Episode 117 -- Surviving AI-Generated Code
In Episode 117 of the Cybersecurity Readiness Podcast Series, Dr. Dave Chatterjee is joined by Nir Valtman, Chief Executive Officer and Founder of Arnica, an application security platform built to secure AI-generated code as it is written rather than after the fact. After recent episodes on defending the security operations center, AI going up against AI, and agentic AI replacing brittle incident response playbooks, this conversation looks upstream at the code itself. A growing share of the code in organizations is generated by tools such as Copilot, Cursor, and Codex, and much of it lands in the code base without anyone sitting with it the way a developer once did. The question behind the episode, surviving AI-generated code, is whether that code can be trusted and, if not, what organizations should do about it. Valtman, a former CISO at Kabbage ahead of its acquisition by American Express, VP of Product and Data Security at Finastra, and head of application security at NCR, brings a builder’s and a breaker’s view of the problem.
Valtman reports that Arnica benchmarked the top six coding agents and the top six models and found that, when prompted to develop very simple features, roughly 35 percent of sessions included significant vulnerabilities: ship more code, and you ship more vulnerabilities. His answer is to control how code is written at the point of the prompt, by injecting secure-coding instructions into the rule files (such as agents.md) that steer coding agents, rather than adding friction at code review. According to Arnica’s recent research, such rules leave about 98 percent of sessions free of vulnerabilities. He pairs this with private, blameless notifications delivered where developers already work, and reports that 78 percent of the issues Arnica flags never reach the code review stage. Two data points frame the accountability challenge: only 13 percent of recent open source contributions are attributed to a developer, and 82 percent of meaningful findings were authored by developers who are no longer at the company.
The episode’s central lesson is that surviving AI-generated code means engineering trust rather than assuming it, and that the work is as much about people and process as about scanning technology. Viewed through Dr. Chatterjee’s Commitment–Preparedness–Discipline (CPD) Framework, commitment means leadership that sets the tone and holds a named human accountable for the code, whoever or whatever wrote it; preparedness means an updated threat model, secure-by-default rules, and validated findings routed to the right owner at the right time; and discipline means feedback loops, outcome testing, and metrics that track adoption and developer impact rather than code generated. Valtman’s advice to senior leaders is to integrate security into every development life cycle they run, to avoid applying the most expensive AI models to everything, and to remember that within a year organizations will be measured not on how many tokens they spend but on the value they get from them.
To access and download the entire podcast summary with discussion highlights -https://www.dchatte.com/episode-117-surviving-ai-generated-code/
Connect with Host Dr. Dave Chatterjee
LinkedIn: https://www.linkedin.com/in/dchatte/
Website: https://dchatte.com/
Books Published
Cybersecurity Readiness: A Holistic and High-Performance Approach
Articles & Cases Published
Chatterjee, D. (2026). The Cryptographic Reckoning: Why Quantum Readiness Begins with Agility, Not Algorithms, The INFORMS Analytics Magazine, June 26, 2026
Chatterjee, D. (2026). The New Digital Fragility: How AI-Enhanced Cyber Threats Are Reshaping Operational Resilience, The INFORMS Analytics Magazine, March 4, 2026
Chatterjee, D. (2026). Root: Automating the Remediation Gap, Ivey Publishing, Jan 7, 2026.
Chatterjee, D. and Leslie, A. (2024). “Ignorance is not bliss: A human-centered whole-of-enterprise approach to cybersecurity preparedness,” Business Horizons, Accepted on Oct 29, 2024.
Chatterjee, D. (2023). “Mission critical – How American Cancer Society successfully and securely migrated to the cloud amid the pandemic,” I by IMD, March 13, 2023.
Chatterjee, D. (2022). “Preventing security breaches must start at the top,” I by IMD, September 28, 2022, Institute for Management Development, Lausanne, Switzerland
Benz, M. and Chatterjee, D. (2020). “Calculated Risk? A Cybersecurity Evaluation Tool for SMEs,” Business Horizons, available online from May 4, 2020
Chatterjee, D. (2019). “Should Executives Go To Jail Over Cyber Attacks,” Journal of Organizational Computing and Electronic Commerce, Vol 29, Issue 1, pp. 1-3.
Abraham, C., Chatterjee, D., and Sims, R. (2019). “Muddling through cybersecurity: Insights from the U.S. healthcare industry,” Business Horizons, July 2019.
