How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI-Assisted Secure-Coding Workflow
Measure AI code against a human baseline
Verify that metrics are collected on AI-produced and AI-mediated code, and that the results are compared against a human-only baseline. Vulnerability density, mean-time-to-detect, AI-attributable defect rate, prompt-injection detection rate, and fork-PR rejection rate are all useful.
OWASP AISVS v1.01, requirement AC.1.4
In plain English
Measure the security quality of AI-produced code against code written without AI, using figures like vulnerability density, time to detect and defects traced to AI.
What good looks like
- Code is tagged so AI-produced changes can be identified.
- Metrics are collected for both groups.
- Results are reviewed and drive changes to the workflow.
How teams usually do it
- Commit trailers or PR labels for AI involvement, joined with scanner and incident data.
Evidence an auditor would accept
- A recent metrics report.
Common mistakes
- Collecting metrics nobody looks at.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.