Understand this story
Gera Dorfman, Chief Product Officer at Orca Security, argues that the security scanning built into AI building tools is not sufficient to prove an application is secure, and that security teams need tools that can understand how these platforms build and connect applications. A case cited in the article shows that a distribution lead at Orca used AI to build a partner portal over a weekend; the built-in scanning let it pass directly, but after the company's security team tested access permissions, it found before production that the application could read other partners' records, and after the creator fed the results back to the AI tool, a fix was generated within minutes. Dorfman also emphasizes that applications employees build using personal accounts to bypass normal processes may be small in scale yet still able to read the entire customer database. At present, this claim is supported only by this one report, with no follow-up developments yet.
AI-generated from public reports
Latest development · Report
AI makes app development easier, and security protection must keep upDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 24
CTech
AI makes app development easier, and security protection must keep up
Gera Dorfman, Chief Product Officer at Orca Security, points out that the built-in security scanning of AI building tools is not enough to prove that an application is secure; security teams need tools that can understand how these platforms build and connect applications. In the case described in the article, a distribution lead at Orca used AI over a weekend to build a partner portal, and the built-in scanning let it pass directly, but after the company's security team tested access permissions, they discovered before production that it could read other partners' records; after the creator fed the results back to the AI tool, a fix was generated within minutes. Dorfman emphasizes that applications built by employees using personal accounts to bypass normal processes, even if small in scale, may be able to read the entire customer database.