As reported by Dark Reading, Checkmarx has appointed Kobi Sivilya as its new Chief Information Security Officer, bringing cybersecurity and technology leadership experience to the company at a time when AI is fundamentally reshaping how software is built, tested, and secured.

Key Insight: As reported by Dark Reading, Checkmarx has appointed Kobi Sivilya as its new Chief Information Security Officer, bringing cybersecurity and technology leadership experience to the company at a time when AI is fundamentally reshaping how software is built, tested, and secured.

This appointment is more than a routine executive shuffle. It reflects a structural shift happening across the application security vendor landscape — one that every security leader should be paying attention to.

The Convergence Driving AppSec Leadership Changes

For years, application security vendors treated internal security as a back-office function. That posture no longer holds. Three converging pressures are forcing AppSec companies to elevate CISO-level leadership:

The Convergence Driving AppSec Leadership Changes
AI-generated code is flooding pipelines. Developers are increasingly relying on AI coding assistants and large language models to generate functionality. This code enters repositories at velocity, often without human review of security implications. The volume and opacity of AI-generated code demands a security leader who understands both the development lifecycle and emerging AI threat models.
Supply chain attacks have made AppSec vendors prime targets. The SolarWinds and 3CX compromises demonstrated that security vendors themselves are high-value targets. A compromise at an AppSec vendor can cascade across thousands of downstream customers. Internal security is now a customer trust issue, not just an IT hygiene issue.
Regulatory scrutiny is intensifying. The SEC's cybersecurity disclosure rules, the EU's Cyber Resilience Act, and evolving software supply chain executive orders are pushing security from an operational concern to a board-level governance issue. Vendors need CISOs who can speak to regulators, customers, and boards with equal fluency.

What This Means for the Broader Market

The AppSec vendor that cannot secure its own pipeline will not survive the trust crisis that follows the next major supply chain compromise.

Checkmarx's move signals that the market is maturing. We expect to see more AppSec and DevSecOps vendors appoint dedicated CISOs with development-lifecycle expertise rather than repurposing IT security leaders. The skill set required is distinct: understanding SBOM management, pipeline integrity, AI code provenance, and developer-facing security workflows.

For security leaders at non-vendor organizations, this trend is equally relevant. If your application security tooling provider lacks a visible CISO and a published security posture, that should factor into your third-party risk assessments. The security of your tools is now part of your own attack surface.

Key Questions for Vendor Security Evaluations

  • Does the vendor have a dedicated CISO with application security background, or is security managed as a secondary responsibility?
  • What controls are in place for securing AI-assisted development within the vendor's own engineering organization?
  • Is the vendor's SBOM available to customers, and how frequently is it updated?
  • How does the vendor handle pipeline integrity and build attestation?

Shield53 Recommendations

  • Update third-party risk assessments for all AppSec and DevSecOps vendors to include CISO presence, security governance maturity, and AI code governance policies.
  • Evaluate your own AI code pipeline exposure. If your organization uses AI coding tools, ensure security review processes account for AI-generated code — traditional SAST/DAST may not fully cover LLM-generated patterns.
  • Request SBOMs from security vendors. If your AppSec vendor cannot provide a current SBOM and pipeline attestation, treat that as a risk indicator.
  • Elevate internal AppSec leadership. If your organization has significant development operations, consider whether your CISO has sufficient application security expertise — or whether a dedicated AppSec leader is needed.
  • Monitor vendor security disclosures. Track whether your security vendors are transparent about their own incidents and posture. Silence is not a positive signal.