Developers and their AI agents now push a couple thousand code commits in the time it takes to read one sentence, against about 150 a year ago. GitHub recorded 7.38 billion commits in September 2026 alone, more than five times the total from a year earlier. Every commit creates code that someone must understand, maintain and secure. For business leaders, the issue is no longer build speed but whether security programs can keep pace with what AI creates.
Why AI-generated code outpaced security teams
Cloud Security Alliance found that AI-assisted developers at Fortune 50 companies commit code at three to four times the rate of their peers, while their monthly security findings rose roughly tenfold. The team that inherits that volume has not grown: the CISO organization is the same size as a year ago, while vulnerability submissions rise, monthly fixes fall and unresolved critical issues expand. Gartner describes CISO burnout as a critical operational risk. The result is a risk gap between how fast software is created and how fast risk gets found and fixed.
Checkmarx responds with an architecture called Checkmarx Fusion, built from three layers working in sequence. Rules-based engines establish ground truth reproducibly and without token-based cost, covering predictable patterns. Frontier models are then directed at what rules cannot anticipate, including novel patterns, complex logic and exploitability in context. A findings analysis layer fuses both outputs into one trusted set. The same logic extends to prevention inside the IDE where developers write code, plus merge-ready fixes for the vulnerabilities that pass through.
Frontier models bring reach through probabilistic reasoning, finding novel exploits and uncatalogued flaws, including weaknesses that become exploitable only when separate parts of code interact. That power is inconsistent: Checkmarx research found that running the same scan on the same code five times produces matching findings only about a third of the time. Cost adds a second constraint, because frontier models bill by the token whether or not a scan finds anything. Scanning a one-million-line repository costs more than a thousand dollars at current published prices, and Uber, which spends 3.4 billion dollars a year on R and D, reportedly exhausted its entire 2026 AI budget within months of rolling out AI coding tools.
What combined scanning means for business
For companies adopting AI coding, the combined approach changes where effort goes. Deterministic analysis handles familiar classes such as hardcoded credentials and SQL injection reliably, which reduces validation work and leaves developers more time for fixing. Against a large language model working alone, Checkmarx reports up to four times the fidelity, two to four times the accuracy, and roughly a third of the cost. In a small company with few repositories, the gain shows up as fewer interruptions from false alarms. In a large enterprise scanning every commit, pull request and repository, the gain shows up as lower token spend and a shorter backlog of critical issues.
The choice still requires verification around three practical questions outlined in the source material. The first is trust: a finding that is not real costs a developer an afternoon and costs security credibility, and repeated false positives turn alerts into background static. The second is completeness, measured by an F1 score on a 1-0 scale that balances precision against missed issues; the industry average is about 0.20, while Checkmarx says its work reaches three to four times the accuracy of a standard scanner. The third is feasibility across the organization, since token use and price vary widely by model and reasoning load. None of these answers emerge reliably from a short pilot.
The marker to watch is whether combined pipelines reduce unresolved critical vulnerabilities while holding token cost per repository steady. If vendors publish audited F1 scores, repeatability rates and cost per million lines scanned, buyers can compare programs on facts rather than scan counts. That disclosure would show the risk gap closing in months rather than widening. Without it, commit volume will keep growing faster than fixes.
