Tell your CFO that AI coding assistants raise output, and that code from them needs the same checks as any other code, applied automatically. The risk is real but bounded: insecure suggestions and made up package names. The cost question is how much checking you automate versus how much humans do by hand.
What is the risk, in one paragraph?
OWASP's guidance on LLM misinformation includes a section on unsafe code generation, saying a model may suggest insecure or non existent code libraries. One of its scenarios describes attackers experimenting with popular coding assistants to find commonly hallucinated package names. In plain terms, an assistant can confidently recommend a library that does not exist, and someone else can register that name and fill it with harmful code.
That is the finance version: the speed gain is real, and it comes with a new route for bad code to enter, which an old review process may not catch.
Why is this a budget question?
Because the saving from faster coding survives when checking keeps pace. If code volume rises and review capacity does not, the gap becomes either delay or unreviewed code. Neither is free.
NIST's Secure Software Development Framework says its practices can be built into any development life cycle, and that following them should help producers reduce the number of vulnerabilities in released software. It does not exempt code from an assistant. The practices apply to what ships, whoever or whatever wrote it.
If you are an SEC registrant, remember the disclosure rules for material incidents and for describing cybersecurity risk management. The SEC says an incident filing is generally due four business days after a company determines the incident is material. A weak process around AI generated code is a governance topic your board may ask about.
What are the three checks to fund?
OWASP's mitigations give a short list. Map each to a cost line.
- Secure coding practices for suggestions. OWASP says to establish secure coding practices to prevent integrating vulnerabilities from incorrect code suggestions. Cost: engineering time to write and maintain the standard.
- Automatic validation of outputs. OWASP says to implement tools and processes that automatically validate key outputs, especially in high stakes environments. Cost: scanner licenses and pipeline time.
- Human oversight on what matters. OWASP calls for cross checking and human oversight of critical information. Cost: reviewer hours on the riskiest changes.
A fourth check comes from OWASP's LLM supply chain page: maintain an up to date inventory of components using an SBOM. Without it you cannot answer a customer who asks what is in your product.
What should the CFO ask the engineering lead?
- What share of our code is written with AI assistance, and how do we know?
- Does every dependency an assistant suggests get checked before it is added?
- Which of the three checks run automatically, and which rely on someone remembering?
- How fast can we answer a customer asking what is in our software?
- Which vendors see our source code, and under what terms? OWASP's supply chain page lists unclear vendor terms among the risks.
How should you evaluate tools?
Describe categories, not brands. You are buying some mix of code scanning, dependency checking and inventory. Compare on four points: what languages it supports, whether it runs inside the editor and in the pipeline, whether source code leaves your environment, and whether it can run without an AI model if your policy requires. Safeguard offers editor extensions for VS Code, Cursor and JetBrains, scanning in a CLI that can run on your machine, and Full AI, Zero AI or bring your own model modes. Test any tool on a real repository and compare to your own findings.
Try the walkthrough at /demos/sast-code-scan.
What are the honest limits?
Scanners find known patterns and known flaws. They miss logic errors and novel issues. Review by a person still matters for authentication, payments and data handling. And no figure we cite measures how much insecure code assistants produce in your codebase. Measure your own.
What to do
- Ask which assistants developers use today, including personal accounts.
- Write a one page standard: dependencies must be checked before they are added.
- Turn on automatic scanning in the editor and in the pipeline.
- Generate an SBOM for each release and store it.
- Choose which changes always get a human reviewer, such as authentication and payments.
- Report two numbers monthly: open exploited vulnerabilities and median days to fix.
- Revisit the budget after one quarter with real data.
Quick check
Is AI generated code less safe than human code?
We have no sourced figure for that, so we do not claim it. OWASP documents specific risks, such as insecure or made up libraries, and recommends validation and oversight.
Can we just ban AI assistants?
You can set policy, but developers may use them anyway. Visibility and automatic checks usually work better than a ban nobody can verify.
Sources
- OWASP GenAI: LLM09:2025 Misinformation, fetched 18 October 2026
- OWASP GenAI: LLM03:2025 Supply Chain, fetched 18 October 2026
- NIST SP 800-218: Secure Software Development Framework, fetched 18 October 2026
- SEC: Cybersecurity disclosure rules, fetched 18 October 2026
Last reviewed: 18 October 2026.
