Developers are shipping three to four times faster with AI assistants. New research on what they are shipping should get the attention of every CTO.

In April, the Cloud Security Alliance published a research note that put hard numbers on something engineering leaders have been sensing for a year. Across Fortune 50 enterprises, developers using AI coding assistants were producing commits at three to four times the rate of their peers. They were also introducing security findings at ten times the rate. The security debt, the researchers wrote, is now accumulating faster than organizations can remediate it.

It was not an isolated finding. Veracode has been running more than 100 large language models through security-sensitive coding tasks since 2025, and roughly 45 percent of the generated samples introduce vulnerabilities from the OWASP Top 10. The number that should really bother people is the trend line: while the same models kept improving on coding benchmarks, their security pass rate stayed flat, testing cycle after testing cycle. Bigger models did not do better.

Meanwhile GitClear, which analyzed 211 million changed lines of code across major enterprise repositories, documented what all that velocity is doing to codebases. Between 2021 and 2024, the share of commits devoted to refactoring collapsed from 25 percent to under 10 percent. Copy-pasted code rose steadily over the same window. Everyone is adding. Almost nobody is tending.

The New Bottleneck Is Review

Talk to engineering managers and a consistent picture emerges. The problem is rarely that AI code fails. The problem is that it looks right. In Sonar’s survey published this February, 53 percent of developers said AI produces code that appears correct while hiding defects. In a separate industry survey, 71 percent of developers said they refuse to merge AI-generated code without manual review. They are not being precious. They have been burned.

So, the work has moved. Senior engineers now report spending 20 to 35 percent more time on code review, and the junior developer role has quietly inverted: instead of writing code that a senior reviews, juniors now accept AI code that a senior still has to review, with less understanding of what they accepted. One academic team tracking AI-authored commits in public repositories counted over 100,000 unresolved AI-introduced issues surviving in production code by February of this year, a number that was a few hundred at the start of 2025.

None of this is an argument against AI-assisted development. Our own engineers at Softensity use these tools every day, and the productivity gains are real. It is an argument that the gains are only durable for teams that changed their process to match, and most teams have not.

What the Disciplined Teams Do Differently

The teams keeping quality flat while velocity climbs are doing recognizable things. Mandatory human review on security-critical paths, no exceptions for AI-authored code. Static and dynamic analysis wired into CI so vulnerabilities get caught before a human ever looks. Test coverage gates that block merges rather than politely reporting. A tracked ratio of AI-authored code in the repository, treated as a metric leadership actually sees. And a standing refactoring budget, because the GitClear data is unambiguous about what happens when refactoring becomes optional.

Regulation is about to make this discipline less optional anyway. The EU AI Act reached full applicability for high-risk systems this month, with documentation and human oversight requirements that will be very hard to satisfy for teams that cannot say which parts of their codebase were machine-generated or how they were validated.

This is territory Softensity knows well. Quality assurance has been one of our core practices for over 25 years, alongside the senior engineering teams we place with clients, and the past 18 months have brought us a new kind of engagement: companies that moved fast with AI tooling and now need the codebase hardened, the test automation built, and the review discipline installed before the next audit or the next outage. The pattern in those engagements matches the research almost exactly. The code mostly works. The gaps are in what nobody checked.

If your team’s velocity chart went up and to the right this year, the honest question is whether your defect and security data kept pace with it. If you do not know, that is usually the answer. We are happy to help you find out.