Developers behaving badly: Why holistic AppSec is key

This analysis outlines how untested releases, risky developer behaviors, and the rise of AI-generated and low-code/no-code applications are expanding software risk, arguing for a holistic AppSec strategy that embeds IAM guardrails, branch protections, and anomaly monitoring across development ecosystems while automating “shift-everywhere” testing—including final-stage checks for malware, tampering, signatures, and secrets. Survey data reveals widespread bypassing of MFA/VPN, credential sharing, and pushing untested (often GenAI-derived) code; experts urge policies, education, and developer-friendly security controls to manage accelerating CI/CD and the surge of AI- and low-code-built applications.