriskandsecuritymanagement)technicalcontrolsorpoliciesinplace.

■VendorshostingGenAImodelsdonotalwaysprovideacompletesetofcontrolsthatmitigatetheserisks.Instead,usersneedtoacquiresolutionsthataugmenthostingvendors’limitedcontrols.

■ITleadersmustrelyonhostingLLMvendorswithprotectionoftheirdata,withouttheabilitytoverifytheirsecurityandprivacycontrols.

MarketImplications:

Theuseofthird-partyhostedLLMandGenAImodelsunlocksmanybenefits,butusers

alsomustcontendwithnewuniquerisks,requiringnewsecuritypracticesinthreeprimarycategories:

Gartner,Inc.|G00800663Page8of23

■Contentanomalydetection

■Unacceptableormalicioususe

■Unmanagedenterprisecontenttransmittedthroughpromptsorothermethods,resultingincompromiseofconfidentialdatainputs

■Hallucinationsorinaccurate,illegal,copyright-infringingandotherwise

unwantedorunintendedoutputsthatcompromiseenterprisedecisionmakingorcanleadtobranddamage

■Dataprotection

■Dataleakage,integrityandconfidentialitycompromisesofbothcontentanduserdatainhostedvendorenvironment

■Inabilitytogovernprivacyanddataprotectionpoliciesinexternallyhostedenvironments,orevencontractserviceprovidersasdataprocessors

■Difficultyconductingprivacyimpactassessmentsandcomplyingwithvariousregionalregulations,duetotheblackboxnatureofthethird-partymodelsandthemostlyabsentpossibilitytoofficiallycontractthesemodelprovidersas

dataprocessors,followingprivacylegislativerequirements

■AIapplicationsecurity

■Adversarialpromptingattacks,includingbusinesslogicabusesanddirectandindirectpromptinjections

■Vectordatabaseattacks

■Hackeraccesstomodelstatesandparameters

Ourrecentsurveyofover700webinarattendeesonwhatGenAIriskstheyaremost

concernedaboutvalidatedtheseriskcategories—andhighlightedthatprivacyanddatalossarethetoprisksfromITleaders.1

TheserisksareexacerbatedwhenusingexternallyhostedLLMandotherGenAImodels,asenterpriseslackcapabilitiestodirectlycontroltheirapplicationprocessesanddatahandlingandstorage.However,therisksstillexistinon-premisesmodelshostedand

directlycontrolledbytheenterprise—especiallywhensecurityandriskcontrolsarelacking.

Gartner,Inc.|G00800663Page9of23

ThesethreecategoriesofrisksconfrontusersduringruntimeofAIapplicationsand

models.Figure2showshowthesethreerisksaffectAImodeldevelopmentand

deployment,theAImodelatruntime,plustheeffectfromAIrisksintheITsupplychain.

Thisincludestrainingdata,third-partymodels,codeandlibraries,andpromptandmodelintegrations.

Thesenewattacksurfaceswilldriveenterprisesecuritydepartmentstospendtimeand

moneyimplementingGenAIsecurityandriskmanagementcontrols,suchthatapplicationanddatasecurityspendingwillincreaseatleast15%through2025.

Figure2:GenerativeAIAttackSurfacesAcrosstheAILifeCycle

Gartner,Inc.|G00800663Page10of23

Gartnerexpectsthatmanyenterpriseswillinitiallyacquiresolutionsthatmitigate

input/outputrisksthroughanomalydetectionorsecureAIapplicationstogainvisibilityintoenterpriseuseofGenAIapplicationsandmodels.Thisincludesuseofoff-the-shelfapplications,suchasChatGPTorinteractionsthroughotherintegrationpointslikeplug-ins,promptsorAPIs.GettingtheirarmsaroundenterpriseinteractionswithGenAIisthefirstpriorityfororganizations,andtheseproductscanprovideagoodmapofthose

interactions.Oncethemapisestablished,corefunctionsofmitigatingrisksandsecuritythreatscanbegraduallydeployed.Thisallhasmajorimplicationsonsecuritystaffingandbudgets;henceourpredictionthatsecuritybudgetswillincrease.

Recommendations:

■OrganizewithinandacrossyourenterprisetomanagenewGenAIrisksandsecuritythreats.Onceorganized,establishacceptableGenAIusepoliciesforyourenterprise,andenforcethemonacontinualbasisinpartusingAITRiSMtechnology.

■SetupproofsofconcepttotestemergingAITRiSMproducts,specializedinGenAIinthethreenewriskandsecuritycategoriestoaugmentyoursecuritycontrols,and

applythemtoproductionapplicationsoncetheyperformasrequired.

■Usecontentanomalydetectionproductsthatmitigateinputandoutputrisksto

enforceacceptableusepolicy,andpreventunwantedorotherwiseillegitimatemodelcompletionsandresponsesfromcompromisingyourorganization’sdecision

making,safetyandsecurity.

■PerformuserawarenesstrainingtoreminduserstoalwaysvalidatetheoutputofGenAIproductsforaccuracybeforeincorporatingthemintobusinessworkflow.

■EvaluatetheuseofAIapplicationsecurityproductstoprotectyourorganization

fromhackerswhoexploitnewGenAIthreatvectorstodamageyourorganizationanditsassets.

■Continuetouseknownsecuritycontrolstoprotectsensitiveinformation,applicationstacksandassets,butrecognizetheydon’tmitigaterisksuniquetoLLMs,suchasinaccurate,inflammatoryorcopyrightedoutputsinresponses.

RelatedResearch:

4WaysGenerativeAIWillImpactCISOsandTheirTeams

InnovationGuideforGenerativeAIinTrust,RiskandSecurityManagement

Gartner,Inc.|G00800663Page11of23

GenerativeAIPolicyTemplate

MicrosoftAzureOpenAIvs.OpenAI:ComparingGenAITrust,RiskandSecurity

QuickAnswer:HowtoMakeMicrosoft365CopilotEnterprise-ReadyFromaSecurityandRiskPerspective

StrategicPlanningAssumption:By2026,40%ofdevelopmentorganizationswillusetheAI-basedauto-remediationofinsecurecodefromASTvendorsasadefault,upfromlessthan5%in2023.

Analysisby:MarkHorvathKeyFindings:

■Although80%ofvendorsofferingApplicationSecurityTesting(AST)havesome

formofsuggestingfixestocodebasedonsecurityproblems,(autoremediation),lessthan5%ofdevelopmentorganizationsuseit—inpartbecausethesolutionsit

offersaregenerallyexamples,ratherthanactualcodefixes.

■Developerscomplainthatautoremediationsuggestedbycodesecuritytools(ASTtools)oftenhaveadversesideeffectsonotheraspectsoftheircode,like

performanceandreliability.BecausemostdevelopershaveKPIsaroundthesecodeaspects—andlessstringentonesaroundsecurity—theyviewthesesuggestionsnegatively.

■Developerscanfeeloverloadedbythenumberofplug-instotheirdeveloper

environment—eachofferingadviceonaspecificparameter(e.g.,codequality

assessments,performanceandoptimizationsuggestions,etc.).AnynewadditionstotheIntegratedDevelopmentEnvironment(IDE)willneedtosynthesize

suggestionsbasedontheinputofmorethanoneautocorrectiontool.

Near-TermFlag:WhilemanyAI-basedsecurecodeassistantsareplannedorarein

development,theiradoptionbyreal-worldproductionteamsin2024,asopposedtopilotsorproofsofconcept(POCs),willbealeadingindicatorthattheyofferanadvantageoverexistingsystems.

MarketImplications:

Gartner,Inc.|G00800663Page12of23

Currently,theapplicationsecuritytestingmarketiscenteredaroundahandfulofcore

toolsusedfordeterminingelementsofcodesecurityrisk(e.g.,SAST,DAST,IAST,SCA,IaC,etc.).Althoughtheyinterfacewithdevelopersonadailybasis,theyareprimarilysecuritytoolsandweredesignedtobeusedby,andfor,securityprofessionalsworkingwith

developers.Theyareoftenheavyintermsoftechnicalsecurityjargonandassumethatdevelopershaveanunderstandingofthedata,andareabletoactionittoreducesecurity

risk.However,thereisoftenaconsiderablegapbetweenthesecuritytrainingthatdevelopersreceive,andreal-worldcodesecurityissuesthatoftendon’tlookliketheexamplestheyaretaught.

RemediationguidancefromstandardASTtoolsisusuallyintheformofautocorrection,whichworksinwayssimilartoaspellchecker(e.g.,isthislineformattedcorrectly)?

Guidancetothedeveloversisusuallyspecificonlytosecurity,andonlytothelineorlinesinquestion.Itfailstoprovideamorecomprehensiveanalysisofdifferentaspectsofthecodeinalargercontext.Thisresultsinfairlygenericadvice,usuallyreflectingtheOWASPtop10asthebasisofrepair.

Largelanguagemodels(LLMs)havetheadvantagethattheyarenotonlyabletomore

easilydealwithmultiplecodemetricslikesecurity,qualityandreliability,theyarevery

flexibleinthewaytheycanpresentthedataandsuggestionstodevelopers.LLMshavethepromiseofbeingabletoconvertsecurityjargonintoaneasiertounderstandformat,leadingtoabetterunderstandingoftheissueandamoreeffectivefix.Thecurrent

generationofcodesecurityAIsofferadeveloperachoiceofseveraldifferentsuggestionsforaddressingvulnerabilities,puttingthedeveloperinchargeofpickingthetypeof

remediationthatbestfitsintotheapplication,thuspreservingthe“ownyourcode”philosophy.Thishasseveraladvantages:

■AIsandpeopleoftenworkbettertogetherthaneitheronealone.TheAIassistant

offersabroader(andpotentiallydeeper)viewofavulnerabilities’securityposture,whilethehumanunderstandstheapplication’scontext,goalsandworkflows.TheAIassistantallowsabetterselectionofpossibleremediations,whilekeepingthe

application’sfunctioninmind.

■Bypresentingmultipleoptionstothedevelopers,theycanmoreeasilyrecognizeandfilteroutmisidentifications/hallucinationsfromtheAIassistant.

Gartner,Inc.|G00800663Page13of23

■NoneoftheautoremediationoptionsavailablefromASTtoolseffectivelyinclude

parameterslikeperformance,codequality,reliabilityetc.,whicharebothimportanttodevelopmentteamsandwell-correlatedwithsecurityfindings.NewAI-basedcode

assistantscanoptimizeseveralvariablesbeyondjustsecuritytogivedevelopersmoremotivationinlinewiththeirdevelopmentKPIs.

Recommendations:

■MostenterprisesshouldnotusegenericLLMslikeChatGPTforcodegeneration,

codesecurityscanningorsecurecodereview,duetothehighererrorratesoftoolsnotspecifictosecurity.Instead,relyontoolsthatofferenterprisegradesecurityandgovernancecontrolsforassistingdeveloperswithtechnicaltaskslikesecurity.

■PilotnomorethantwoorthreedifferentAIsecuritycodeassistantstocompareandcontrasttheircapabilities.Thoughproductsarerecentlybecomingcommercially

available,themarketstillhasalongwaytogobeforethesearecommontools.Thecurrentgenerationhasstrengthsandweaknessesindifferentareas,sohave

developmentteamstestthemouttodeterminethemosteffectiveonesforyourorganization.

■Maintainingtheexistingdeveloperexperienceiscriticaltothesuccessfuladoptionofanydeveloperfocusedtools.Changesinworkflow,experienceortestingworksagainstthe“musclememory”ofdevelopersandgeneratesfriction,whichwill

frustratedeveloperswhowillthenavoidusingthetools.

■RememberthatthesetoolsuseanLLM,whichwillneedperiodicretraining.Whenchoosingavendor,askspecificallyaboutprivacy,dataretentionandretraining

detailstoprotectyourIP.AskaboutindemnificationaroundIPloss,licensingissueswithsomecodeoraccidentallyre-usinganothercompany’sIP.

■AICodingAssistantsarerapidlybecomingapopularwayfordeveloperstowritebettercodeatafasterrate.BesuretorunStaticAnalysis(SAST)andSoftware

CompositionAnalysis(SCA)oncodethathasbeengeneratedbyAI.Thiswillhelpensurecodequality,protectIPrightsandcutdownonAImistakesand

misrepresentations.

RelatedResearch:

Gartner,Inc.|G00800663Page14of23

QuickAnswer:MitigatingtheTopFiveSecurityRisksofAICoding

EmergingTech:GenerativeAICodeAssistantsAreBecomingEssentialtoDeveloperExperience

MagicQuadrantforApplicationSecurityTestingHypeCycleforApplicationSecurity,2023

InnovationGuideforAICodingAssistants

StrategicPlanningAssumption:By2026,attacksusingAI-generateddeepfakesonfacebiometricswillmeanthat30%ofenterpriseswillnolongerconsidersuchidentity

verificationandauthenticationsolutionstobereliable