Finding software flaws is getting cheaper, but fixing them is not. At 40% of organizations, AI generated or substantially modified most of the code merged in the preceding 90 days, yet only 34% of development time goes to new software, and scan-and-triage cycles built for code written at human speed cannot keep up. The constraint has moved to the queue between a validated finding and an approved fix: pull requests waiting on review, findings waiting on an owner, and patches waiting on a test run.
The risk is already reaching production. A total of 75% of organizations had a production incident in the past year in which AI-generated code, agent actions, or AI tooling contributed, yet only 43% mandate human review of AI-generated code, and only 12% evaluate agent output before promotion. Closing that gap means security and engineering leaders share the fix: security sets the approval threshold, and engineering applies it in the pipeline.
In our latest thought leadership brief, Remediation Is Becoming a Software Delivery Capacity Problem, completed in partnership with Google Cloud, Futurum Research examines why the queue between a validated finding and an approved fix is now the capacity problem for security and engineering leaders, defines six requirements for any AI code remediation agent, and maps CodeMender, an AI code remediation agent available on Google Cloud, against those requirements.
In this brief, you will learn:
- Why the bottleneck has moved from finding flaws to fixing them
- How to measure time to a validated fix, from a validated finding to an approved, regression-tested change
- Six requirements to set for any AI code remediation agent, and the questions to ask vendors
- How CodeMender maps to those requirements, plus four recommendations for security and engineering leaders
If you are interested in learning more, be sure to download your copy of Remediation Is Becoming a Software Delivery Capacity Problem today.
Author Information
Vikram Rathnam is Research Director, Software Lifecycle Engineering at The Futurum Group. His research examines how software is built, tested, secured, and operated as AI agents move from assisting developers to doing the work. His coverage includes observability, platform engineering, and the control planes that govern agents. Before joining Futurum, he spent 24 years on the vendor side: ten in engineering at Silicon Labs and fourteen in product and partner strategy, with roles at Cisco, Secureworks, Dell, and CMIT Solutions. Across those roles, he managed B2B cybersecurity, IoT, and AI products, with partner and channel ecosystems as the common thread. At CMIT Solutions, he led product strategy across a franchise network of 180 locations. He reads a vendor’s roadmap as someone who has had to ship one and take it to market.
Mitch Ashley is VP and Practice Lead for the CIO & Technology Buyers and Software Lifecycle Engineering practices at The Futurum Group. A multi-time CIO and CTO with 30+ years leading technical organizations, Mitch built and operated production systems spanning cybersecurity for the U.S. Department of Defense, PKI services for the broadband and 5G industries, SaaS platforms, large-scale telecom and banking systems, and a national broadband network. His work with AI began early, developing expert systems that diagnosed and repaired complex mainframe environments. That operator foundation grounds his analysis in operational consequence, covering the technology buyer's world of software engineering, cybersecurity, DevOps, cloud, and AI.
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
