The adoption curve has already outrun the security curve

AI coding tools stopped being optional a while ago. DORA's 2025 State of AI-Assisted Software Development report found that 90% of software development professionals had adopted AI tools at work — a 14-point jump year-over-year — with 65% describing themselves as heavily reliant on AI and a median of two hours a day spent on AI-assisted work. Stack Overflow's 2025 survey put overall adoption at 84%, with 51% of professional developers using AI tools daily. GitHub reports its Copilot alone now generates 46% of code written in enabled files, and 90% of Fortune 100 companies have deployed it.

Every one of those developers is now making security-relevant decisions — how a prompt is constructed, what an agent is allowed to touch, how retrieved data is trusted — that no prior training program was ever built to cover. Most enterprises have no baseline for whether their developers can make those decisions safely, because until now there hasn't been a way to certify it.

AI-authored code is measurably less secure, and most teams don't realize it

This isn't a theoretical risk. It shows up consistently across independent research:

• Veracode tested over 100 large language models across 80 coding tasks and found that 45% of AI-generated code samples introduced OWASP Top 10 vulnerabilities — a pass rate that hasn't meaningfully improved across repeated testing, with samples failing to defend against cross-site scripting 86% of the time and against log injection 88% of the time.
• Independent research puts AI-generated code at roughly 2.7 times the vulnerability density of human-written code, with security review coverage running 20–30% lower — and a false sense of security compounding it: over half of developers say they trust AI output without testing it, and around 70% accept AI suggestions without modification.
• Three in four developers believe AI-generated code is more secure than human-written code, while close to 40% accept AI suggestions with no review at all.
• Developer trust in AI output accuracy has actually fallen — down to 29% from 40% the year before, according to Stack Overflow — even as usage keeps climbing. Teams increasingly sense something is off, without a structured way to fix it.

The pattern across every study is the same: the more code AI writes, the more a team's real security posture depends on whether the developer directing it knows how to constrain it. Right now, most don't — and most enterprises have no way to verify who does.

Most enterprises have no governance layer for any of this

Well over half of enterprises still have no formal policy governing AI code usage at all, and a majority of IT leaders report experiencing an AI-related breach in just the past year — while a similar share of organizations are still debating which team should even own AI security. Certification gives enterprises a concrete way to close that gap at the level where the risk actually originates: the developer's daily workflow, not a policy document nobody reads.