Why AI Security Training Can't Wait Until After the Breach

There's a pattern I've seen repeat itself across every security role I've held — at PayPal, at Kyndryl, at ActiveFence. A team adopts a new technology fast. Security training follows slowly. The breach happens somewhere in between.

We're in that gap right now, and this time the technology is AI-assisted coding.

The speed problem

Developers using Copilot, Cursor, or any agentic coding tool ship code faster than any previous generation. That's genuinely valuable. But speed without security awareness is a liability that compounds with every commit.

The problem isn't that AI tools write bad code. It's that they write confident code — fluent, plausible, syntactically clean code that can contain broken access control, insecure deserialization, or a hardcoded credential, all without a single warning. Static analysis catches some of it. Developer knowledge is supposed to catch the rest.

When developer knowledge hasn't been updated since 2019, you have a gap.

What "training" has meant until now

For most engineering teams, security training means a 40-minute compliance module once a year. It checks a box. It changes nothing.

The developers who go through it don't leave knowing how an SSRF attack works, why JWT algorithm confusion is dangerous, or what makes a prompt injection different from a SQL injection. They leave knowing they completed the training.

That's not a knowledge asset. That's a liability disguised as a checkbox.

What the SDLC actually needs

A secure SDLC isn't a gate at the end of the pipeline. It's a habit distributed across every person who commits code. Threat modelling at design time. Input validation as a reflex. Access control decisions made by developers who understand why they matter — not because a scanner flagged a finding two weeks later.

Building that habit requires training that's contextual, repeated, and tied to real code patterns. Not a slide deck. Not a phishing simulation. Missions that put a developer inside a vulnerable codebase and ask them to find and fix the flaw.

The cost of waiting

The IBM Cost of a Data Breach report has put the average breach cost for mid-size organisations above $4 million for years running. The share attributable to human error — which includes developers shipping insecure code — is consistently above 70%.

Training isn't a cost centre. It's the cheapest control in your entire security stack, and the one most companies deprioritise until they're explaining a breach to a board.

Don't wait for the breach to make the case for training. Make it now, with data, before a CISO has to make it with a post-mortem.