Generative AI and security considerations in software development : Perceptions and mitigation of risks regarding security among junior developers working in a Swedish government agency

Sammanfattning

Generative AI (GenAI) use has rapidly increased in software development mainly to increase productivity. The adoption of GenAI is however accompanied by issues that potentially introduce risks when used in software development, which has raised concerns among software developers. Some of these concerns are related to data and code-related security. The aim of this study was to increase the understanding of how these risks are perceived by junior software developers working in a Swedish government agency and what is done to mitigate them. To achieve this aim, software developers and GenAI were studied from a sociotechnical systems (STS) perspective. Semi-structured interviews were carried out with six participants to collect qualitative data complemented by quantitative data. The collected data was analyzed in an iterative process using thematic analysis. Four themes were identified during the thematic analysis: T1: Ambivalent trust in GenAI and hosting entities, T2: Organizational processes can empower users and increase perceived security T3: Developer knowledge and intuition key for perceived secure use T4: Personal awareness and perceptions of security. Using these four themes it is concluded that although the participants show an awareness of the mentioned risks when using GenAI in software development, most of them use GenAI daily. The perceived risks were found to be either trust related or due to differences in quality of output between different models and concerns about software developers becoming too reliant on GenAI. The factors that were found to be important to be able to mitigate the risks are mainly related to developer knowledge and the organization securing the use of GenAI. From a STS perspective these findings show factors that can improve the interaction between users and GenAI, as well as ways to enhance the efficiency of the socio-technical system as a whole.