Security in development won’t become “invisible” this year, but it will become easier to manage.

Those are the thoughts of Danny Allan, CTO at developer-orientated cybersecurity firm Snyk.

Right now, developers are primarily tasked with creativity – building things – however, security has become part of their remit with the shift left. Allan believes we’re about to see security largely handed over to the security operations team, guided much more by AI in every part of the software development lifecycle.

“AI will help security and policy teams understand where they need to spend their attention as well as removing the burden and cognitive load from developers,” he explains. “But only for those organisations that put in place strong DevOps practices providing consistency and checkpoints – for GenAI in particular. Leaders taking this seriously have board groups devoted to security and governance, and the governance solutions in place to support policy.”

When done well, many of the common repetitive, painful security tasks that have existed for the last 20 years could become much less visible to developers and the wider organisation. 

We’ll see more organisations giving security to platform engineering teams who will set up guardrails on the ‘paved path’, Allan adds. “As a consequence, developers will finally get a reduction in their cognitive load, unlocking greater innovation and time-on-task.”

For open source security in an AI-driven paradigm, there’s a fair amount of uncertainty that lies ahead.

AI really helps organisations focus on what needs to be addressed in the short term, but not on actually addressing the problem.

Allan explains: “It’s likely that the majority of code will be created by code assistants within five years, and as a consequence, we may see less open source and more security as a result.

“When creating custom code, you need guardrails, particularly with AI assistants trained on open source material. This raises issues: What’s the licensing with this blended code? We’ll see litigation and regulation associated around code transparency, and inevitably, new standards and practices must evolve. With up to two years of experimentation with GenAI, these issues will come to the fore in 2025.”

But more concerningly, with AI assistants creating new, custom, private code, Allans feels there will potentially be less open source code written and used, and therefore less maintenance of existing codebases. As a rule, developers want to develop, not maintain.

“Plus, from a security point of view, if an AI assistant creates an average blend of open source components there will be no patch or update for that – unless the human overseer keeps at it and ensures it stays secured,” Allan notes. “We may see the impact of less open source and also less security as a result.”

AI-powered vulnerability remediation

As far as AI-powered vulnerability remediation is concerned, Allan is confident it will become recursive in the months ahead. 

“AI is more than GenAI, and different models can be used to generate ideas or code fixes, as well as test them and compare them to policy guidelines,” he says. 

This year will inevitably show the DevSecOps community catching up and using complementary models for both analysis and fix. GenAI coding will likely be the most prominent technology creating code, meaning that development, rather than fix, will develop quicker – causing bottlenecks in the workflow.

“There are also techniques like symbolic regression analysis that will help users understand the data flows of the application in a way that traditional analysis does not as clearly,” notes Allan. “GenAI has so many more uses. For instance, it can read the release notes of the open source packages. Often within these notes there are statements about which security vulnerabilities are being fixed, or other changes, that can be used to better understand the internals.

“What leaders will do is embed the right processes and guardrails so that the growing set of AI-driven capabilities can be slotted into already efficient DevSecOps systems without causing bottlenecks and unwelcome pressure.”

Allan’s colleagues, Randall Degges, head of developer & security relations at Snyk, is concerned that injection attacks are making a comeback, reinforcing the need for hybrid AI and human oversight.

He explains: “As AI coding tools become a mainstay in development workflows, they introduce fresh security challenges that require vigilant management. Injection attacks are set to re-emerge as a top threat in 2025, fueled by AI-generated code vulnerabilities. While AI can speed up development, it often produces code that fails to adhere to security best practices, compounded by developers who may bypass crucial security guidelines, leading to AI-driven security gaps that ripple across critical software systems.”

Once a primary focus in the OWASP Top 10 list, injection vulnerabilities saw a decline by 2021 due to improved security awareness and coding practices. But with AI tools now handling code generation across multiple platforms and frameworks, injection risks are once again front and center. 

AI systems process massive volumes of input data, often without robust validation, creating perfect conditions for injection attacks to resurface. This risk grows as AI-driven coding tools gain traction across diverse programming languages and deployment environments, raising the security stakes for developers and organisations alike.

“To address these evolving risks, a hybrid AI approach – combining symbolic AI, machine learning, and human intelligence – is essential,” suggests Degges. 

“Human oversight ensures that AI-generated code meets security standards while providing valuable feedback that continuously enhances AI performance. By 2025, organizations committed to secure development will adopt this hybrid approach, balancing the productivity gains of AI with rigorous security validation.

“For developers, this approach emphasizes the importance of AI as a complementary tool, not a substitute for human expertise. With secure coding practices and vigilant oversight, AI can empower developers without compromising on safety, driving forward a new era in secure, efficient software development.”

Degges also believes that, With AI, developer experience becomes yet more vital. However, to become more competitive, developers are turning to their ‘tools of desire’ via shadow IT if their experience is not delivering what they feel they need. 

The challenge for organisations, he says, is to really deliver on that experience such that their developers are able to do their job without running around the CIO and CISO. 

“Developers’ preferred shadow tooling may open the business to data leakage, compliance, and security risk,” Degges says. 

“Those organisations that crack the developer experience flow will outpace their peers – and likely poach their talent. It’s what everyone should be striving to do to keep costs down, it’s way more efficient, and it builds a culture where people feel like they’re empowered to actually do their job – a powerful aid to doing great work.”

Shadow IT risk

Numerous companies have still not caught up to what’s going on with their shadow IT situation – and it’s putting them at risk, Degges warns. Developers are using their own AI tooling, like Cursor, ChatGPT, or Copilot, even when these are forbidden by the company. 

Degges says: “They do it because these tools are like the new Google: An assist, that, if you’re not using them, mean you’re not as effective and don’t look as good at delivery as your peers.

“So, the challenge to get right in 2025 lies in helping companies to give developers the tools they need to just do their job successfully, on time, on budget, and compliantly. All while retaining the experience and speed that developers crave.”

Supply chain attacks are another major risk companies need to wary of in the coming year, according to Degges.

“An attack on the software supply chain is a great business model for attackers. We should expect to face many more attempts in 2025. If you’re an attacker looking to steal company data, you could spend considerable time scoping the business, their technologies and defences, phishing or coercing people into doing stuff for you. 

But that’s all laborious and time consuming and comes with a lot of opportunities to be thwarted by the good guys. It’s smarter to just attack the supply chain and capture the data from dozens, hundreds, or thousands of companies all at once. 

“We will see much more energy put into attacking the software supply chain in 2025, and many businesses are totally unprepared. Simply – it scales better, and attackers can use it for a huge impact. This tactic will grow.”

Technical leaders must be acutely aware of their risks from supply chain attacks, and consider what processes and visibility they have, beyond SBOMs, into what really matters and how to effect needed changes as risks manifest.

Photo by Rene Böhmer on Unsplash.

Looking to revamp your digital transformation strategy? Learn more about Digital Transformation Week taking place in Amsterdam, California, and London. The comprehensive event is co-located with IoT Tech Expo, AI & Big Data Expo, Cyber Security & Cloud Expo, and other leading events.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.