devopsy.kinsta.cloud

Tag: ai

Making the Case for AI in Testing, Security and Delivery—Not Just Coding

Harness CEO and co-founder Jyoti Bansal unpacks a core challenge facing modern software teams: while AI is dramatically increasing the amount of code being written, it is also putting unprecedented pressure on everything that happens after code is committed.

Bansal argues that much of the industry’s AI focus has centered on the developer inner loop—AI-assisted coding on laptops—while overlooking the outer loop, where most of the real work lives. Testing, security scanning, deployment verification, compliance checks, release orchestration, and cost management consume the majority of engineering effort in large organizations. As AI accelerates code generation, those downstream processes become bottlenecks unless they are equally automated and modernized.

This is where Bansal frames Harness’ vision of “AI for everything after code.” Rather than relying on generic copilots, he describes an approach built around purpose-designed AI agents that handle specific DevOps, testing, security, and FinOps tasks. These agents operate with deep contextual awareness, drawing from a software delivery lifecycle knowledge graph that reflects an organization’s infrastructure, policies, pipelines, and operational constraints.

Crucially, Bansal emphasizes that AI should not replace human judgment in production environments. Instead, AI is used to generate deterministic, auditable orchestration—pipelines, tests, rollout strategies, and safeguards—that humans can review, approve, and govern. This human-in-the-loop model is especially important for large and regulated enterprises, where reliability, security, and blast-radius control matter as much as speed.

They also explore how rising code volumes—especially from AI-generated code—can actually reduce delivery throughput and quality if the outer loop is neglected. Without strong automation, observability, and guardrails, more code simply means more vulnerabilities, more failures, and more rework.

The message is clear: AI’s real impact on DevOps will be determined not by how fast teams write code, but by how intelligently they automate, secure, and govern everything that comes next.

December 18, 2025
Analysis Surfaces Rising Wave of Software Defects Traced to AI Coding Tools

An analysis of 470 real-world open source pull requests published today finds code generated using artificial intelligence (AI) tools introduces significantly more defects across every major category of software quality, including logic, maintainability, security, and performance, compared to human-authored code.

Conducted by CodeRabbit, a provider of a platform that employs AI to review code, the report finds that pull requests generated using AI contain ~1.7x more issues on average than ones created by a human.

Additionally, logic and correctness issues rise 75%, including business logic errors, misconfigurations, and unsafe control flow, while security vulnerabilities increase 1.5–2x, according to the report.

Finally, code readability problems such as elevated naming and formatting inconsistencies increase by a factor of more than 3x, while performance inefficiencies, such as excessive I/O, appear nearly 8x more often in AI-generated code.

David Loker, director of AI for CodeRabbit, said the report makes it clear that while AI makes developers more productive the amount of technical debt currently being generated by these tools is unsustainable. Short of abandoning these tools, the only way to address the fundamental challenge is to rely more on AI to review the code being generated, he added.

For example, organizations need to implement tests for non-trivial control flow, mandate nullability/type assertions, standardize exception-handling rules, and enforce effective guardrails. Code reviewers should also explicitly ask if error paths are covered, if concurrency primitives are correct, if configuration values are validated, and if passwords are handled via the approved helper, all of which are areas where AI coding tools tend not to address.

DevOps teams should make sure that application developers are exposing prompt snippets, repo-specific instruction capsules, and configuration schemas that expose business rules, configuration patterns, or architectural constraints that the AI tool needs to observe. Continuous integration (CI) tools that enforce formatters, linters, and style guides can also eliminate entire categories of AI-driven issues.

DevOps teams should also further centralize credential handling, block ad-hoc password usage, and automatically run static application security testing (SAST).

It’s not clear how many organizations are revisiting DevOps workflows in the wake of adopting AI coding tools, but it’s apparent the amount of technical debt that needs to be addressed is rising as the pace at which code is being developed only continues to accelerate. DevOps teams need to pay particular attention to the readability and maintainability of their code bases to ensure the highest quality applications possible are being deployed in production environments, noted Loker. That goal, however, can only be achieved by ensuring best DevOps practices are followed, a goal that might soon be easier to achieve as AI is used to verify the quality of code being generated, he added.

Hopefully, the quality of the code generated by AI coding tools will improve. In the meantime, however, DevOps teams might need to prepare for the worst as the number of issues that engineers will need to address after code has been checked in starts to exponentially increase.

December 17, 2025
Rethinking Software Architecture for the Next Generation of User Interfaces

The next wave of user interfaces demands a complete rethinking of software architecture. For decades, digital products have relied on menus, checkboxes, search bars, and forms. These elements worked, but they were never designed around how people naturally think, speak, or interact. In 2025, clinging to them feels like printing paper maps for directions or expecting voicemail to be anyone’s preferred mode of communication.

It’s time to design systems that adapt to human communication instead of forcing humans to adapt to rigid systems.

Search and interaction are shifting from keyword-driven models to intent-driven experiences. Large language models and advanced embedding techniques now allow systems to interpret nuanced human requests. For example, a user might say, “Show me running shoes that look professional enough for the office,” and the system can return accurate results because the technology now allows it to understand intent, not just literal keywords.

Conversational AI platforms like ChatGPT, Anthropic’s Claude, and Perplexity show how people increasingly bypass traditional menus in favor of direct interaction. In commerce, conversational agents embedded in e-commerce flows let customers describe what they want, compare options instantly, and finalize purchases, reducing friction and increasing conversions. In healthcare, triage assistants and virtual nurses handle initial patient queries through natural language, freeing up human staff while accelerating care. Online evidence shows that conversations are rapidly becoming the default entry point to digital services.

Multimodality as the New Standard

The future extends beyond conversation alone. Systems must now support multimodal interactions including voice, text, images, video, and gestures within the same session. Architectures must be able to capture and synchronize these streams, offering flexible early, mid, or late fusion strategies depending on user needs.

The most advanced models, such as OpenAI’s GPT-4o and Google’s Gemini, already allow a user to hold a conversation that combines speech, uploaded images, and typed refinements all seamlessly fused. In enterprise use cases, product designers can sketch prototypes, describe them verbally, and iterate through text refinements in real-time. In education, multimodal tutors can analyze a student’s handwritten notes, explain them verbally, and provide adaptive follow-up exercises. These scenarios highlight why multimodal orchestration is no longer a feature; it’s the baseline expectation.

Delivering these experiences requires rethinking architecture at its core. APIs can no longer be simple endpoints for text; they must accept multimodal events enriched with metadata, timestamps, and contextual signals. Backends need orchestration layers capable of managing diverse pipelines and maintaining continuity across modalities and time. The W3C Multimodal Architecture provides a useful blueprint, but implementing such systems at scale requires new engineering practices.

Performance is critical. Real-time multimodal AI workloads must respond within sub-second latency to maintain immersion. Hybrid retrieval pipelines (sparse-first, dense-refined), GPU-accelerated inference, high-throughput message brokers like Kafka, and orchestration frameworks such as Temporal or AWS Step Functions are becoming core building blocks. Without this infrastructure, even the smartest models will feel clunky and unusable.

Designing for Trust and Accessibility

Technology succeeds only if people trust it. Users must know their input has been processed, whether through responsive animations, acknowledgment cues, or clarifying follow-up questions. Progressive disclosure is critical; interfaces should surface only what’s needed, when it’s needed. Accessibility must be baked in from the start: voice agents should include captions, gesture interfaces must offer keyboard alternatives, and input methods must remain redundant so no user is excluded. The system should adapt to the person, not the other way around.

The shift from clicks to cues, from forms to conversations, and from single-modality to multimodal systems isn’t just a UI evolution, it’s a foundational transformation in software architecture. Companies that embrace modular backends, scalable AI pipelines, multimodal orchestration, and inclusive design will lead the next era of computing. Inline industry research confirms that they will set the standard for intuitive, human-centered technology and secure lasting advantages in trust, loyalty, and market leadership.

December 10, 2025
Black Duck Adds AI Tool to Analyze and Fix Code in Real Time

Black Duck today added a tool for analyzing and remediating code that is directly integrated into artificial intelligence (AI) coding tools.

Company CEO Jason Schmitt said Black Duck Signal makes it possible to discover issues as application developers increasingly rely on AI coding tools to generate more code faster, which paradoxically also typically contains more vulnerabilities than code created solely by humans.

Black Duck Signal makes use of multiple large language models (LLMs), model context protocol (MCP) servers and AI agents to autonomously detect and remediate vulnerabilities in real time, both as applications are being developed and after they have been deployed, noted Schmitt.

Enabled by the Black Duck KnowledgeBase, those capabilities make it possible to automatically find, prioritize, and fix vulnerabilities across source code, binaries, supply chain components, and running applications regardless of what programming language was used, with a high degree of accuracy, he added.

Black Duck has petabytes of data on examples of known good code that it is exposing to AI agents using different LLMs depending on the use case and the type of programming language used, noted Schmitt.

In fact, Black Duck Signal substantially reduces the number of false-positives generated by existing static analysis testing tools, he added.

Once discovered, it then becomes possible to invoke an AI agent to automate remediation across the software development lifecycle (SDLC) using verified code fixes found in a Black Duck library. That capability is critical because it also helps ensure that the code generated by one LLM is verified using a different LLM to eliminate bias, noted Schmitt.

Additionally, Black Duck Signal will surface open source and third-party risk issues stemming from, for example, licensing agreements and policies.

Currently being made available to existing Black Duck customers and design partners, the company plans to make Black Duck Signal more broadly available in early 2026.

While AI coding tools have been widely adopted to improve productivity of application developers, it’s not clear to what degree organizations trust the code that is being generated. Most of these tools have been trained using examples of code gleaned from across the Web that is often flawed. AI tools based on LLMs rarely generate code the same way so each time they are invoked it creates another possible instance where a vulnerability might be inadvertently injected into the code generated.

As more code is generated using these AI tools, more organizations are becoming aware of a growing acute need to automate best DevSecOps processes to keep pace. Otherwise, the volume of code that might later need to be scanned for vulnerabilities will simply overwhelm application security teams.

It’s not clear to what degree organizations are revisiting DevSecOps workflows in the age of AI, but it’s now more a question of when and to what degree, rather than if. Organizations are not likely to abandon AI coding tools because of security concerns but they will inevitably put more guardrails in place as appreciation for the downside of relying on AI tools to generate code becomes more apparent.

In the meantime, however, the pressure on already undermanned DevSecOps teams in the short term at least is only going to continue to increase.

December 10, 2025
How Low-Code Is Reshaping DevOps Automation and Governance

Jon Scolamiero breaks down how low-code platforms are becoming an increasingly important part of the modern DevOps ecosystem. As organizations grapple with rapid shifts brought on by AI, vibe-coding practices, and an explosion of tooling, Scolamiero argues that low-code isn’t a shortcut—it’s a way to bring structure, automation, and transparency back into software delivery.

He explains that the core mechanics of DevOps don’t disappear in a low-code environment. Pipelines still need to deploy reliably, infrastructure still needs to be provisioned, and applications still need to be secured and monitored. What changes is how teams interact with those systems. Low-code abstracts much of the repetitive orchestration work so teams can focus on governance, quality, and outcomes instead of plumbing. For organizations struggling with shadow AI, fragmented workflows, or inconsistent platform engineering practices, this abstraction can be the difference between chaos and clarity.

Scolamiero also touches on the growing divide between U.S. and EU compliance expectations. While the EU pushes ahead with strong regulatory frameworks—including around AI transparency—the U.S. market often lags in political will but compensates with heavier requirements in highly regulated industries like federal, defense, and finance. That gap puts new pressure on DevOps teams to understand not just how software is built, but how every dependency enters the environment. Software supply chain security, Scolamiero notes, is no longer a niche concern—it’s a foundational requirement.

Looking ahead, he warns that AI-driven development may soon trigger a high-profile security incident unless organizations adopt responsible governance practices. For DevOps teams, the message is clear: abstraction and automation are powerful, but only if paired with visibility, policy, and a strong understanding of the end-to-end delivery chain.

December 8, 2025
Harness Allies with AWS to Integrate AI Agents for Software Engineering

Harness this week extended its alliance with Amazon Web Services (AWS) to integrate their respective artificial intelligence (AI) agents to automate DevOps workflows.

Announced at the AWS re:Invent 2025 conference, Harness is now integrating the Model Context Protocol (MCP) server it added to its continuous integration/continuous delivery (CI/CD) platform with the Kiro AI coding tool developed by AWS.

At the same time, Harness is now making its entire DevOps platform available on the AWS cloud.

Bala Venkatrao, senior vice president and general manager for platform at Harness, said that integration will make it possible for the AI agents that are being embedded into Kiro to invoke AI agents that Harness has developed to automate workflows using a Harness Software Delivery Knowledge Graph that helps ensure more accurate outputs are generated.

That approach will enable developers to invoke, for example, security scans as they code, with DevOps teams then relying on Harness to automate workflows after code is checked in.

Longer term, Harness expects to develop similar relationships with other providers of AI coding tools, noted Venkatrao. The Harness CI/CD platform will, in time, become the vehicle for integrating and observing DevOps workflows spanning multiple cloud computing environments, he added.

In the meantime, the deeper ties with AWS align with a broader effort to automate DevOps workflows using AI agents. The cloud service provider is previewing an AWS Security Agent to review and test code and an AWS DevOps Agent that will always be on call to help manage IT incidents.

Mitch Ashley, vice president and practice lead for software lifecycle engineering for The Futurum Group, said the Harness integration with AWS demonstrates how AI-generated code and delivery systems can operate as one workflow. Kiro gains direct access to the delivery context, and Harness brings the intelligence needed to validate, secure, and move that code through pipelines without slowing teams down. Developers stay inside their environment while agents see the full picture of build health, policy checks, and production readiness, he added.

As a result, Harness is positioning delivery as an adaptive system that learns from every build and release, and AWS provides the platform where that automation can run at scale. As this approach takes hold, AI software development will shift from being a set of disconnected stages to a continuous operational loop that improves with each change, noted Ashley.

Neha Goswami, director of engineering for Amazon Q Developer at AWS, said the overall goal is to reduce the level of friction software engineering teams currently experience between when code is checked in and when an application is deployed in a production environment. AWS does not have any ambitions toward building its own CI/CD platform or code repository, but there is an opportunity to leverage AI agents to streamline DevOps workflows.

In fact, as more code is generated using AI coding tools it will soon become apparent that every organization that builds software will need a CI/CD platform to manage those workflows, noted Goswami.

It’s still too early to say how best DevOps practices will evolve in the age of AI but the one thing that is certain is AI agents will make it simpler for application developers to invoke a range of backend services that should improve the quality of the code being created before it finds its way into a build.

December 4, 2025
Stack Overflow Makes Available AI Assistant for Verifying Code

Stack Overflow today made generally available an artificial intelligence (AI) tool that makes it possible to use natural language to search its repositories for code.

Company CTO and chief product officer Jody Bailey said AI Assist provides developers with a conversational search and discovery tool that enables them to more easily find relevant online content stored on the Stack Overflow and Stack Exchange sites.

After a summary is generated based on Stack Overflow’s ranking system, an AI agent embedded within AI Assist will also re-rank any answer provided for correctness and comprehensiveness to ensure verified code is surfaced with clear attributions, added Bailey.

Finally, if the search itself fails to yield any relevant community content, the AI agent is then instructed to answer the question using examples of code it finds outside of the Stack Overflow sites by invoking third-party large language models (LLMs). That hybrid approach, while prioritizing Stack Overflow content, ensures that a relevant answer to a question is always provided, said Bailey.

Many developers are, of course, relying on AI tools from OpenAI, Microsoft, Google and Anthropic to discover code they can reuse. The AI Assist tool created by Stack Overflow provides an alternative that generates more reliable content, including its original source, that makes use of the Stack Overflow ranking system to minimize any chance a hallucination will surface a snippet of code that actually doesn’t work or is deeply flawed, noted Bailey.

Going forward, Stack Overflow plans to integrate AI Assist via a Model Context Protocol (MCP) server with other Stack Overflow features and offerings, including its chat function and coding challenges, before adding extensions to integrated development environments (IDEs) and Discord servers. Longer term, AI Assist will also enable Stack Overflow to add additional education programs for developers, noted Bailey.

Since making AI Assist available in beta, Stack Overflow claims more than a quarter million IT professionals have already employed it.

It’s not clear how many developers are relying on AI to find and generate code, but as usage increases DevOps teams are starting to encounter more code that for one reason or another needs to be rejected. In some cases, it’s because a known vulnerability is discovered but just as often DevOps engineers are realizing that the overly verbose code generated by AI tools increases the amount of infrastructure required to run it. Over time, the code created by the AI tool will eventually significantly increase the total cost of IT.

The AI Assist tool developed by Stack Overflow helps minimize those issues by providing developers with examples of code that have already been vetted by their peers, noted Bailey.

There is little doubt that AI tools are making application developers more productive than ever. However, without the appropriate safeguards it’s also apparent that AI coding tools quickly become too much of a good thing. The challenge and the opportunity now is to find ways to apply much-needed guardrails to AI coding as early as possible in the software development lifecycle (SDLC).

December 2, 2025
Why Junior Developers Remain Essential in the Age of AI

Raj Sethi, senior vice president and go-to-market leader for software development lifecycle (SDLC) at GlobalLogic, pushes back on the narrative that generative AI will eliminate the need for junior developers. He argues that while AI can generate boilerplate code, tests and scaffolding, modern software delivery still depends on human judgment, critical thinking and a deep understanding of how systems are designed, built and evolved over time.

Sethi notes that recent layoffs and hiring slowdowns are less about AI replacing humans and more about organizations recalibrating after over-hiring and then scrambling to understand how AI actually fits into their productivity models. Despite headlines about “60–70% of code written by GenAI,” he points out that teams still need people to design prompts, review what AI produces, validate correctness, and reason about architecture, algorithms and performance. If organizations skip that layer of human oversight—especially at the junior level—they risk creating an unsustainable wave of technical debt.

He also challenges how junior talent is being prepared and evaluated. In an era where learning resources, courses and tools are democratized, Sethi urges aspiring developers to treat education as continuous, not transactional. Degrees alone aren’t enough; portfolios, open source contributions and visible problem-solving matter more than ever. He encourages students to focus on fundamentals—math, algorithms, linguistics, systems thinking—and to use AI as a collaborator rather than a crutch.

For DevOps and software delivery teams, the future isn’t about replacing junior engineers with AI, but about elevating their role. Junior developers will spend less time on repetitive plumbing and more time reviewing AI-generated output, refining specs, improving quality and learning how to orchestrate systems. In that world, the organizations that invest in growing their next generation of engineers—not just in buying tools—will be the ones that actually benefit from AI at scale.

December 1, 2025
How to Escape the Talent Valley

Across the tech industry a disconcerting trend is emerging , job losses at the hand of a seemingly more efficient and cost-effective employee, artificial intelligence (AI). Software developers in particular have felt the full force of automation’s iron fist, with layoffs widespread.

Since May, Microsoft alone has let go of approximately 15,000 employees, with software engineers bearing the brunt of these cuts. This has taken place in tandem with the company’s $100 billion investment in AI technologies.

Junior developers are particularly vulnerable and their role is increasingly being outsourced or supplemented by AI. Whilst AI’s potential to transform software development cannot be ignored, the short-term benefits come with long-term consequences.

Chief among this is the risk of creating a “talent valley.” A future where the talent pool of skilled developers runs dry due to a lack of real-world experience, leaving companies searching for senior engineers to be met with a barren landscape.

The Hidden Cost of Efficiency

Developers are not just responsible for writing code, they are also the stewards of application security. Every day, they make decisions that shape the integrity and safety of the software we rely on. Yet in many organizations, this critical responsibility remains overlooked. AI may have transformed how code is written, but it hasn’t changed the fact that developers are ultimately accountable for the security and reliability of what they build.

Despite this, many developers, especially those early in their careers, lack the training and support needed to accurately assess the risks introduced by AI-generated code, leaving software and users at risk.

A Looming Crisis

As companies increasingly automate routine tasks, junior developers lose the opportunity to build critical skills. Great engineers aren’t born writing perfect code – they’re forged through the messy, trial and error process of solving real problems. When AI eliminates these learning opportunities, it can hinder the evolution of developers into senior engineers capable of coding complex systems and understanding nuanced flaws.

The industry risks creating a generation of developers who never progress into senior roles. This is the essence of the “talent valley”, a future where in streamlining the present, we undermine the technical resilience of the future and organizations find themselves without the expertise needed to secure increasingly sophisticated systems.

AI: A Double-Edged Sword

Some of the risk lies in AI itself. Large language models (LLMs) can be manipulated, misled, or exploited through adversarial prompts. Last week, a hacker slipped data-wiping code into Amazon’s Developer Extension for Visual Studio Code, a free generative AI extension with nearly one million installs. The very tool designed to aid developers in coding and debugging was the one introducing risk.

But just as often, the problem lies in how teams adopt these tools. Longstanding practices like threat modeling are skipped and LLMs are treated as neutral helpers rather than complex systems that require scrutiny and understanding.

This leads to a growing disconnect between development and security posture. Code may be produced faster than ever, but without proper oversight, it can be riddled with vulnerabilities.

Building a Smarter Future

Organizations must rethink how they nurture talent. Findings from Stack Overflow’s annual Developer Survey highlight that despite 84% of software developers using AI, nearly half admit to not trusting the technology due to concerns over accuracy. This underscores a crucial point: human expertise remains irreplaceable and must continue to be a top priority.

The solution is not to reject AI, but to support developers in using it wisely. This means treating LLMs as untrusted components within threat models, implementing rigorous testing and documentation for AI-generated code, and embedding AI-specific risks into development training programs. With developers shouldering so much of the security burden, equipping them with the knowledge to manage it is essential for navigating the next wave of AI adoption.

Navigating the Valley

The talent valley is approaching, but not inevitable. To escape it, leaders must take proactive steps to preserve and cultivate human expertise. AI can be a powerful ally, but only if it is integrated thoughtfully and responsibly. It is critical that there is investment into developer education, hands-on experience is fostered, and security is embedded into every stage of the development lifecycle.

The road ahead may be steep, but with the right approach, the talent valley can be bridged and a future where AI and human talent thrive together built.

November 25, 2025
Humans in the Loop: Governing AI Agents Across the SDLC

AI agents are moving from novelty to necessity in software delivery—and with that shift, the developer’s role is changing. Emilio Salvador, vice president of strategy and developer relations for GitLab, explores what happens when every engineer works alongside a small “team” of agents: some personal, some shared across squads, and others assigned to specific lifecycle tasks. The takeaway: DevOps will look less like a linear pipeline and more like an orchestrated system where humans set intent and policy while agents execute, verify and report.

Salvador lays out a practical model for “AI guardians”—specialist agents that continuously check security, quality and compliance as code and configs move through the system. Above them sits a layer of “meta-agents” that coordinate work, escalate issues and interact just like team members (email/Slack/tickets), while keeping humans firmly in the loop for approvals and accountability. No one’s shipping enterprise software on autopilot.

Salvador also gets real about today’s bottlenecks. Most teams fixate on AI for code generation, but the real drag lives elsewhere: brittle CI/CD, slow security checks, noisy incidents and manual release chores. The guidance is to instrument AI across the entire SDLC—pipeline optimization, policy enforcement, test generation, SCA/secret scanning, rollback logic—not just at the editor prompt. Otherwise, you’ll write code faster only to hit the same wall faster.

On governance, the risk isn’t just “shadow AI” tools; it’s fragmented models and agent sprawl. What’s needed is a single source of truth for software assets and activity, plus clear policies for which agents can do what, where, and with which data. Expect multi-model strategies, layered verification (agents auditing agents) and stronger observability for both pipelines and AI behavior.

Finally, we touch modernization: AI will help refactor legacy apps and accelerate adaptation cycles. The horizon isn’t “more software,” it’s faster evolution—with DevOps teams measured by how intelligently they balance speed, safety and scale.

November 24, 2025