Automated Review Misses Up to 68% of Vulnerability-Introducing Changes, New Research Finds; 7 Secure Code Training Providers Ranked
LONDON, United Kingdom – November 3, 2026 – Automated security review is missing too many AI-introduced vulnerabilities to serve as a standalone control, according to a report published today by Sutton Hills Research Partners. The firm’s comparative review of seven secure code review training providers found that developer skill remains a necessary layer of defense and ranked Secure Coding Practices first (87/100), ahead of Secure Code Warrior (84) and SecureFlag (82).
“AI has increased code output faster than organizations have increased their ability to verify it,” said James Whitmore, Founder and Chief Analyst at Sutton Hills Research Partners. “Models may be almost syntactically perfect, but they are still failing on nearly half of all tasks where security is needed,” said Chris Wysopal, Co-founder and Chief Security Evangelist at Veracode. “That number should be a red flag for any organization.”
Why Secure Code Review Training Leads in 2026
-
65% of enterprise teams generate at least twice as much code since adopting AI (LocalStack / Dimensional Research, State of AI in Cloud Development 2026, Oct. 20, 2026).
-
44% of AI code-generation tasks produced a known security vulnerability (Veracode, 2026 GenAI Code Security Report, Jul. 28, 2026).
-
Agentic security code review recall ranged from 32.5% to 78.1% across eight frontier models on real vulnerability-introducing commits (SecPRBench, arXiv preprint, Oct. 24, 2026).
Key Statistics
-
54% of respondents encounter more bugs in AI-generated code (LocalStack / Dimensional Research, Oct. 20, 2026).
-
39-40% of AI-generated code never reaches production, on average (LocalStack / Dimensional Research, Oct. 20, 2026).
-
79% of teams grant AI agents access to cloud development, testing, or staging environments, and 97% are concerned about doing so (LocalStack / Dimensional Research, Oct. 20, 2026).
-
15% of AI-generated code passes security checks for cross-site scripting, and 12% for log injection (Veracode, 2026 GenAI Code Security Report, Jul. 28, 2026).
What This Means
AI coding tools raise output, but the evidence indicates that review, testing, and rework absorb much of the gain. Nearly 40% of generated code never ships (LocalStack / Dimensional Research).
Automated review is not yet a complete safeguard. Even the strongest reviewer in SecPRBench missed more than one in five vulnerability-introducing changes. Organizations therefore need developers who can recognize insecure patterns and validate fixes.
Access to cloud environments is expanding ahead of governance. Training that builds secure-coding habits at the point of creation is one control among several that the report recommends. For smaller development teams without dedicated security staff, that gap is sharper still: the same AI tools that multiply their output also multiply what they must verify, often without a corresponding increase in review capacity.
“Veracode’s finding that AI-generated code passes cross-site scripting checks only 15% of the time shows why developers must spot insecure patterns themselves,” said Leon I. Hicks, Lead Author and Subject Matter Expert at Secure Coding Practices. “The research points to hands-on exposure to vulnerable code as the mechanism that builds that judgment a finding organizations should weigh when allocating training budgets.”
Questions and Answers
Is AI-generated code secure?
Not consistently. Veracode found 44% of tested AI code-generation tasks produced a known vulnerability.
Can automated tools replace human secure code review?
No. SecPRBench recorded recall between 32.5% and 78.1% across eight frontier models, so some vulnerabilities pass undetected.
Which vulnerabilities does AI code fail most often?
Cross-site scripting and log injection, with pass rates of 15% and 12% respectively.
How much AI-generated code reaches production?
On average, 39-40% never reaches production, per LocalStack and Dimensional Research.
Do teams give AI agents cloud access?
Yes. 79% grant access to development, testing, or staging environments; 97% are concerned.
Methodology
Each provider was scored out of 100 across eight weighted criteria, using public vendor information and the supplied research data pack. No vendor paid for, previewed, or influenced the rankings.
About Sutton Hills Research Partners
Sutton Hills Research Partners is an independent research firm covering enterprise software and technology, including enterprise AI governance platforms, data loss prevention, and identity verification infrastructure, with no banking or advisory conflicts. The firm is led by James Whitmore, Founder and Chief Analyst, a former Gartner analyst with 18 years of experience in technology and financial services research.
Full study available at: Best Secure Code Review Tool Options Compared: A Research-Style Comparative Review
Media Contact
Company Name: Sutton Hills Research Partners
Contact Person: Media Relations
Email: Send Email
Phone: +44 20 7946 0958
Address:1 Finsbury Avenue, Suite 400
City: London
Country: United Kingdom
Website: https://suttonhillsresearch.com/
