Skip to main content

Black Duck releases report on AI code security gap

Source Decision Insights Record Published December 17, 2025 Companies 1
Human View Machine View

1st article in the last 90 days, one of 12 articles referencing Synopsys. Previous coverage: Weekly Intelligence Brief on High Performance Computing and Quantum Technologies - Week of August 25, 2025 (Aug 2025).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
How to start
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Black Duck released a report that documented a gap between broad use of Artificial Intelligence (AI) tools in software development and limited protections for code produced by those tools, a difference the report said increased risk across software supply chains.

The report presented survey data showing that 95% of respondents used AI tools in development while only 24% performed comprehensive intellectual property, license, security, and quality evaluations on AI-generated code, a shortfall the report said exposed the software supply chain to potentially severe and unaddressed risks.

The study also described several practices and their measured outcomes: 76% of respondents checked AI-generated code for security risks; organizations effective at tracking open source dependencies reported 85% preparedness compared with 57% overall; respondents using automatic continuous monitoring reported a 60% rate of remediating critical vulnerabilities within a day versus 45% for the full group.

The report outlined additional findings on third-party verification and controls: respondents that always validated SBOMs reported 63% high preparedness to evaluate third-party software and 59% typically responded to critical vulnerabilities within one day; respondents using at least three compliance controls remediated critical vulnerabilities within a day at 49%, rising to 54% for those using at least four controls, while 35% cited interpreting and operationalizing complex regulatory requirements as their biggest challenge.

“We're in a new era of rapid software innovation, fueled by AI, but these findings reveal a critical challenge: security isn't keeping pace,” “It's imperative that organizations prioritize robust security frameworks, with a sharp focus on AI-generated code and meticulous dependency management, to build truly resilient software supply chains,” said Jason Schmitt.

The study was conducted by UserEvidence using a survey of 540 software security leaders and practitioners and was published as the report titled “Navigating Software Supply Chain Risk in a Rapid-Release World,” which emphasized that a resilient software supply chain extended beyond compliance and enabled organizations to address vulnerabilities, minimize downtime, prevent data breaches, and improve developer productivity and development velocity.

Press release, provided by Cision on behalf of Synopsys. Read the original.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/black-duck-releases-report-on-ai-code-security-gap/",
        "name": "Black Duck releases report on AI code security gap",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/black-duck-releases-report-on-ai-code-security-gap/#blogposting",
    "@type": "NewsArticle",
    "about": {
      "@id": "https://decisioninsights.ai/registry/synopsys/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/synopsys/",
      "name": "Synopsys"
    },
    "articleSection": [
      "Cybersecurity",
      "Artificial Intelligence"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
      "@type": "Person",
      "name": "Decision Insights Record",
      "url": "https://decisioninsights.ai/author/decision-insights-signals/"
    },
    "dateModified": "2026-08-27T10:32:16-06:00",
    "datePublished": "2025-12-17T07:11:14-07:00",
    "description": "Black Duck report found 95% used AI in development while 24% applied full IP, license, security and quality checks to AI-generated code.",
    "headline": "Black Duck releases report on AI code security gap",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@type": "Organization",
        "name": "Cision"
      },
      "url": "https://www.prnewswire.com/news-releases/black-duck-report-reveals-software-supply-chains-vulnerable-as-ai-adoption-outpaces-security-302644341.html"
    },
    "keywords": [
      "Compliance",
      "Software",
      "Supply Chain",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/black-duck-releases-report-on-ai-code-security-gap/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-27",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/synopsys/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/synopsys/",
        "name": "Synopsys"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
    "@type": "Person",
    "description": "Press releases and independent analyst research, structured into concise summaries for research and monitoring. Produced under our Standards & Methodology.",
    "name": "Decision Insights Record",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-signals/"
  }
]

Is this your company? Get structured data for your own pages