博客

反映真实 AI 使用情况的安全编码学习

June 1, 2026
Shannon Holt

将安全编码学习与实际的 AI 使用情况、开发人员工作流程以及现代软件开发实践相结合。

AI 辅助开发已逐渐成为日常工程工作的一部分。

开发人员可能在上午手动编写核心应用程序逻辑,下午使用 AI 生成测试覆盖率,然后在下班前审查 AI 辅助生成的拉取请求。工作流程是流动的,工具也在快速更迭。使用模式每周都在演变,有时甚至因团队而异。

过去,安全编码学习通常以相对固定的周期进行,例如入职培训、年度任务、广泛的基于角色的培训或定期的意识提升活动。当开发工具演进较为缓慢且学习需求长期保持稳定时,这些模式是合理的。

AI 辅助开发则完全不同。安全团队现在需要一种更具响应性的方式,确保安全编码指导能够紧跟开发人员当下的实际工作方式。

自适应学习旨在帮助企业将安全编码学习与整个软件开发生命周期(SDLC)中的实际软件开发活动及软件风险信号相结合。

‍这包括 AI 辅助开发活动、漏洞发现以及与软件实际构建方式相关的开发人员行为演变。

在本文中,我们将重点介绍由 Trust Agent: AI 驱动的 AI 信号自适应学习——利用 AI 辅助开发检测,帮助企业动态地为在日常开发工作中积极使用 AI 编码工具的开发人员提供相应的安全编码指导。

反映真实 AI 使用情况的学习

安全编码学习只有反映开发人员的实际工作方式时,才最有效。企业已经能够根据角色、编程语言、技术栈和漏洞重点领域来调整学习内容,从而提高各工程团队培训的相关性。

AI 辅助开发引入了额外的上下文层面。

一位今天尝试使用 AI 生成 Python 代码的工程师,下个月可能就会转而审查 Terraform 中的基础设施即代码,或使用 AI 加速前端测试工作流程。有些开发人员非常依赖 AI 编码助手,而另一些人则几乎不用。

自适应学习帮助企业将 AI 可见性转化为有针对性的安全编码指导。当 Trust Agent: AI 识别出 AI 辅助开发活动时,企业可以自动分配与这些工作流程相匹配的学习内容。

这意味着,积极使用 AI 编码助手的开发人员可以获得与其实际工作环境紧密相关的针对性学习,而安全团队无需手动识别每位开发人员,也无需随着 AI 在工程团队中的普及而反复重新分配学习任务。

自适应学习的实践应用

由 Trust Agent: AI 驱动的自适应学习旨在自然地融入现有的软件开发工作流程中。

安全团队可以创建针对安全 AI 辅助开发实践的学习内容,然后利用 Trust Agent: AI 的检测功能,将这些学习内容动态分配给在日常工作中积极使用 AI 编码工具的开发人员。当开发人员开始与 AI 辅助开发环境交互时,系统会根据其活动自动分配相关的安全编码指导。

So now we can detect the AI usage, we can understand where it's happening, and we can trigger that targeted training for the right developers. And that's what I'm gonna show you today, how we take that AI signal and turn it into adaptive learning. So there are a few parts of the process which I'll walk through today. The first piece is in the policy setup on TA, then we can go to the Quest side to trigger the training. For the policy, it's super simple and straightforward. So if you want to ensure that developers who use AI need a training, you can head over to this policy section within configuration. And what you wanna do is ensure that the adaptive AI learning is toggled on. Once that's set up, that's all you need to do on the Trust Agent AI side. In this demo itself, we've already gone ahead and set up the installer and all that piece over here. We have various internal external documentation on how to locally install it or use various scripts like Jamf, there'll be other documentation on that. But in this, like I say, in this demo, I'm just gonna head on with the actual policy setup and the adaptive learning creation. Okay. So now this is set up. I'm over into quests, and what I'm gonna do is create a quest to target the specific learners who have used AI. So So once you're in the quest, if you scroll down and you look at the participant section, what we have now is a new participant type, which is trust agent detection. And what this will do is automatically pull the developers who have been flagged in that TA AI report. So what we're gonna do is select this, and we can start to fill out the rest of the quest like normal. So we give it a title, a badge, we'll scroll down to the objectives. And what's really nice about this is the flexibility that the admins have to define the criteria for the training needed. For example, they can go in and they can select the specific content. So they could just go with Coding With AI. They could go with the AI agents and the protocols as well. For this demo, I'm gonna select both of these and keep them as part of the criteria. I can also then decide the schedule, so I'm gonna use fixed dates, and then I can go ahead and configure some of the quest settings as well. One important area to note is the count pass completions. This again is flexible based on customer's needs where we can define if they want learners to complete the training regardless if they've done any of the content before, or they can set a specific time period like three or six months where they have done it recently. So for this demo, I'm gonna set it to redo all content. Once that's filled out, you can then go ahead and save and publish. Now that's set up. That's gonna be available for them developers that were flagged for the Trust Agent AI, and the two steps are complete from an admin's perspective. So we've gone in and we've set up the policy and made sure that's enabled. And we've gone over to Quest and ensure we've created a Quest that's using the new participation type, the trust agent detection. So what I can do now is quickly log in as a learner just so we can see if they have received that training. So just to quickly show you what it's like from the learner perspective, here I am logged in as a learner. I was one of the learners who flagged up based on AI usage, and therefore, I have now received the quest, which you can see here on the screen. And in the normal process, I would then go through and then go through the topics within the quest. Once I have completed this, then I've completed the quest. And that concludes the demo today. So what I've gone through is really just an overview of the importance of Trust Agent AI and adaptive learning, and then gone through to the demo of the admin experience and then quickly briefly through to the learning experience as well. As always, any questions on adaptive learning, please feel free to reach out. Always happy to help. Thank you very much.


上述演示展示了带有 AI 信号的自适应学习在实践中是如何运作的,包括配置 Trust Agent 检测、创建自适应任务、动态分配学习内容以及跟踪参与度和完成情况。

如需分步设置说明和配置详情,请查阅 Adaptive Learning with Trust Agent: AI 知识库文章。

安全编码指南应反映开发者的实际工作方式

AI 辅助开发已成为日常工程工作流程的一部分。开发者在一天的工作中,需要快速切换于 AI 生成的建议、手动编写的代码、自动化测试以及拉取请求审查之间。

随着这些工作流程的不断演进,安全编码指南必须与软件的实际构建方式保持同步。

由 Trust Agent: AI 驱动的自适应学习(Adaptive Learning)正是为了实现这一目标——将学习内容与真实的 AI 辅助开发活动相结合,确保在最相关、最可操作的时刻为开发者提供指导。

其成果是能够随 AI 工具演进而保持相关性的安全编码指南,且不会给负责运行该项目的安全团队增加额外负担。

标语

在 AI 驱动的开发成果发布前实现有效治理

评估 AI 辅助风险,在提交代码时强制执行安全编码策略,并加速整个软件开发生命周期的安全交付。

预约演示
资源库

探索更多博客

获取有关安全编码、人工智能治理和软件风险管理的专家内容。

浏览全部
案例研究
筛选标签
这是 div 块中的一段文本。

Supercharged Security Awareness: How Tournaments are Inspiring Developers at Erste Group

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

了解更多
案例研究
筛选标签
这是 div 块中的一段文本。

Security as culture: How Blue Prism cultivates world-class secure developers

Learn how Blue Prism, the global leader in intelligent automation for the enterprise, used Secure Code Warrior's agile learning platform to create a security-first culture with their developers, achieve their business goals, and ship secure code at speed

了解更多
案例研究
筛选标签
这是 div 块中的一段文本。

统一的安全文化:Sage 如何打造其安全倡导者项目

了解 Sage 如何通过灵活且以关系为导向的方法提升安全性,成功培养了 200 多名安全倡导者,并实现了显著的风险降低。

了解更多
博客
筛选标签
这是 div 块中的一段文本。

2026年网络安全意识月:理解人工智能安全对企业防御至关重要

目前,大多数顶级人工智能公司已公开呼吁全球放缓人工智能的发展速度,以便安全防护措施能够跟上步伐。然而事实是,严重的安全问题已经显现。随着人工智能实施带来的经济成本和风险不断累积,无数安全领导者和高管团队正处于紧迫的境地。

了解更多
博客
筛选标签
这是 div 块中的一段文本。

赋能要素 8:打造项目品牌

成功的安全编码项目不仅需要优质的内容。赋能要素 8 展示了如何通过品牌化将参与过程转变为一种令人向往、以地位为驱动的体验。

了解更多
博客
筛选标签
这是 div 块中的一段文本。

每一位员工现在都处于 AI 网络安全的最前线

企业技术格局正以一种鲜有人预料到的速度发生剧变,直到为时已晚。我们已正式跨越了从人工编写代码和基础辅助编程,进入“智能体开发生命周期”(ADLC)的时代。虽然自主 AI 智能体有望在多个职能领域实现前所未有的效率,但它们也带来了全新的安全和监管风险。

了解更多

在产品发布前确保 AI 驱动的开发安全

洞察开发风险,执行安全策略,并在整个软件开发生命周期中预防漏洞。

预约演示
未找到相关项目。