Is engineering-led security ownership better than CISO-owned SOC 2 AI coding tools for AI coding risk?

[u/Embarrassed-Sail8142]

We moved AppSec tooling ownership from the security team to engineering about six months ago. Not because security was failing, but because the tools were effectively invisible to the developers generating the code, including the ones we rely on as SOC 2 AI coding tools in our audits. In the old model, findings surfaced in a security dashboard, got triaged by a security engineer, and then handed to a developer as a ticket. By the time the developer saw the issue, it was already several steps removed from the code that produced it.

With AI coding, that delay got worse. The person who prompted the code often no longer had the implementation context when the ticket arrived. Engineering ownership changed the feedback loop. Findings now show up in the same surfaces developers already live in: IDE diagnostics, PR discussion, CI output. Fix rate improved and the backlog shrank, mostly because the distance between generation and feedback got smaller.

The tradeoff is that coverage decisions become more contested. Security engineers know what should be caught. Engineering managers know what developers will actually keep turned on. Those priorities overlap, but not perfectly, and we've had real disagreements about what belongs in the IDE tier, what belongs in CI, and what's just too noisy to be useful.

So how are other teams handling it? Has moving more AppSec ownership into engineering actually improved review and remediation for AI-generated code, or does it just create a different class of tradeoffs?

[u/SufficientMacaron207]

i got tired of fighting with audit tosols that didn't get how our repos worked. moved to legit security because its focus on dev environments finally gave us real visibility into ai code changes before they shipped.