Title: AWS re:Inforce 2024 - Innovate w/ confidence across your AI-powered software supply chain (APS227-S)

Insights:

• AI Adoption and Security Concerns: The session highlighted the widespread use of AI, particularly Gen AI coding tools, within development environments. Despite the benefits, significant security concerns persist, with over half of respondents acknowledging security issues in AI-generated code.
• Unauthorized Use of AI Tools: A striking 75% of developers admitted to using AI coding tools without authorization, indicating a gap in policy enforcement and oversight within organizations.
• Inaction on Software Development Practices: Despite recognizing security issues, many organizations have not adjusted their software development practices to address the risks associated with AI coding tools.
• AI Readiness Report Findings: The 2024 AI readiness report surveyed 400 companies, focusing on developers, application security professionals, and the C-suite. It assessed AI readiness based on two parameters: AI fitness (policies and controls) and AI wellness (motivation to embrace AI).
• C-Suite vs. Security Teams: The C-suite generally feels more confident and less concerned about AI risks compared to security teams, who are more aware of the security challenges and issues arising from AI adoption.
• Developer Perspectives: Junior developers report increased productivity with AI tools, while more experienced developers are less impressed and more concerned about security implications.
• Policy and Preparation Gaps: There is a notable lack of proactive policies and preparation for AI tool adoption. Many organizations have not conducted sufficient due diligence or training for developers using these tools.
• Recommendations for AI Adoption: The session provided four key recommendations for safe AI adoption: conducting proof of concepts (POCs), listening to application security teams, facilitating cross-functional input, and implementing guardrails like SAST tools to manage security risks.

Quotes:

• "Our point of view at Snyk on AI is that it's not an if, and candidly, it's not even really a when anymore."
• "Over half of respondents acknowledged that there were significant security issues with their AI generated code."
• "A very alarming 75% of developers acknowledged that somewhere within their development shop, there are developers using these coding tools in an unauthorized fashion."
• "The most common response was that organizations were not actually taking action to change their software development processes in response to the state of AI coding."
• "The C-suite is dramatically underestimating the risk level of AI gen coding tools. And they're overestimating the state of readiness for their organizations."
• "Two out of three of the developers who responded to the survey said that less than half of their teams had received any training on the use of these tools."
• "An undeniable aspect of Gen AI is it's going to increase the volume of code."
• "Leverage tools that help you scale that AppSec program as a component of your GenAI code adoption, we think is a vital part of the process."