Survey: 100% of Engineering Leaders Use AI for Code Generation—Security Now the Top Concern
Key Takeaways
- ▸100% of surveyed engineering leaders use AI to write production code—universal adoption with no exceptions
- ▸Security vulnerabilities and code quality rank as top concerns, while cost considerations remain surprisingly low on the priority list
- ▸42% of respondents report experiencing security incidents they associate with AI-generated code; 18% have faced supply chain attacks
Summary
A comprehensive survey of engineering leaders across companies of all sizes reveals universal adoption of AI-generated code in production environments, with not a single respondent reporting zero AI code in their systems. However, this widespread adoption comes with significant anxiety: security vulnerabilities and code quality represent the engineering community's primary concerns, overshadowing cost considerations that have dominated headlines. The findings paint a picture of an industry rapidly integrating AI coding tools while racing to establish appropriate safeguards.
The survey uncovered a stark divide between adoption rates and confidence levels. While 100% of respondents use AI to write production code—with most having 25-100% of their codebase generated by AI—engineering leaders report mounting concerns about security flaws, technical debt, and loss of developer expertise. Notably, 42% have already experienced a security incident they believe may be connected to AI-generated code, and 18% have faced supply chain attacks. Despite these risks, the mitigation strategies remain traditional: human code review (still considered non-negotiable by 97% of teams) and security scanners, suggesting the industry has not yet found AI-based solutions to address AI-specific risks.
- Human code review remains essential: 97% of teams review AI-generated code the same or more strictly than human-written code
- Traditional tools (human review, security scanners) remain the primary mitigation strategy; no consensus on AI-based alternatives yet
Editorial Opinion
This survey exposes a critical gap between AI adoption velocity and security preparedness in the software industry. While engineering leaders have unanimously embraced AI coding assistants, their confidence in managing the associated risks remains fragile—security concerns dominate the conversation, yet the mitigation toolkit remains stubbornly analog (human review) and conventional (scanners). The industry is essentially flying on instruments designed for the previous era of software development. For AI companies building coding tools, this should be a wake-up call: the market isn't asking for faster code generation anymore; it's demanding better security assurances, transparency into model behavior, and tooling that addresses the unique vulnerabilities introduced by AI-generated code.
