New research to help you take control of AI-driven development
Not all LLMs produce secure code equally. Comprehensive new benchmarking research reveals the security gaps across leading AI coding models — and a maturity model to help every enterprise respond.
Why this research matters
The LLM your team uses is a security decision
AI is accelerating software development at every stage — from human-written code, to AI-assisted vibe coding, to fully agentic systems making autonomous decisions in production codebases. And at every stage, enterprises face the same core problem: the code being generated may not be secure.
New research from Secure Code Warrior and RMIT University presents the first comprehensive benchmarks on how often leading LLMs produce insecure code, giving security leaders the data they need to make informed decisions about AI adoption.
- Significant variation across models. Secure output rates ranged from approximately 32% to nearly 65% — meaning the choice of model directly determines your baseline risk exposure.
- Same task, very different outcomes. Models were evaluated against identical development problems. The gap in security behavior is not theoretical — it shows up in the code your teams are shipping today.
- Material implications for enterprise AI governance. As agentic systems gain autonomy, understanding which AI did what — and how securely — becomes foundational to compliance and incident response.
The maturity model
Understand where your organization stands — and what to do next
Alongside the benchmarking data, the research aligns with Secure Code Warrior’s AI Software Governance Maturity Model: a clear framework for assessing your organization's current posture and the specific gaps creating the most AI risk exposure.
The model spans the full arc of the AI development transition and maps where most organizations have blind spots. It gives security leaders an actionable view of the gaps — and the steps to close them.
Maturity stages
Ad hoc → Aware → Defined → Managed → Leading
Three pillars
- Observe — Visibility into AI contributions and risk signals at the commit level
- Govern — Guardrails on what AI can and can't touch in your codebase
- Learn — Developer capability that evolves at every stage of the transition
Be first to access the complete research
Secure AI-driven development before it ships
See developer risk, enforce policy, and prevent vulnerabilities across your software development lifecycle.
