Is being a Application Security Engineer
at risk from AI?

Not in the foreseeable future, but the role will transform significantly. AI excels at automating repetitive vulnerability scanning, dependency checks, and flagging common coding mistakes—tasks that already consume 40-50% of junior AppSec work today. However, the strategic parts of the role—threat modeling for complex business logic, designing security architectures that balance risk with usability, responding to novel attacks, and building security culture across engineering teams—require human judgment, organizational context, and trust that AI cannot replicate. The engineers at risk are those who focus exclusively on running automated tools and filing tickets. Those who evolve into security advisors, architects, and incident responders will remain in high demand. The role is shifting from 'security gatekeeper' to 'security enabler,' and AI is accelerating that transition.

Focus on skills that require deep context and human judgment. Threat modeling frameworks (STRIDE, PASTA) are valuable, but more important is learning to apply them to messy real-world systems with competing business priorities. Develop expertise in emerging attack surfaces like AI/ML security (prompt injection, model poisoning, data extraction), supply chain security (dependency confusion, malicious packages), and cloud-native architectures where traditional security boundaries don't apply. Soft skills matter more than most engineers realize: learn to communicate risk to non-technical stakeholders, build relationships with product and engineering teams, and influence without authority. Incident response and forensics skills are also highly resilient—when things go wrong, organizations need calm human judgment, not automated reports. Finally, get comfortable configuring and validating AI security tools themselves; someone needs to be the expert who knows what these tools can and cannot do.

The impact is already here but uneven. Routine vulnerability scanning and dependency management are heavily automated today—tools like Snyk, GitHub Advanced Security, and Semgrep are already doing work that junior engineers handled five years ago. Over the next 2-3 years, expect AI-assisted code review to become standard, reducing the need for manual security reviews of straightforward pull requests. The bigger shift will be 3-5 years out, as AI agents become capable of not just identifying vulnerabilities but proposing and testing fixes autonomously. This will compress the 'detect-report-remediate' cycle and reduce headcount needs for teams focused purely on vulnerability management. However, the strategic work—designing secure architectures, responding to incidents, and embedding security into organizational culture—will remain human-driven. Job growth will slow in traditional AppSec roles, but demand will stay strong for engineers who position themselves as security architects and advisors rather than tool operators.

Junior positions will become harder to find, but they won't disappear entirely. Entry-level roles that consist mainly of triaging scanner output, validating automated findings, and filing remediation tickets are already shrinking as AI handles more of that workflow. Companies are increasingly expecting new hires to arrive with some security experience rather than training them from scratch on tool operation. That said, junior roles focused on learning threat modeling, participating in architecture reviews, and supporting incident response will persist because these are apprenticeship skills that require human mentorship. If you're trying to break into AppSec, emphasize hands-on experience with secure coding, contribute to open-source security projects, and demonstrate you can think like an attacker—not just run tools. Certifications like OSCP (Offensive Security Certified Professional) or practical experience from CTF competitions signal you bring more than automation can provide.

Salaries for senior AppSec engineers and architects remain strong (often $150k-$250k+ in major tech markets) because demand for strategic security expertise continues to outpace supply. However, the salary floor for junior roles is compressing as automation reduces the value of entry-level scanning and triage work. We're seeing a widening gap: experienced engineers who can design security programs and lead incident response command premium compensation, while early-career engineers face more competition for fewer positions. Geographically, remote work has intensified competition—companies can now hire AppSec talent globally, which benefits senior specialists but puts pressure on junior salaries in high-cost regions. The engineers seeing salary growth are those with specialized skills (cloud security, AI/ML security, supply chain risk) and strong communication abilities. If you're purely technical without business acumen or leadership skills, expect salary growth to flatten as AI handles more of the technical execution.

Yes, modestly more resilient, but the gap is narrowing. AppSec has historically been more resistant to automation because security requires adversarial thinking—anticipating what attackers will do, not just what the system should do. This 'red team' mindset is harder for AI to replicate than straightforward feature development. Additionally, security work involves high-stakes judgment calls about risk acceptance, regulatory compliance, and incident response that organizations are reluctant to delegate to automated systems. However, the routine parts of AppSec (vulnerability scanning, dependency management, basic code review) are automating faster than many security engineers expected. General software engineering roles that focus on architecture, product strategy, and cross-functional leadership are equally resilient. The real dividing line isn't AppSec vs. SWE—it's strategic vs. execution-focused work. AppSec engineers who think like security architects will outlast software engineers who only write code, but software engineers who drive product direction will outlast AppSec engineers who only run scanners.

AI security is a smart bet but not the only path. The field is growing rapidly—prompt injection, model extraction, adversarial examples, and AI supply chain risks are all areas where tooling is immature and expertise is scarce. If you specialize now, you'll be ahead of the curve as organizations scramble to secure their AI deployments. However, AI security is still a niche; most companies don't yet have dedicated AI security roles, so you may need to position it as an additional skill rather than your sole focus. A safer strategy is to build broad security architecture skills while developing AI security as a differentiator. Learn how to secure AI/ML pipelines, understand model security risks, and stay current on emerging threats—but also maintain core AppSec competencies like threat modeling, secure architecture design, and incident response. This makes you valuable to organizations whether or not they're heavily invested in AI. The engineers with the most resilience will be those who can secure both traditional applications and AI systems, not specialists who bet everything on a single emerging area.