11 | 2026 Erkka Korpi, Senior Software and Cloud Security Engineer, Partner, Kipinä
It’s no coincidence that cybersecurity has been a hot topic of discussion lately. Data breaches and threats occurring on a global scale affect both companies and individuals. Artificial intelligence is transforming software development in two ways at once. Companies are able to build new applications and features at an unprecedented pace. At the same time, attackers have access to exactly the same technology—without the safeguards, regulations, or caution that companies employ.
We asked Erkka Korvela, an information security expert at Kipinä, three questions that every company building a digital business should be asking right now.
1. How is data security ensured in AI-enabled rapid product testing, innovation, and, for example, vibe coding?
Artificial intelligence has radically lowered the barrier to entry for software development, making it possible to go from an idea to a working prototype in a matter of hours or days, while at the same time enabling people without in-depth software development expertise to build increasingly complex technical solutions.
"This enormous opportunity from an innovation perspective is, on the one hand, incredible, but at the same time, it gives rise to a new kind of risk."
With Vibecoding, the end result may appear to function properly without the developer necessarily having the ability to assess what’s happening beneath the surface. Is the authentication working correctly? Are access rights in order? Where does the data end up? Is the library suggested by the AI secure? Can an outsider access something they shouldn’t?
Therefore, code generated by AI should not automatically be considered “secure code” as is. OWASP also highlights the uncritical acceptance of AI-generated code as a growing risk in software development. However, the solution is not to slow down innovation, but to build secure safeguards around it.
At the enterprise level, this means in practice, for example, that there are clearer rules governing the use of AI, data, and access rights, code generated by AI goes through standard review and testing procedures, dependencies and vulnerabilities are checked, and access to production environments is strictly restricted—under the guidance of a qualified cybersecurity expert. Particularly when it comes to critical functions, there is an increasing need for deep expertise—the ability to understand what the code actually does and to take responsibility for it.
"A good rule of thumb could actually be very simple: the easier construction becomes, the more important the constraints on construction become."
2. Why is information security becoming an increasingly critical part of agent-based software development?
In agent-based software development, AI no longer merely suggests a single line of code. An agent can design solutions, edit multiple files, install dependencies, run commands and tests, and use various tools as part of completing a task.
"As capabilities grow, so do the digital footprint, the attack surface, and the scope of impact of any potential error."
In traditional development, a developer is constantly engaged in the work: writing, reading, and reviewing code. In agent-based development, a single person can oversee a significantly larger volume of work. It is no longer possible to evaluate everything that is produced solely through the developer’s eyes. This in itself changes the role of information security.
Information security cannot be a check performed at the end of a development project to see if the finished product is secure. It must be an integral part of the environment and the development process: what permissions agents have, what data and systems they can access, what they are allowed to do independently, how changes are tested, and who approves critical decisions.
When working with agents, the principle of least privilege is particularly important: an agent is not granted all the access that the developer himself happens to have, but only the permissions required to perform the task at hand.
"Information security is therefore by no means an obstacle to the development of agents. On the contrary! Well-designed information security makes it possible to utilize agents more boldly and on a broader scale than ever before."
3. Why are cybersecurity risks particularly prominent right now?
Simply because the same technology that empowers defenders and software developers also empowers attackers.
Companies often adopt artificial intelligence in a controlled manner. New tools are evaluated, access rights are considered, lawyers review the terms and conditions, and the organization learns new ways of working.
Attackers do not face the same limitations, and these same highly effective AI tools are making attacks increasingly aggressive. AI can also lower the threshold for launching attacks and help automate and scale operations. At the same time, companies’ own digital footprints are growing rapidly: new applications, integrations, APIs, cloud services, AI components, and agents are emerging. Every new connection can also mean a new point whose security must be understood.
That is why, when it comes to information security, we can no longer focus solely on how to prevent an attack.
An equally important question is: what happens if someone gets through?
Where is our critical data located? How far can an attacker penetrate our systems? Will we even notice what happened? Can we isolate the problem? Do we have working backups? Who makes the decisions in a crisis? How quickly can business operations be restored?
Effective information security is therefore built on three capabilities: prevention, detection, and recovery.
“Attackers aren’t going to sit around waiting for companies to develop their AI capabilities.”
Erkka Korpi, Senior Software and Cloud Security Engineer, Partner, Kipinä
Faster development requires information security that evolves just as quickly
Alongside the momentum driven by AI and agent-based development, companies should ensure that their ability to manage risks evolves at the same pace as their new development capabilities.
In my opinion, the first step is very practical: figure out where you are right now.
Kipinä’s application, cloud, and AI security assessment examines the application and its cloud environment from both the defender’s and the attacker’s perspectives. The AI security assessment also takes into account AI and language model components, the AI-assisted development process, and the management of data, access rights, and tools.
The goal is not to produce a long list of potential threats, but to answer a more fundamental question: where do our greatest risks lie right now—and what should we do about them first?
Erkka Korpi, Senior Software and Cloud Security Engineer, Partner, Kipinä
This article was written by one of Kipinä's seasoned experts. Erkka's principled and inquisitive nature drives his passion for understanding how things truly work deep beneath the surface. Technology is Erkka's passion both as a consultant in Supercell's team and in his free time: “I like to dive into the deep end.”