AI is Accelerating Retail Development — and Exposing New Security Gaps

Retail technology teams face a paradox: artificial intelligence is transforming how software gets built, yet the very tools that accelerate delivery are outpacing the security processes designed to protect it. For retailers competing on digital experience, faster development is essential. However, as the use of generative AI to create code and automate features becomes standard practice, the risks are real and rising.

These rising risks play out in the real world with growing frequency. Air Canada was recently held liable after its website chatbot provided incorrect guidance on bereavement refunds, leading to a tribunal ruling that the airline was responsible for misinformation generated by its own AI tools. Companies must now take full responsibility for the outputs their AI systems generate. That means establishing strong governance frameworks, enforcing rigorous oversight at the data and policy layers, and embedding integrated security and quality controls at the point of model and code creation.

The New Reality: AI-Driven Development Has Accelerated Risk

Safer AI starts in the integrated development environment (IDE), where modern applications are built. Developers are no longer writing every line of code themselves. Increasingly, they’re prompting AI tools to generate functions, workflows, and sometimes entire application components.

In retail environments where digital innovation directly drives revenue, this shift is especially visible. AI-generated code now helps power e-commerce storefronts, payment integrations, mobile apps, inventory systems, and personalization engines. The result is dramatically faster development cycles. However, it also means that a growing percentage of application code is created without traditional human review at the moment it’s written.

Research consistently shows that AI-generated code often includes insecure defaults, flawed logic, or vulnerable dependencies. These issues aren’t always obvious, and many traditional scanning tools struggle to detect them early in the development process. For retailers processing large volumes of customer and payment data, that risk has serious implications.

Why Traditional AppSec Can’t Keep Up

Historically, application security followed a predictable model: developers wrote code and security tools scanned it later in the pipeline. That model worked when development cycles were slower and security teams had time to review findings before software reached production.

AI-driven development disrupts that workflow in two ways. First, it dramatically increases the volume of code being produced, leaving security teams with more vulnerabilities to triage than ever before. Second, risk now originates at the moment code is created, not just after it’s committed or deployed.

If security checks only occur after code enters a repository, the vulnerability may already be embedded in the application architecture.

Retail organizations relying solely on traditional post-commit scanning are often discovering issues long after developers have moved on to the next feature, when remediation becomes far more complex.

Security That Matches AI Pace

To keep pace with AI-assisted development, security needs to operate at the same speed and within the same environments where code is created. That means applying security in layers across the development lifecycle rather than relying on a single scanning stage.

The first layer is security at the point of creation. Embedding security guidance directly in the developer’s IDE allows vulnerabilities to be identified immediately, whether the code was written manually or generated by AI. Developers can fix issues while the code is still in context.

The second layer extends security into pull requests and CI/CD pipelines, where automated analysis evaluates code changes within the broader application. This stage helps identify issues that only emerge when components interact, such as insecure dependencies or risky integrations.

Finally, organizations increasingly rely on autonomous analysis and prioritization to keep pace with development speed. Advanced automation helps triage vulnerabilities, identify the most critical risks, and reduce the noise that often overwhelms developers and security teams.

Secure at AI Speed

Retail applications connect directly to customer data, payment systems, and operational infrastructure. A vulnerable API or insecure dependency can expose sensitive customer information or disrupt critical business functions. At the same time, retailers can’t afford to slow innovation. Digital experiences, from mobile shopping to personalized recommendations, have become core drivers of customer loyalty and revenue growth.

As AI continues to reshape software development, application security must evolve alongside it. A layered approach that integrates security from the IDE through automated analysis allows organizations to move quickly without sacrificing protection. In the AI era, security isn’t a gatekeeper, it’s a partner in delivery.

Ori Bendet is vice president of product management at Checkmarx, the leader in agentic application security.