{"id":93411,"date":"2024-05-05T18:00:00","date_gmt":"2024-05-05T22:00:00","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=93411"},"modified":"2025-06-08T14:32:33","modified_gmt":"2025-06-08T12:32:33","slug":"introducing-real-time-ide-scanning-more-secure-code-in-real-time__trashed","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/introducing-real-time-ide-scanning-more-secure-code-in-real-time\/","title":{"rendered":"Introducing Real Time IDE Scanning \u2013 More Secure Code in Real Time"},"content":{"rendered":"

The need to shift left<\/strong><\/h2>\n\n\n\n

The pressure to deliver quickly and efficiently is pervasive. Speed often comes at the expense of security. To address this, the \u201cshift left” philosophy has gained traction among development teams. This emphasizes the importance of integrating security measures early in the development lifecycle, rather than as an afterthought. We have also spoken about the need for security to be integrated throughout the entire SDLC \u2013  allowing you to secure your applications from the very first line of code, to runtime and deployment in the cloud.<\/p>\n\n\n\n

The rationale behind this strategy is straightforward: identifying and resolving security issues during the initial stages of development is significantly more cost-effective and less risky than making changes after deployment. By addressing security considerations earlier in the development process teams can prevent future headaches. This can also help get software to production faster, as it\u2019s easier to fix in the development cycle.<\/p>\n\n\n\n

The best way to secure applications is to bake security into the code from the start. Developers play a critical role in securing the software by adopting security best practices. However, that\u2019s easier said than done. There is a gap between theoretical best practices and truly embedding security into development.<\/p>\n\n\n\n

The security gap in software development<\/strong><\/h2>\n\n\n\n

Software developers aren\u2019t security experts. According to the Forrester report<\/a>, \u201cShow, Don\u2019t Tell, Your Developers How To Write Secure Code,\u201d none of the top 50 undergraduate computer science programs in the United States require a secure coding or secure application design class.<\/p>\n\n\n\n

Bridging the skills gap and fostering security awareness among developers is critical. This is why Checkmarx offers security training such as Codebashing<\/a>. However, training doesn\u2019t equal  instant changes. As a result, developers are relying on AI-generated coding due to the speed it provides and the mistaken belief that AI-generated code is somehow more secure. <\/p>\n\n\n\n

The new frontier of AI-generated code<\/strong><\/h2>\n\n\n\n

Traditional software development workflows are being reshaped with the proliferation of AI-generated code. GenAI tools, such as GitHub Copilot or Amazon CodeWhisper, fundamentally alter the coding process by providing suggestions, autocompleting code, and automating repetitive tasks. This shift represents a significant advancement in the field, with AI-driven assistants seamlessly integrated into coding workflows, enhancing human capabilities, and expediting development cycles.<\/p>\n\n\n\n

AI-generated code is a double-edged sword. While it offers the potential of productivity boosts and tapping into collective knowledge, there are potential risks.  Research into the increasing prevalence of AI-generated code and its potential to redefine software engineering practices<\/a>, has also identified the potential of reduced code quality<\/a> and security risks.<\/p>\n\n\n\n

Often ignored by developers, AI tools can generate insecure code. According to research<\/a>, \u201cParticipants with access to an AI assistant were also more likely to believe they wrote secure code, suggesting that such tools may lead users to be overconfident about security flaws in their code.\u201d<\/p>\n\n\n\n

Introducing real-time scanning in the IDE<\/strong><\/h2>\n\n\n\n

Real-time scanning in the IDE offers a security best practice for developers that complements Checkmarx SAST. It analyzes and provides real-time insights for:<\/p>\n\n\n\n

    \n
  • Human-generated code as it\u2019s being written by software developers<\/li>\n\n\n\n
  • AI-generated code using tools such as GitHub Copilot<\/li>\n<\/ul>\n\n\n\n

    This is a plugin for Visual Studio Code, and it scans in milliseconds, providing instant responsiveness in the IDE and even can scan source code repositories. In internal tests, we scanned over 1 million lines of code in under 10 seconds \u2013 much faster than other \u201cdeveloper-friendly\u201d solutions. <\/p>\n\n\n\n

    \n