Whitepaper 1 of 2  ·  PerfAI  ·  2026

Security Best Practices
for AI Apps

AI coding agents are shipping apps faster than ever. The security playbook that worked for traditional software — SAST, DAST, periodic pentesting — was not designed for this. Here is what the teams getting ahead of it are doing differently.

100%
of apps tested have broken access control — OWASP Top 10:2025 (Jan 2026), 175K+ CVEs analyzed
97%
of organizations that had AI-related breaches lacked proper AI access controls (IBM, July 2025)
$4.44M
global average cost of a data breach in 2025, US hits record $10.22M (IBM Cost of Data Breach 2025)

Part 1

The old security playbook — and where every tool breaks down

Enterprise AppSec was built for a world where code was written by humans, changed quarterly, and reviewed carefully before release. That world no longer exists. AI coding agents now generate 41% of all code globally (Stack Overflow 2025, n=49,000+), and the tools designed for the old world are struggling to keep up with the new one.

The AI coding agents reshaping how software is built:

GitHub Copilot
GitHub Copilot
Cursor AI
Cursor
Claude Code
Claude Code
Gemini Code
Gemini Code
Amazon Q
Amazon Q Dev
Replit
Replit
Windsurf
Windsurf

SAST Degrading

Trained on human-written patterns. AI-generated code uses non-standard structures that SAST tools were never trained to recognize. Catches syntax, misses logic.

📡

DAST Degrading

Probes from outside. Cannot test cross-role or cross-tenant access-control scenarios that require internal session context and business logic.

📅

Pentesting Obsolete

$10K–$50K per engagement. Point-in-time. Your app ships daily. The pentest report reflects code that no longer exists by the time it lands.

🐛

Bug Bounties Reactive

90% of payouts now go to access-control flaws — meaning researchers find what your tools missed, after your app is live with real user data.

👁

Manual Review Impossible

A typical AI app has ~20K permission combinations. You cannot review that at any team size, for any budget, at daily shipping velocity.

🤖

Autonomous Required

Continuous, comprehensive, purpose-built for AI app architecture. The only approach that scales with daily releases and a complex permission surface.

Why AI code makes SAST worse, not just less effective. GitHub Research (2024) found that 29.1% of Python code generated by AI contains potential security weaknesses — patterns that SAST tools were never trained to detect because they were never written by humans before. CodeRabbit's December 2025 analysis of 470 PRs found AI-authored code has 1.7× more major issues and 2.74× higher security vulnerability rates vs. human-written code.


Part 2

The app explosion — 3,100 new apps ship every day

Vibe coding is not just changing how apps are written. It is changing the rate at which they are created and updated. The volume makes manual security review impossible — not impractical, structurally impossible.

1,865
New iOS apps daily — Apple App Store 2026
1,205
New Android apps daily — Google Play 2025
28%
Of apps updated weekly — permissions change with every release
1.2M
Pull requests/month from GitHub Copilot agent alone — each a potential permission change (GitHub 2025)

Every update is a permission event. 28% of Google Play apps are updated weekly. Every sprint introduces new workflows, endpoints, and roles. The app you pentested last quarter is not the app running in production today — and there is no continuous process verifying that the permission model is still correct.


Part 3

The OWASP signal — access control is #1, and getting worse

OWASP released its Top 10:2025 in January 2026 — the first update since 2021. The most striking finding: Broken Access Control is still #1, and the prevalence number moved in the wrong direction.

OWASP Top 10:2025 — Released January 2026 · 175,000+ CVEs analyzed

100% of applications tested — up from 94% in 2021. OWASP's 2025 dataset analyzed 175,000+ CVEs and mapped 248 CWEs. The conclusion: broken access control is not a niche problem. It is universal. And SSRF has now been absorbed into A01, expanding the category further. OWASP states plainly: "Broken Access Control maintains its position at #1 as the most serious application security risk."


Part 4

The permission math — why 20,000 combinations cannot be audited

The issue is not that developers are careless. The issue is that the permission surface of a modern AI app is too large for any human process to reason about completely.

50 workflows
+growing
100 endpoints
web+API+AI
8 user types
minimum
N tenants
× each
= ~20,000+ combinations that must all be correct, at runtime, across every release

Best Practice #1: Stop manual security testing. Manual audits cannot cover ~20K permission combinations reliably. The misconfigurations that get missed are not random — they cluster in the complex, cross-role, cross-tenant scenarios that attackers specifically look for. Manual testing gives you a false sense of coverage, not actual coverage.

Best Practice #2: Retire point-in-time pentesting for AI apps. A pentest tells you what your app looked like during the test window. Your app ships daily. Your permissions exposure shifts with every release. One misconfigured access-control rule — one role that can invoke an endpoint it should not — is all it takes for a breach. With a quarterly pentest cadence, you have an 89-day exposure window on every release.


Part 5

The AI access control crisis — by the numbers

IBM's Cost of a Data Breach Report 2025 (published July 2025, covering March 2024–February 2025) studied AI security for the first time. The findings establish the scale of the problem:

13%
of organizations reported breaches of AI models or apps — and 8% don't know if they were breached (IBM 2025)
97%
of those breached lacked proper AI access controls — the defining governance failure (IBM 2025)
63%
of breached organizations have no AI governance policy or are still drafting one (IBM 2025)
$670K
extra breach cost from shadow AI — unauthorized AI raising costs above the $4.44M average (IBM 2025)

Best Practice #3: Treat AI access control as a first-class governance requirement. IBM's data shows that 97% of organizations experiencing AI-related breaches lacked access controls. This is not a technology gap — it is a governance gap. Access control for AI apps, AI agents, and AI-generated workflows must be explicitly defined, tested, and enforced — not inherited from defaults.


Part 6

Bug bounties — the early warning signal nobody wants to hear

Bug bounty programs are a real-time signal of where security researchers are finding vulnerabilities. The data from 2024–2025 shows a dramatic shift toward access-control flaws.

"90% of bug bounty payouts are now awarded for access-control flaws — compared to a fraction for traditional injection vulnerabilities. Researchers go where the vulnerabilities are, and access-control failures in AI apps are where the vulnerabilities are."

— Bug bounty payout analysis, 2024–2025

Best Practice #4: Don't rely on bug bounties as your primary detection mechanism. When a researcher finds your access-control flaw, you find out after your app is live with real user data. Bug bounties are a good supplement, not a substitute for continuous security validation. The goal is to find misconfigurations before researchers do — not after.


Part 7

What "best practice" looks like in 2026 — a checklist

❌ Stop: Manual security reviews at sprint boundaries
Does not scale to 20K+ permission combinations. Generates false confidence, not real coverage.
❌ Stop: Annual or quarterly pentesting as primary security validation
Point-in-time. Your app changes daily. Exposure window between tests averages 89 days.
❌ Stop: Assuming SAST/DAST covers access control
SAST catches code patterns. DAST probes from outside. Neither can determine if User A should access Object B — that requires business logic and runtime context.
✅ Start: Continuous runtime testing on every deployment
Security validation must match your release velocity. If you ship daily, you must test daily — automatically, not manually.
✅ Start: Testing every user type and tenant boundary explicitly
Regular users, SSO, enterprise, multi-tenant, collaborators, support staff, AI agents — every type has its own permission model. Test all of them, not a representative sample.
✅ Goal: Autonomous security purpose-built for AI app architecture
Continuous, comprehensive, with automated remediation. Not adapted from legacy tooling. Built for apps that change every day across 20,000+ permission combinations.

Part 8

PerfAI — autonomous security for AI apps

PerfAI was built to close the gap between daily shipping velocity and the security validation that should accompany every release. Three agents form a continuous loop.

01

Vision agent

Maps every workflow, endpoint, role, user type, and tenant configuration. Builds a live permission model that updates with every release.

02

Security agent

Tests every permission combination at runtime across every deployment. Simulates all user types — including cross-tenant and AI agent scenarios.

03

Fix agent

Translates runtime findings into context-aware fixes. Not a report — a specific remediation scoped to your codebase, ready to ship.

40+ teams across FinTech, HealthTech, B2B SaaS, and EdTech have already adopted PerfAI since Web Summit Vancouver. The economics are clear: one prevented breach at the $4.44M average cost pays for years of continuous security. One pentest costs $12K and is out of date in 24 hours.


References
1OWASP Top 10:2025 (released January 2026) — 100% of apps have broken access control; 175K+ CVEs analyzed; 248 CWEs mapped. owasp.org/Top10/2025
2IBM Cost of a Data Breach Report 2025 (July 2025) — $4.44M global average; $10.22M US record; 97% of AI-breached orgs lacked access controls; 63% lack AI governance. ibm.com/reports/data-breach
3Stack Overflow Developer Survey 2025 (n=49,000+) — 41% of all code is AI-generated or AI-assisted; 84% of developers use AI coding tools
4GitHub Research 2024 — 29.1% of AI-generated Python code has security weaknesses; GitHub Copilot generates 1.2M pull requests/month
5CodeRabbit December 2025 — AI-authored PRs have 1.7× more major issues, 2.74× higher security vulnerability rates vs. human-written code
6Apple App Store 2026 — 1,865 new apps released daily. SQ Magazine / BigOhTech 2026
7Google Play Store 2025 — 1,205 new apps released daily; 28% of apps updated weekly. TekRevol / Appinventiv 2025
8Taskade State of Vibe Coding 2026 — CVE-2025-48757: 10.3% of 1,645 apps had critical access-control flaws in production
9Verizon DBIR 2025 — 22,000+ incidents, 12,000+ confirmed breaches; credentials led initial access vectors; 30% of breaches involved third parties (doubled YoY)
10Gartner 2025 — 90% of enterprise engineers will use AI coding assistants by 2028 (up from <14% in early 2024)

See what PerfAI finds in your app

Free to start. No pentest budget required.

Start free at perfai.ai →