A Harvard Business School study tracking GitHub activity reveals something your security team needs to see: developers using Copilot increased their coding time by 12.4%, while their project management activities dropped 24.9%. More strikingly, peer collaboration events fell by almost 80%.
These aren't just productivity metrics. They're signals that AI-assisted development is fundamentally changing how your team writes, reviews, and maintains code. For security engineers, that shift carries specific risks you can measure and mitigate.
What the Data Shows
The study tracked developers' actual GitHub activity before and after Copilot adoption. Here's what changed:
Coding volume increased, everything else decreased. Developers spent more time writing code and less time on pull request reviews, issue discussions, and documentation. The largest productivity gains appeared among less-experienced developers, who increased their core coding time significantly.
Collaboration patterns collapsed. An 80% drop in peer collaboration events means fewer code reviews, fewer architecture discussions, and fewer opportunities to catch security issues before they reach production. Your junior developers might be shipping faster, but they're doing it with less oversight.
Project management tasks fell by a quarter. The 24.9% reduction in project management activities suggests developers are spending less time on planning, documentation, and cross-team coordination. These activities aren't just bureaucratic overhead; they're crucial for surfacing requirements conflicts and security considerations early.
What This Means for Your Security Program
Code Review Becomes Your Critical Control Point
When collaboration drops 80%, your formal code review process becomes the primary gate for catching security issues. You can't rely on the informal peer review that used to happen naturally.
Review your current code review requirements. If you're following OWASP ASVS v4.0.3, Verification Requirement 14.2.1 requires secure code review processes. With less peer collaboration, you need explicit security review checkpoints for:
- Authentication and authorization logic
- Input validation and output encoding
- Cryptographic implementations
- Third-party dependency additions
- Database query construction
Junior Developer Output Needs Structured Security Scaffolding
The study shows less-experienced developers gain the most from AI tools. That's valuable for productivity, but it creates a security risk: junior developers shipping more code with less mentorship.
You need guardrails that don't slow down their increased output:
- Pre-commit hooks that catch common security anti-patterns (hardcoded secrets, SQL concatenation, unsafe deserialization)
- IDE-integrated security linters that provide real-time feedback
- Mandatory security-focused code review for authentication, authorization, and data handling changes
- Automated security testing in CI/CD that blocks obvious vulnerabilities
Your Threat Model Needs an AI Assistance Assumption
Traditional threat modeling assumes humans write code with full context of what they're building. AI-assisted code changes that assumption. Developers might implement Copilot suggestions without fully understanding the security implications.
Update your threat modeling process to account for:
- Code that implements functionality the developer didn't explicitly design
- Dependencies or libraries suggested by AI that the developer hasn't vetted
- Security patterns copied from training data that might be outdated or context-inappropriate
- Reduced tribal knowledge about why certain security decisions were made
Action Items by Priority
Immediate (This Sprint)
Audit your code review coverage. Calculate what percentage of merged PRs received security-focused review in the last 30 days. If it's below 100% for changes touching authentication, authorization, or data handling, that's your baseline problem.
Inventory your pre-commit security checks. What security issues can developers catch before they even create a PR? If you're not scanning for secrets, checking dependency vulnerabilities, and linting for common security anti-patterns, you're relying entirely on human review.
Short-Term (Next Quarter)
Implement security review triggers. Define specific code patterns that require security team review: new authentication mechanisms, cryptographic implementations, privilege escalations, data export features. Make these triggers explicit in your PR templates and CI/CD checks.
Create AI-aware secure coding guidelines. Your existing secure coding standards probably assume developers are writing code from scratch. Add guidance specific to AI assistance: how to validate AI suggestions, when to reject plausible-but-insecure patterns, which security contexts require human-only implementation.
Measure collaboration metrics. Track PR review participation, issue discussion activity, and documentation updates. If these are declining, you're seeing the same pattern the study identified. You need countermeasures before the knowledge gap becomes a security gap.
Long-Term (Six Months)
Redesign your security training program. If junior developers are coding more but collaborating less, they're missing the informal security mentorship that used to happen in PR reviews and pair programming. You need structured security training that replaces that lost knowledge transfer.
Build security context into your development environment. Instead of relying on developers to remember security requirements, embed them in the tools. IDE plugins that highlight PCI DSS v4.0.1 requirements for payment handling code, or OWASP Top 10 2021 risks for the specific code patterns developers are working on.
Establish security office hours. With less organic collaboration, create explicit time for developers to ask security questions. Make it low-friction and high-value: real code reviews, threat modeling sessions, security design consultations.
The Underlying Risk
The 80% collaboration drop isn't just a cultural concern. It's a security control failure. Peer review, informal knowledge sharing, and collaborative problem-solving are how security knowledge spreads through your engineering team. When those activities collapse, you're creating security knowledge silos.
AI tools aren't going away. The productivity gains are real, especially for less-experienced developers. But you can't let increased coding velocity outpace your security controls. The answer isn't to ban AI assistance; it's to redesign your security program for a world where developers code more and collaborate less.
