devopsy.kinsta.cloud

Tag: ai

AWS AI Agent Surfaces Recommendations to Optimize Cloud Computing Environments

Amazon Web Services (AWS) today made available a preview of an artificial intelligence (AI) agent that surfaces recommendations to optimize cost, security, performance and resilience based on the business objectives an organization defines.

Jill Fariss, vice president of AWS Support, said the AWS Well-Architected Agent generates code that can be implemented via a command line interface (CLI), an infrastructure-as-code tool or some type of runbook automation.

The overall goal is not to eliminate the need for humans to manage IT infrastructure but rather make it simpler for engineers and IT administrators to manage workloads at much higher levels of scale, added Fariss. That capability is critical because most organizations today simply don’t have enough IT staff to effectively manage and optimize the workloads they currently have deployed, an issue that is only going to be further exacerbated as advances in AI make it possible to build and deploy even more applications, she noted.

The AWS Well-Architected Agent is designed to function much like a cloud architect that continuously correlates metrics, resource configurations, and application topology that are then analyzed using a set of best practices that AWS has defined across more than 65 of its services. Based on the goals an organization might have, it will then surface recommendations that highlight the tradeoffs that might need to be made to achieve one goal versus another, said Fariss.

In addition to presenting those consolidated findings, the AWS Well-Architected Agent also provides step-by-step remediation guidance and, when applicable, the costs that might be incurred. DevOps engineers or an IT administrator can define the business goals they are trying to meet or, alternatively, opt to run AWS Well-Architected Agent simply to discover issues and suggestions for resolving them.

It’s not clear what the future will hold for DevOps engineers and IT administrators in the AI era, but the only thing that is certain is the level of expertise required to manage complex IT environments will continue to steadily decline. In some cases, organizations will opt to rely on smaller teams of engineers to manage workloads at much higher levels of scale. In other cases, organizations may opt to augment IT administrators that typically cost less to hire and retain.

Regardless of approach, each organization will ultimately need to determine the scope of the tasks that it is comfortable with an AI agent automating with little to no intervention on the part of an IT professional necessarily being required. For now, however, AI agents that are deployed to optimize IT operations still need to establish a level of trust, said Fariss.

IT teams, ultimately, should expect the number of AI agents being made available by providers of IT infrastructure to only increase in both number and capabilities. The challenge and the opportunity then becomes determining precisely where the separation of duties and responsibilities between various AI agents and the humans that supervise them is going to lie not just today but, more importantly, a few short months from now as the capabilities of AI agents continue to expand and evolve.

October 1, 2026
Introducing Futurum Media: Why Futurum, Why Now?

I am a builder. My career has spanned the rise of the commercial internet, web hosting, application service providers, managed infrastructure, security, DevOps, cloud native computing, platform engineering and now AI. Through all of it, I have been a builder and a leader.

I didn’t think, after all these years, I would be building again quite like this. But in the age of AI, we can all be builders. I am happy to be doing this.

Today, The Futurum Group is launching Futurum Media, bringing Techstrong, Tech Field Day and Visible Impact together into a go-to-market execution business. It becomes the umbrella for Futurum’s editorial properties and media services, backed by the broader organization’s research, intelligence and expertise.

For those of you who read DevOps.com and our other publications, participate in our programs or work with us, here is why I believe this is a significant next step.

A Community Worth Building On

DevOps.com grew alongside a community changing how software was developed and delivered. People needed somewhere to share what worked, debate what didn’t and question the claims being made. We helped provide that place.

As Techstrong expanded across cybersecurity, cloud native, AI and enterprise IT, those conversations became increasingly connected. Our readers were working across those boundaries long before anyone reorganized a coverage calendar around them.

The relationships we built are the foundation of Futurum Media. Readers give us their time because they expect useful information. Practitioners contribute because they have something worth sharing. Commercial partners work with us because we have earned the attention of people they want to reach.

We have to keep earning it. Bringing more expertise into that work is a good reason to build.

The Tip of the Spear

Futurum Media is the tip of the spear for the full Futurum enterprise.

Techstrong brings specialist publications, journalism, video, events and community relationships. Tech Field Day puts experienced practitioners in the room with technology developers, where they can examine products and ask the questions a presentation might leave unanswered. Visible Impact helps companies explain complex technology and turn that understanding into effective positioning and sales conversations.

Behind them stands a much broader set of capabilities. Signal65 can test technical claims. ETR can examine enterprise buying priorities and spending intentions. Futurum Research’s analysts interpret market developments and what they mean for upcoming decisions. The Futurum Intelligence Platform provides access to proprietary research and data, while Six Five Media brings executive and analyst perspectives into the conversation.

That combination connects technical performance with buyer priorities and market direction. It gives us more ways to investigate a subject and more people qualified to challenge an assumption.

For clients, those capabilities can support work from the initial market question through content, engagement and demand generation. For readers, they give us a deeper foundation for coverage. Futurum Media can draw on the resources appropriate to the task, whether that task calls for a single asset or a sustained program.

Why Now? Look at the Work in Front of Us

AI is changing how software gets written, how systems operate and who gets to build them. It is also changing how people find information and decide what to buy.

Producing more code or content has become easier. Assessing it still takes work. Does it solve the problem? Can it be trusted in production? What does it cost to operate? What happens when something goes wrong?

Our readers have to answer those questions. Vendors have to explain themselves to buyers who are busy, skeptical and swimming in material competing for their attention.

The industry needs informed scrutiny, technical depth and people willing to say what they think. Futurum has research, engineering expertise and enterprise buyer intelligence to bring to that work. Futurum Media gives those resources a direct connection to communities already wrestling with these decisions.

The exchange should run both ways. A practitioner’s deployment problem can expose a gap in the market’s assumptions. Buyer research can challenge a popular industry narrative. A technical evaluation can give everyone a better basis for discussion.

That is useful to an engineer choosing a tool, an executive approving an investment and a company trying to earn a place in the market.

Forward Analysts, Forward Media

Daniel Newman and the Futurum analyst team bring an approach that appeals to anyone building a business: Examine what is happening now with an eye toward the decisions coming next.

Where will buyers put their money? Which architectures could alter a market’s economics? What might accelerate adoption, and what stands in the way?

Answering requires evidence and a willingness to take a position. It also requires being willing to change that position when the facts warrant it.

Forward Media brings that analysis into reporting, interviews and technical discussions that people can participate in and question. It gives the industry continuing access to the thinking, along with opportunities to challenge it.

Credibility makes this work. Research findings must stand on their merits. Tech Field Day practitioners must be free to reach their own conclusions. Editorial judgment must remain independent, and commercial programs must be clearly identified. The audience’s trust is something we earn through those decisions.

Still Building

Writing The Indispensability Trap gave me room to examine AI’s economics, the enormous investments behind it and the assumptions about where lasting value will reside. Those questions are very much on my mind as we build Futurum Media.

I am excited about what AI enables people to create. I also believe the bets being made deserve serious examination. We can contribute to both, helping people understand the technology and giving them room to debate where it is taking us.

I get to do that alongside colleagues whose expertise expands what we can accomplish together. After all these years, that still makes me want to get to work.

To our readers, contributors, partners and everyone who has helped build these communities, thank you. You made this next chapter possible. I hope you will help shape it.

Learn more about Futurum Media.

Forward analysts. Forward media. Forward, engage.

October 1, 2026
Survey Surfaces Sharp Increase in Amount of Code Written by AI

A global survey of 705 developers and IT leaders finds 42% of respondents reporting that artificial intelligence (AI) now writes at least half their code, with only 21% of developers now spending more than half their week writing new code from scratch.

Conducted by BairesDev, a provider of software development services, the survey also finds nearly 80% of developers now spend less than half their week coding. As a result, developers on average are saving 13 hours a week on coding, allowing them to devote more time to reviewing AI output (67%) and debugging it (52%).

Developers are also now spending, on average, nine hours a week learning AI tools and new technologies. That investment appears to also be paying off, with AI tool fluency (29%), system architecture (20%), and human skills (15%) expertise driving pay increases for developers, the survey finds.

A full 86% of respondents also report they now find their role in their organization more fulfilling, according to the survey. In addition, 51% of developers noted that accountability for AI-generated code sat with them personally.

BairesDev CTO Justice Erolin said that while AI has transformed coding, the rest of the software development lifecycle remains a work in progress. For example, only 7% of developers said the ship decision has been entirely delegated to AI without their input. Another 32% said it has been delegated to AI with a developer in the loop.

It’s not clear at what pace DevOps teams are re-engineering workflows for the agentic AI era, but the amount of code being created is clearly starting to overwhelm existing pipelines. Ideally, DevOps teams will be relying more on AI agents to manage those pipelines, but for the moment, at least the pace at which applications are being deployed has not exponentially increased. Organizations are definitely generating more code than ever, but the percentage of it that winds up being deployed in a production environment differs widely from one team to the next.

The one thing that is apparent is that humans won’t so much be in the middle of the DevOps loop in the AI era so much as they will be observing and supervising the activities of AI agents, noted Erolin. Otherwise, human engineers will eventually become just another bottleneck slowing down the pace at which software is built and deployed, he added. At the same time, AI agents that are not properly governed will simply run amok in ways that would be too difficult for most DevOps teams to discover and contain on their own, noted Erolin.

Of course, re-engineering DevOps workflows will require some level of additional investment. In some cases, that may simply come in the form of additional training for software engineers. However, many organizations will also be revisiting the continuous integration/continuous deployment (CI/CD) platforms that were not designed for the agentic AI era.

Regardless of approach, there is at this juncture no going back. The challenge and the opportunity now is determining how best to employ AI agents to safely deploy more software at a scale that a few short years ago would have seemed unimaginable.

September 30, 2026
Perforce Applies Machine Learning to Generate Synthetic Data for App Testing

Perforce Software has added a tool that leverages artificial intelligence (AI) to make it simpler for application development teams to generate synthetic data for application testing purposes.

Mayank Ahluwalia, a senior product manager for Perforce Delphix, said Delphix Synthetic Data makes use of machine learning algorithms to generate synthetic data for specific use cases. It automatically identifies data structures, relationships, and business context across multiple sources.

Historically, DevOps teams would have had to manually provide access to those data sources using some type of legacy tool, he added.

The overall goal is to limit or eliminate the need to give application development teams access to production data in order to test an application, noted Ahluwalia. At the moment, providing those teams with access to data needed to run tests has become a bottleneck that can be eliminated by using a self-service platform for generating synthetic data, he added. That capability will be especially critical as AI agents are relied on more to create and run those tests, said Ahluwalia.

In far too many instances, the data being used to test applications is not especially useful. In fact, a recent Perforce survey finds only 34% said synthetic data provides referential integrity and only 36% said it provides data realism. Machine learning algorithms that have been trained specifically to generate synthetic data typically generate synthetic data that can be much more closely aligned with a specific use, said Ahluwalia.

DevOps teams can then more easily decide what mix of synthetic and masked data can be used to create tests that better reflect the actual environments where code will run, he added.

Delphix Synthetic Data is designed to enable both human developers and AI agents to access data via a graphical user interface, application programming interfaces (APIs) or the Model Context Protocol (MCP). DevOps teams can then also load that data into the large language model (LLM) of their choice to generate tests to better control costs, noted Ahluwalia.

It’s not clear at what pace DevOps teams are now applying AI to application testing. However, as it becomes easier to generate those tests, the overall quality of the applications being built and deployed should improve. In the meantime, however, the pace at which code is being generated in the AI era is now in many organizations overwhelming existing workflows for testing applications. More often than software engineers may care to admit, even more code that has not been properly vetted is now as a result running in production environments. As a result, it’s little wonder that the number of issues that DevOps teams are encountering after an application has been deployed in the AI era are, instead of decreasing, actually increasing.

Hopefully, there will soon come a day when the state of the art of AI testing catches up to the rate at which AI tools are being used to generate code. In the meantime, however, DevOps teams are likely to have their hands full until a complete agentic approach to managing the software development lifecycle (SDLC) is adopted.

September 30, 2026
AWS Benchmark Aims to Reduce Number of False Positives Found by AI Vulnerability Scanners

Amazon Web Services (AWS) has developed a benchmark that can be used to test whether a model can distinguish real vulnerabilities from code that looks risky but is actually safe.

The Deception Benchmark was created following an evaluation of the capabilities of 12 models from five different providers. In all, the benchmark includes 14,822 samples of code built using 16 different languages spanning more than 70 Common Weakness Enumeration (CWE) categories. Each sample is run through an adversarial loop to generate code, test it against frontier models, harden, repeat. If a model gets it right easily, the sample is removed.

According to the benchmark, every AI model has the same fundamental issue. While they identify up to 95% of real vulnerabilities, they also flag 41 to 99% of safe code. Proof-of-exploit prompting can cut false positives by 17 to 74 percentage points but misses 7% to 44% of real vulnerabilities. The environment-gated challenges are worse: models flag the code and ignore the Kubernetes Network Policy next to it. No tested configuration keeps both false positives and false negatives below 10%, according to the benchmark.

To provide those assessments, the Deception Benchmark creates two distinct types of challenges for AI models. Code-level challenges present vulnerable and safe variants that differ by a subtle fix. Both look suspicious, but only one is exploitable. Environment-gated challenges go a step further by using that same code to test specific IT environments to determine, for example, if a Kubernetes network policy blocks a server-side request forgery (SSRF) path. That foundation, for example, then makes it possible for CyberGym agents to test on more than 1,500 realistic tasks while another AI agent invokes the CYBENCH framework to evaluate capture the flag (CTF) challenges.

Additionally, the benchmark is designed to treat labeling as a convergent audit loop rather than a one-time step. Every label is re-examined independently by multiple reviewers who do not see one another’s assessments or the original reasoning behind the label. Disagreements escalate to direct adjudication, where the original reasoning is evaluated against the challenge. Unresolved cases are then passed on for human review.

Neha Rungta, director of applied science at AWS, said ultimately the goal is to identify the AI models that generate the fewest number of false positives when used to scan for vulnerabilities. That issue is becoming problematic because as AI models are used to scan for vulnerabilities, many DevSecOps teams are now wasting more time than ever investigating vulnerabilities that turn out to be false alarms.

Preventing those false positives requires AI models that reason not just about the existing code, but also how a remediation might impact the surrounding environment, noted Rungta. The goal is to provide the context needed to enable AI models to better understand what good should actually look like when fixing a vulnerability, she added.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at the Futurum Group, said false positives are verification debt that ultimately undermines confidence in AI findings. AI scanners that read code without the environment around it cannot tell an exploitable path from a blocked one, he added. A model that flags safe code as vulnerable is only making more work for DevSecOps teams, noted Ashley.

Just how much work AI models are creating for DevSecOps teams is unclear, but other reports suggest that the more complex the environment, the less helpful AI becomes. Hopefully, as AI continues to evolve, these tools and platforms will not just be used to discover vulnerabilities but also fix them in a way that requires as little intervention from a DevSecOps team as possible.

September 30, 2026
Keeping Humans Accountable as AI Agents Take On the SDLC

Who is responsible when an AI agent finishes a development task? Ming Wu, head of engineering for Dev AI at Atlassian, puts that responsibility with people. In her interview with Alan Shimel, she separates the ability to automate work from the obligation to understand and control the result. That distinction matters as teams move beyond individual coding prompts and start assigning agents larger portions of the software development lifecycle.

Wu describes governed agent loops as two related capabilities. Governance supplies visibility, guardrails and enforcement; loops allow agents to process batches of jobs under defined conditions instead of waiting for someone to trigger each task. The scope can include taking on an issue, carrying out the work and reviewing a pull request. Automation may handle more steps, but teams still need a way to trace activity and judge whether the output meets their expectations.

Existing work-tracking systems offer a place to organize that activity. Wu explains why Jira is an initial interface for the approach: it already records work across teams and organizational boards. She also describes support for third-party coding agents and a shared context layer intended to give agents a consistent understanding of team priorities, organizational requirements and business intent. Coordinating those inputs is part of the engineering problem, particularly when several agents contribute to the same body of work.

Customers are asking how to scale these workflows and demonstrate real improvements in delivery speed, according to Wu. Some software teams are already experimenting, while organizations in more traditional industries are at different stages of adoption. Her examples put visibility into work alongside automation itself: teams need to see what agents are doing, where people remain accountable and whether the investment is producing useful gains. Completing more automated tasks is only part of that assessment; understanding their contribution to the software lifecycle is the harder question.

September 28, 2026
Headless DevOps Gives AI Agents Access to Delivery Workflows

A delivery platform built around screens and mouse clicks assumes a person is doing the work. That becomes a constraint when developers delegate tasks to coding agents from inside their development environments. Exposing the same capabilities through APIs, command-line tools and agent interfaces changes how work reaches the platform, but it does not remove the need to test changes, enforce security checks or decide which actions still require a human.

Federico Larsen, co-founder and CTO of Copado, joins Alan Shimel to explain that shift through the lens of Salesforce development. Larsen describes three access layers: APIs, CLI commands and packaged agent skills or MCP servers. Developers using tools such as Cursor and Claude Code can delegate work without having to move every step back into a graphical interface. The design accommodates autonomous execution as well as workflows that keep people involved in decisions.

Giving an agent more access also expands what teams must validate. Larsen points to connected applications, IP ranges and agent behavior as areas that need security scrutiny, alongside quality gates earlier in the delivery process. Testing an agent adds another complication: its responses are not necessarily identical from one run to the next. Teams need to assess whether it stays on task and follows corporate language requirements, rather than relying only on a fixed expected answer. He also describes generating regression tests from user-story acceptance criteria.

The distinction between making a platform accessible and making it safe to automate runs through Larsen’s examples. An API can expose an operation, but the surrounding workflow still needs checks on the changes an agent produces. His account connects headless access with testing and compliance, not simply the removal of a user interface. As agents take on more delivery tasks, those controls need to remain part of the path from a developer’s request to an accepted change.

September 28, 2026
Survey: Lack of Confidence in Software Supply Chain Security Runs High

A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (15%) in the ability of their existing tools for managing software artifacts to prevent attacks against their organization’s software supply chain.

Conducted by Cloudsmith, a provider of a platform for managing software artifacts, the survey also finds nearly half of respondents (48%) can identify an intrusion in their software supply chain but need to rely on manual efforts to enforce some type of quarantine or resolve the issue. Only 37% said they can automatically identify, block, and trace an intrusion within minutes.

As a result, nearly two thirds (65%) are either investigating a different approach to compliance (45%) or are evaluating some type of security framework (25%), the survey finds.

Cloudsmith CEO Glenn Weinstein said that as it becomes more apparent in the AI era that changes will be made to how software supply chains will need to be secured, there will be more focus on securing binaries after applications are deployed. Cybercriminals will increasingly target those binaries using cyberattacks that will be launched at machine speed. As such, more resources will need to be allocated to automating DevSecOps workflows within a curated repository that limits the number of potential vulnerabilities that might find their way into a software supply chain, noted Weinstein.

The challenge is that securing binaries is a much more complicated challenge than simply trying to fix issues at the source code level, he added.

Overall, the top three concerns are attacks exploiting AI-generated code to introduce malicious dependencies, followed by supply chain attacks blending into normal DevOps activities and automated systems modifying software at scale.

More challenging still, only 27% said they are very confident their organization could pass an unexpected audit of their software supply chain. On the plus side, however, 61% are at least moderately confident that AI coding tools are not introducing additional vulnerabilities into their software supply chains. However, only 32% said they are scanning the AI models they employ for specialized threats, compared to 41% that are scanning for basic integrity to, for example, verify checksums/provenance. Another 22% are relying on general security tools such as runtime monitoring. Half of respondents (50%) are relying on provenance or attestation data to validate software builds.

Additionally, a full 95% said they generate software bill of materials (SBOM) data but only 25% integrate and automate SBOM verification into security gatekeeping. Instead, three quarters (75%) said they use that data for ad hoc compliance only.

Finally, nearly half (49%) of respondents said their organizations will occasionally skip implementing a new security/developer feature, compared to 28% that admitted they do so regularly.

Ultimately, it’s not clear which teams have responsibility for securing software supply chains. More than three quarters of respondents said security is the function most concerned with dependency-led attacks. However, when asked where the decision to trust an open-source dependency should sit, nearly two in five (39%) put it with a centralized security, platform, or governance team. Another 37% said it is a shared responsibility with developers.

Regardless of who is ultimately held accountable for securing the software supply chain, the one thing that is certain is more cybercriminals than ever are discovering just how soft the underbelly of organizations that build and deploy software really is.

September 28, 2026
DHH Declares End of Hand-Writing Code at Rails World 2026

Controversial developer David Heinemeier Hansson (aka DHH) announced last week at Rails World 2026 that the end of handwritten code is upon us, calling it the modern era’s “Brownie” moment.

The moment to which he referred was when Kodak released its Brownie camera that forever changed the trajectory of photography. In this case, the Brownie of our era is AI.

During the event, DHH announced that his company, 37signals, decided it would no longer write code by hand and, instead, would use AI agents as its default code generation tool; humans were to only intervene when the auto-generated code needed to be fixed. To back up that migration, DHH proclaimed that he’d written half as much code over the past twenty months as he had in the previous twenty-one months.

One justification for this change, DHH addressed in a REWORK Podcast episode, when he spoke about how AI doesn’t suffer the same “attachment” to code as humans. To that, DHH said, “We are no longer attached to this piece of code that has been produced by prompts because I mean, we didn’t write it. There’s not a human on the other side. If you tell the AI to, well, you don’t tell the AI; you just start a new session and boom, amnesia. They’ve completely forgotten that they spent a lot of expensive tokens producing this stuff, and they’re not offended.”

During the Rails World 2026 keynote, DHH stated that at 37signals, “Writing code by hand is now an exceptional state.” He also did an informal poll of the audience, asking how many developers were still writing material amounts of code by hand. Only five people raised their hands.

Clearly, DHH is on to something.

During his keynote, he also brought up the lesson learned with Basecamp 5, when an early attempt at allowing designers to vibe-code a particular set of features left the architecture looking like “Swiss cheese.” The assumption was that the AI technology wasn’t ready for the task, so 37signals went back to manual coding. This experience led DHH to realize that there is only one serious question to ask: “How do you get the most out of this intelligence exposure?”

Now, 37signals is working on a new version of the email client, Hey, with the goal of it no longer being a web app. Prior to AI, creating web apps with small teams and the proper tooling, DHH claims, was the only way to be productive. He then went on to show a demo video of the new native Hey app looking very much as if it was production-ready, after only a few weeks of work.

This new version of Hey was vibe-coded, and the results (in his own words) were “electrifying.”

To DHH, using AI for coding is the future, and web apps would soon shift to native apps because of the efficiency of AI.

He also took a moment to display the first iteration of the Windows app that was vibe-coded, which was less than viable. After that moment, the audience got a peek at the next iteration of the app, which was created, with a few tweaks to the prompt, twenty minutes later. The results were astonishing.

To punctuate his point, DHH proclaimed, “This is coming. Get ready.”

The reactions to DHH’s keynote ranged from excitement about increased productivity to grief over the last craft of manual coding.

September 28, 2026
Blitzy Makes Sandbox for Reverse Engineering Code Available at No Cost

Blitzy has made available a sandbox where DevOps teams can reverse-engineer up to one million lines of code, generate up to 25,000 lines of tested end-to-end code, and identify security vulnerabilities across a codebase at no cost.

Dan Ochs, director of AI solutions consulting for Blitzy, said the provider’s Proactive Insights platform uses multiple artificial intelligence (AI) models from Anthropic, OpenAI and Google, AI agents and a knowledge graph to discover vulnerabilities in code, determine how reachable they actually are, assess whether they are fixable and, if so, generate the code needed to remediate them.

Blitzy provides that capability by building a knowledge graph that spans architecture, dependencies, business logic, and data flows, mapped back to the actual code. That graph is queryable and continuously evolves as a codebase changes. Known and previously undiscovered vulnerabilities get traced through their execution paths, checked against dependencies, and validated for remediation.

Thousands of AI agents are then used to build, validate and test code in parallel, with the output surfaced as a set of pull requests prioritized by risk level that human software engineers can review and approve.

Additionally, DevOps teams can use Proactive Insights to reverse-engineer an undocumented legacy application, add a new feature to an existing system, upgrade a service to a modern framework or build an entirely new application, noted Ochs. Blitzy also ensures that no code is ever used to train an AI model and that all data is encrypted in transit and at rest to ensure compliance mandates are met.

Blitzy is now making a sandbox environment available at no cost in the hopes of exposing that capability to more DevSecOps teams at a time when many of them are now hunting for vulnerabilities in their codebase that might be discovered first by cybercriminals using any number of AI platforms. In effect, DevSecOps teams are now locked in a race against time that requires AI tools to discover and remediate what could be thousands of vulnerabilities before they are exploited. The only way to meet that challenge will be to rely more on an AI platform capable of understanding how a codebase was constructed at scale, said Ochs.

While most DevOps teams are using AI to generate code, it’s clear AI will soon need to be embedded into the DevSecOps workflows used to discover, validate and remediate vulnerabilities. The challenge is that whatever AI platform is used to provide those capabilities will need to understand the underlying codebase. In the absence of that context, much of the code generated isn’t likely to actually run as intended in a production environment.

At this point it’s apparent that software engineers are evolving into managers of AI agents that are assigned specific tasks to autonomously complete. Each DevOps team will make that transition at their own pace, but in the face of what is becoming a tsunami of vulnerabilities that are likely to be discovered in the weeks and months ahead, there may actually be no better time than the present to get started.

September 25, 2026