devopsy.kinsta.cloud

Tag: sdlc

Securing the AI Era: How Development, Security, and Compliance Must Evolve
The Code Boom and Its Paradox

We are witnessing an unprecedented shift in how software is built. With the rise of AI copilots, automated agents, and low-code platforms, code is being produced faster than at any point in history. What once took weeks can now be generated in minutes.

This is a remarkable advance, but it comes with a paradox. The explosion of code does not guarantee that software is more secure. In fact, the opposite is often true. More code increases the attack surface. AI introduces unpredictability and novel risks. Traditional approaches to securing the software development life cycle (SDLC) cannot keep up.

The core question for engineering and security leaders is no longer just how to build software quickly, but how to ensure that the speed of development is matched with the strength of security.

Maker and Checker: A Model That Must Evolve

Historically, software relied on a clear separation of roles. The developer was the maker, building features and writing code. The security analyst was the checker, reviewing work and catching mistakes before deployment.

This principle of dual control worked in a world of deliberate, slower releases. But in an AI-accelerated SDLC, it breaks down. The checker cannot keep pace with the volume of AI-generated code. Manual approvals and reviews become bottlenecks. Teams are forced to choose between velocity and safety.

The answer is not to abandon the maker and checker model. It must be rewired. Instead of gates that block progress, security becomes a set of guardrails. Developers are empowered with real-time feedback, while security engineers build the systems that enforce policy at scale.

The Developer’s New Role

Developers are no longer just authors of code. They are curators, reviewers, and defenders. Their responsibilities have expanded in three ways:
1. Curators of AI Output: Evaluating and integrating machine-generated suggestions, rejecting those that are insecure or opaque.
2. First Line of Defense: Operating with guardrails embedded within Integrated Developer Environments (IDEs) that flag unsafe code immediately.
3. Security-Aware Makers: Building features with an understanding that functionality and safety are inseparable.
The developer’s role is not to become a full-time security engineer, but to be empowered with guardrails and secure defaults that make the secure path the easy path.

The Evolution of Security Roles

The roles of security analysts and engineers must evolve as well. Analysts can no longer simply triage alerts and file tickets. Engineers cannot spend their time patching vulnerabilities one by one.

The future role is the Security Automator. Analysts become risk-ops engineers who tune signals and build dashboards that highlight the most important issues. Engineers become platform builders who embed policy-as-code and guardrails into the SDLC. Together, they design systems that intercept risks, automate remediation, and scale security across hundreds of developers.

Security is no longer about catching flaws at the end. It is about building systems that prevent flaws from being introduced in the first place.

The SDLC Becomes a Continuous Risk Loop

The linear SDLC is dead. The traditional flow of design, build, test, release, and operate no longer fits the reality of AI-driven development. Code is written and deployed continuously. Risks emerge at any point in the cycle.

The modern SDLC must be reimagined as a continuous risk loop.
1. Build: Code is produced by humans and AI.
2. Intercept: Guardrails catch issues in real time.
3. Triage: Risks are prioritized based on context and exploitability.
4. Remediate: Fixes are suggested or applied automatically.
5. Govern: Security and compliance teams ensure that these processes are aligned with organizational standards.
This loop is not theoretical. It must run continuously with every commit and every deployment.

Product Security 2.0: From Policies to Platforms

Product security has traditionally lived in documents and checklists. Policies are written, reviews are scheduled, and compliance evidence is gathered manually.

That approach cannot handle the speed of AI-driven software. Product security must shift from policies to platforms.
- Policies must become code that runs in pipelines.
- Guidelines must be replaced by guardrails that operate in IDEs and CI/CD.
- Evidence must come from dashboards that pull data directly from automated controls.
Product security becomes an engineering discipline. Its output is not documents, but systems that enforce security continuously and automatically.

Compliance That Improves Security

Compliance has long been viewed as a checkbox exercise. Audits are passed, but attackers do not care about certificates. Compliance alone does not prevent attacks.

Recent frameworks are changing that dynamic.
- PCI DSS 4.0 now requires organizations to manage all vulnerabilities, not just those rated critical.
- NIST SSDF emphasizes embedding secure practices throughout the SDLC.
- NIST CSF 2.0 added Govern as a new core function, making governance and accountability central to security.
These frameworks push organizations toward continuous, risk-driven security practices. Done correctly, compliance can become a forcing function for real security.

Metrics That Matter in the AI Era

Speed without safety is a false victory. Traditional metrics such as deployment frequency and mean time to recovery (MTTR) are not enough. Organizations must measure how well they manage risk at AI speed.

Key categories of metrics include:
- Detection: Mean time to intercept unsafe code, percentage of vulnerabilities caught pre-commit.
- Remediation: Mean time to remediate vulnerabilities, percentage of issues auto-remediated.
- Coverage: Percentage of repos and services protected by guardrails, policy drift between declared and enforced rules.
- Risk Reduction: Reduction in exploitable vulnerabilities, time to safe after each release.
The most effective organizations blend DORA metrics with these security metrics. This provides a holistic view of both velocity and safety.

A Call to Action

The AI era has redefined software. It has also redefined security. Developers are curators and first defenders. Security analysts and engineers are system builders and automators. The SDLC is a continuous risk loop. Product security has shifted from policies to platforms. Compliance frameworks are pushing organizations toward continuous, risk-driven practices.

The organizations that will thrive are those that measure not just how fast they can ship, but how safely they can ship.

The challenge is clear, and so is the opportunity. By embracing continuous guardrails, automation, and governance, we can ensure that software in the AI era is not only faster, but also stronger and more secure.
October 28, 2025
The New Metrics of DevOps: Speed, Trust and Transparency

At swampUP 2025, Alan sits down with Aman Sardana and Vijay Kumar Soni to talk through one of the defining challenges of modern software delivery—how DevOps practices must evolve to accommodate the growing influence of artificial intelligence across the software development lifecycle. They explore the intersection of automation, security and scalability as organizations rethink their pipelines to handle AI-driven workloads and agentic development patterns.

The rapid integration of AI into coding, testing, and deployment workflows has significantly accelerated release velocity, but it has also increased complexity. Traditional CI/CD models are now being stress-tested by AI-generated code, model deployment requirements, and the need for continuous governance. The emerging consensus is that future-ready DevOps teams must combine automation with observability, policy enforcement, and risk management — effectively treating AI systems as first-class citizens within the software pipeline.

They also address the growing need for explainability and traceability as AI systems become embedded into infrastructure management and application delivery. Teams can no longer rely solely on deterministic systems; instead, they must design feedback loops that account for dynamic, probabilistic outcomes generated by AI. This requires enhanced collaboration between platform engineers, data scientists, and security teams to ensure consistency and reliability.

Ultimately, there’s a new reality for DevOps: speed alone is no longer the primary benchmark of success. In the AI era, the goal is responsible acceleration — maintaining trust, transparency, and control even as automation and AI agents transform how code, infrastructure, and models move from design to production. The next generation of DevOps will be defined not only by how fast organizations can deliver, but by how intelligently and securely they do it.

October 23, 2025
Survey Surfaces Downstream DevOps Challenges Created by AI Code

A survey of 900 engineers, platform leaders and technical managers published today finds nearly two thirds (63%) report their organization is shipping code faster since adopting artificial intelligence (AI).

Conducted by Coleman Parkes on behalf of Harness, a provider of a DevOps platform, the survey also suggests, however, that same code is creating more downstream DevOps issues, with 72% of respondents noting their organization has already suffered at least one production incident caused by AI-generated code.

In total, 45% of respondents said that deployments involving AI-generated code have been problematic. More challenging still, only 6% of respondents said their continuous delivery process is fully automated. A full 83% say AI must extend across the entire software delivery lifecycle to unlock its full potential.

Additionally, 63% said vibe coding using AI agents is “a disaster waiting to happen” in the sense that DevOps engineers will be overwhelmed by downstream rework, including reviewing code that may often be fundamentally flawed because it was created using a general-purpose large language model (LLM). Nearly three quarters (73%) are concerned unmanaged AI assistants could significantly widen the blast radius of failed releases.

Nearly half (48%) of respondents also expect AI to increase software vulnerabilities and only 41% are confident their existing governance tools and platform will reliably catch issues before release. Nearly three quarters (73%) also said they believe organizations that fail to integrate AI safely and securely across their software development lifecycle (SDLC) in the next year will “go the same way as the dinosaurs.”

Finally, most survey respondents (70%) are also concerned inefficient AI-generated code will drive uncontrollable cost overruns once it is deployed in a production environment.

Trevor Stuart, senior vice president and a general manager for Harness, said the survey makes it clear that much of the code being created by AI tools is being sent back to the proverbial kitchen to make it palatable enough to deploy. At the same time, many DevOps teams now feel like AI has created a six-lane highway for application developers that leads to a two-lane bridge operated by a DevOps team, he added.

That bottleneck will inevitably require DevOps teams to modernize their pipelines and workflows to make them efficient enough to manage higher levels of throughput, noted Stuart. However, the goal is to not necessarily add more DevOps pipelines so much as it is to enable DevOps teams to leverage AI to more efficiently manage the same or even fewer number of reusable pipelines, he added.

Achieving that goal will require those DevOps teams to not only better manage their pipelines, but in many cases rationalize their existing tools, said Stuart. On average, the survey finds development and engineering teams are already using eight to 10 distinct AI tools, while 36% of respondents juggle even more. A full 71% say context switching between those AI tools actually drains productivity.

It’s not clear how long it might be before DevOps teams are able to take greater advantage of AI to manage the current onslaught of code moving through their pipeline, but the one thing that should be clear to everyone by now is that writing more code does not directly equate to deploying more applications faster.

September 30, 2025
Survey Surfaces Software Engineering Challenges Following Adoption of AI

A survey of 101 senior engineering leaders published this week finds while 87% believe their organization is “prepared” or “very prepared” to adopt artificial intelligence (AI). It’s also clear that several hurdles remain, most notably making sure application development teams have the quality assurance skill and expertise needed to validate AI outputs (66%).

Conducted by Uplevel, a provider of a platform for tracking engineering metrics, the survey also finds engineering leaders are starting to focus more on performance monitoring and optimization (39%) and system architecture and integration skills (34%).

Additionally, the survey identifies technical debt (27%) and lack of clear AI strategy (22%) as the two greatest strategic threats to AI potential.

Amy Carrillo Cotten, director of client transformation at Uplevel, said the survey results suggest that while there is a lot of AI optimism, engineering leaders are also becoming more cognizant of some of the inherent challenges. For example, 30% cited data security and privacy risks as a significant issue that will need to be addressed.

Overall, engineering leaders are investing in AI to drive operational efficiency (53%), accelerate innovation (40%), improve decision-making (28%) and boost competitive advantage (23%).

Engineering leaders to achieve those goals are investing in reskilling existing employees (40%), hiring AI specialists (34%) and partnering with vendors or consultants (22%) to address those issues, the survey finds.

The challenge is, as always, determining what level of productivity gains are being made, said Cotten. While two thirds of engineering leaders (66%) say they regularly measure the business outcomes of their work their teams complete, 37% also conceded they have difficulty isolating how specific teams contributed to the effort. While the survey finds 61% of respondents prioritize key performance indicators (KPIs) are team or organizational level, many are also still tracking metrics such as how much code was produced by individual developers even though that metric has little to do with an actual business outcome, noted Cotten.

Engineering leaders will also need to have a better appreciation for systemic constraints such as complex architectures and collaboration challenges that will only become further exacerbated as the volume of code being created increases exponentially, said Cotten. In effect, many application development teams will discover they are running into the same brickwalls, only faster, she added.

In general, the survey identifies improving development tools and automation (27%), followed closely by reducing technical debt (24%) as the two things that would have the biggest impact on productivity. Obviously, AI is improving tooling but it’s not fairy dust that can be sprinkled everywhere, said Cotten. Engineering leaders need to have a strategy for operationalizing AI across the software development lifecycle (SDLC) to ensure success, she noted.

Ultimately, software development remains a team sport and no amount of wishful AI thinking is going to magically eliminate existing bottlenecks and constraints, added Cotten.

It’s not clear to what extent DevOps teams are adopting AI but there is no going back. The issue now is determining how best to set the right expectations for what can be actually achieved despite the current level of hype being created by exaggerated claims about how AI is eliminating the need for application developers.

September 11, 2025
Harness Delivers on AI Promise for DevOps

Harness today made a DevOps platform infused with artificial intelligence (AI) capabilities that enable agents to automate a wide range of tasks and workflows generally available.

Trevor Stuart, senior vice president for Harness, said the Harness AI platform is based on a knowledge graph that has been created to enable DevOps teams to manage, govern and observe tasks assigned to AI agents. The overall goal is to provide a framework for incorporating AI agents into DevOps workflows that will eliminate much of the manual effort that is often encountered when setting up pipelines, he added.

At the core of the Harness AI platform is a Software Delivery Knowledge Graph that continuously updates data pulled from both Harness and third-party DevOps tools and platforms across every stage of the software development lifecycle (SDLC). That knowledge graph enables AI agents to generate pipelines, rollback deployments and automatically run root-cause analysis.

For example, via a natural language, it is now possible for DevOps teams to simply describe their intent for setting up a pipeline, which Harness AI will build and deploy in adherence to the policies and guidelines an organization has defined, said Stuart.

Harness AI can also create, update, and maintain tests and chaos experiments, detect vulnerabilities and surface actionable insights to help reduce cloud costs, he added. None of the data collected by Harness AI, however, will be used to train any of the underlying AI models that Harness agents are invoking.

Harness claims existing Harness customers who participated in the Harness AI beta program have already seen downtime being cut in half, along with a 50% reduction in the amount of time spent debugging pipelines. Additionally, Harness reports test cycle times reduced by 80% and test maintenance efforts cut by 70%.

While DevOps teams are clearly embracing AI coding tools, the software engineering workflows used to deploy software don’t easily scale because of a dependency on overly brittle scripts. Harness is making a case for an AI platform that assigns tasks to AI agents that have been specifically trained to perform them. That approach makes it possible to not only build and deploy applications at greater scale, it also reduces the number of pipelines that need to be maintained by better optimizing workflows, said Stuart.

At this juncture, it’s not a question of whether DevOps teams will be relying on AI agents to automate tasks so much as it is when and to what degree. The one certain thing is that DevOps engineers will be needed to not only review the output created by those AI agents, but also orchestrate the management of workflows that might soon include hundreds of AI agents.

Hopefully, thanks to the rise of AI agents, much of the tedious manual effort that often conspires to burn out DevOps engineers will soon be reduced, if not entirely eliminated. The challenge and the opportunity now is building, deploying and maintaining the platform used to orchestrate the management of a portfolio of AI agents that, much like humans, will all seem to have their own set of unique personality attributes.

August 26, 2025
MCP Emerges as a Catalyst for Modern DevOps Processes

Loreli Cadapan, VP of product at CloudBees, discusses how the Model Context Protocol (MCP) developed by Anthropic will provide the foundation for reinventing DevOps workflows.

Cadapan explains that MCP acts as a bridge between large language models and enterprise DevOps environments, functioning as a kind of control plane. It can connect with different CI/CD tools and testing frameworks, pull in real-time data on pipelines and vulnerabilities, and even orchestrate tasks across the software delivery lifecycle. By reducing context switching and integrating with existing developer tools, MCP is designed to improve both productivity and governance.

She compared MCP servers to factory floor managers—directing specialized AI agents that handle specific tasks such as diagnosing build failures or recommending tests. The challenge, she noted, is ensuring those agents are trained on the right data. As with any AI, the quality of output depends heavily on the quality of the inputs and feedback they receive.

Cadapan acknowledged that AI adoption varies across organizations. Some want co-pilot style assistance with humans in the loop, while others are experimenting with allowing agents to fully automate parts of their workflows. Either way, she stressed that guardrails and policies must be in place so that outcomes are reliable, secure, and aligned with enterprise requirements.

Looking ahead, Cadapan sees AI changing not just coding and pipelines but also product management practices, from drafting requirements to validating solutions. As AI-generated code and commits increase, bottlenecks are shifting downstream—from developers to reviewers and pipelines. Her advice for teams is to stay informed, experiment carefully, and validate outputs rather than trusting AI blindly.

The broader message: MCP and AI agents are early steps toward rethinking the entire software delivery lifecycle. As software delivery accelerates and AI-generated code becomes commonplace, the real challenge will be ensuring pipelines, governance, and teams evolve at the same pace. For DevOps practitioners, that means preparing now for a future where AI is embedded in every stage of the lifecycle.

August 21, 2025
GitLab Preps Platform for Building and Managing AI Agents for DevOps Teams

GitLab this week made available a public beta of a platform for building, managing and orchestrating artificial intelligence (AI) agents that have been trained to automate a range of DevOps tasks and workflows.

Emilio Salvador, vice president of strategy and developer relations for GitLab, said the GitLab Duo Agent Platform will enable DevOps teams to assign tasks to AI agents both synchronously and asynchronously using an extensible platform that provides full visibility across the software development lifecycle (SDLC).

GitLab as part of that effort is building a catalog for AI agents and a knowledge graph that will enable AI agents to access data beyond the limits of the context window that any large language model (LLM) currently provides, he added. The GitLab Duo Agent Platform also supports the Model Context Protocol (MCP) developed by Anthropic to connect to MCP servers to provide access to additional data sources.

AI agents will, as a result, become members of a DevOps team that might service the needs of a single developer or engineer or an entire software engineering team, noted Salvador. For example, AI agents might help gather additional context, clarify ambiguities or even make changes to codebases and repositories.

While GitLab was an early AI pioneer in terms of making AI co-pilots available to DevOps teams, AI agents move well beyond simply providing a passive chat interface to interact with an AI model, noted Salvador. It’s not clear to what degree AI agents might supplant the need for AI co-pilots but it’s apparent DevOps teams require a more advanced set of capabilities to automate workflows, he added.

DevOps teams, will instead be able to have conversations that include capabilities to expand commands such as /explain, /tests, and /include that create a “delegation language” designed to more precisely assign tasks to an AI agent that using custom rules can now be highly personalized to each member of the team.

Finally, GitLab also revealed it has expanded the number of integrated development environments (IDEs) it supports to include JetBrains portfolio that is widely used to build AI applications.

The pace at which DevOps teams are embracing AI to build and deploy applications is unknown, but a recent Futurum Group survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code.

Mitch Ashley, vice president and practice lead for software lifecycle engineering at Futurum Grouo, said success using AI agents will be is heavily influenced by the context with which they operate. GitLab Duo Agent Platform leverages GitLab’s system of record to provide AI agents with deep project context for orchestrated, asynchronous collaboration. It reimagines DevSecOps, shifting from isolated tasks to integrated, intelligent workflows, he added.

At this point, it’s less a question of whether AI agents will be relied on to help build and deploy software and more a question of how extensively they will be. AI agents are, in effect, the equivalent of a junior developer that while talented should still have their work verified by a senior developer. With the arrival of GitLab Duo Agent Platform, the context that AI tools require to generate higher quality code that actually runs in a production environment will significantly improve. Just as importantly, many of the manual tasks that today conspire to make DevOps workflows tedious should soon be automated in a way that not only accelerates the pace of software development but also improves the quality of the applications deployed.

July 18, 2025
Revolutionizing CI/CD: A Framework for Integrating Generative AI Across the Software Delivery Lifecycle
As a DevOps expert, I’ve witnessed firsthand the transformative power of automation and continuous improvement. Today, I’m excited to share a framework that takes our practices to the next level by integrating generative AI into the software delivery lifecycle. This approach not only streamlines our processes but also enhances the quality and efficiency of our deliverables.

The Gen AI-Powered CI/CD Framework

Here’s a step-by-step guide to building and implementing a generative AI framework for CI/CD:

Automated Code Generation and Review
1. Implement GitHub Copilot or Amazon CodeWhisperer for AI-assisted coding.
2. Use AI-powered static code analysis tools like SonarQube or Amazon CodeGuru Reviewer.
Action: Integrate these tools into your IDE and Git workflows, such as GitHub Actions.

Intelligent Test Generation
1. Leverage tools like Diffblue Cover for automated test case generation.
2. Use AWS DevOps Guru to identify areas needing additional testing based on historical data.
Action: Implement AI-generated tests in your test suites and CI pipelines.

Dynamic Infrastructure Provisioning
1. Utilize AWS CloudFormation or AWS CDK with AI-enhanced templates.
2. Implement predictive scaling using Amazon EC2 Auto Scaling with ML-powered forecasting.
Action: Create AI-driven IaC templates and integrate them into your deployment processes.

Automated Security Scanning
1. Integrate Amazon Inspector for AI-powered vulnerability assessments.
2. Use AI-enhanced SAST/DAST tools like Snyk, Checkmarx, or Veracode.
Action: Implement these scans in your CI/CD pipeline, triggered by code commits.

Intelligent Deployment Strategies
1. Implement AI-driven canary deployments using AWS CodeDeploy.
2. Utilize Amazon SageMaker to build ML models for predicting deployment success.
Action: Integrate these predictive models into your deployment decision-making process.

AI-Enhanced Monitoring and Alerting
1. Leverage AWS CloudWatch with AI-powered anomaly detection.
2. Implement predictive alerting using tools like Datadog or New Relic’s AI capabilities.
Action: Set up AI-driven alert thresholds and automated incident response workflows.

Continuous Feedback and Optimization
1. Use AI to analyze user feedback and application logs (AWS Comprehend for sentiment analysis).
2. Implement ML models to correlate code changes with performance metrics.
Action: Create dashboards that visualize AI-derived insights for continuous improvement.

Documentation and Knowledge Management
1. Utilize GitHub CoPilot or AWS CodeWhisperer to generate and update documentation automatically.
2. Implement AI-powered chatbots for internal knowledge sharing.
Action: Set up automated documentation pipelines triggered by code or configuration changes.

Implementation Strategy
1. Assessment: Evaluate your current CI/CD pipeline and identify areas where AI can add the most value.
2. Tool Selection: Choose AI-powered tools that integrate well with your existing stack. Consider AWS services for seamless integration if you’re already in the AWS ecosystem.
3. Pilot Project: Start with a small, non-critical project to test your AI-enhanced CI/CD framework.
4. Training: Upskill your team on AI concepts and the new tools you’re introducing.
5. Gradual Roll-out: Implement the framework in phases, starting with code generation and review, then moving through testing, deployment and monitoring.
6. Measure and Iterate: Use metrics like deployment frequency, lead time and change failure rate to assess the impact of your AI-enhanced pipeline.
7. Scale: Once proven effective, scale the framework across all your projects and teams.
Challenges and Considerations
- Data Privacy: Ensure that your AI tools comply with data protection regulations.
- AI Bias: Regularly audit your AI models for biases in code suggestions or deployment decisions.
- Over-reliance: Maintain a balance between AI assistance and human expertise.
Conclusion

Integrating generative AI into your CI/CD practices isn’t just about adopting new tools — it’s about reimagining the entire software delivery lifecycle. This framework provides a roadmap for leveraging AI to enhance every stage of your pipeline, from code generation to deployment and monitoring.

By implementing this framework, you’re not just optimizing your current processes; you’re future-proofing your DevOps practices. The combination of AI-driven insights and human expertise will lead to faster, more reliable software delivery and ultimately, better products for your end-users.
June 30, 2025
Survey Surfaces AI Contest for the Hearts and Minds of DevOps Engineers

A report published by the Futurum Group finds organizations are exploring multiple paths to employing artificial intelligence (AI) capabilities across the software development lifecycle (SDLC).

Over the next 12 to 18 months organizations plan to increase spending on not only on AI code generation (83%) and agentic AI technologies (76%), but also existing familiar tools that have been augmented with AI, according to a survey of 855 IT leaders conducted by the Futurum Group.

While many DevOps teams will undoubtedly employ a mix of these approaches, it’s clear there is a battle underway for the hearts and minds of software engineers, said Mitch Ashley, vice president and practice lead for DevOps and application development at the Futurum Group.

Providers of application development tools and platforms have reached a pivotal AI moment as DevOps teams weigh the merits of switching platforms versus relying on incumbent vendors to bolt on additional AI capabilities, he added. Ultimately, success will hinge on lowering barriers to entry, go-to-market models and demonstrating tangible value at a time when the way software is being created is fundamentally changing, noted Ashley.

It’s still early days so far as adoption of AI is concerned but application development teams are clearly at the forefront. Previously, research from the Futurum Group revealed that 41% of the respondents it surveyed expect generative AI tools and platforms will be used to generate, review and test code.

Less clear is how much faith application development teams will have in those tools and platforms. It’s one thing to rely on a generative AI tool to explain how an existing code base is structured, but the quality of the code that might be generated can vary substantially. In some instances, such as generating a script for invoking an application programming interface (API), the quality of the code might not matter. However, the quality of the code being used to create business logic is critical, especially if that code might contain known vulnerabilities that were never properly scanned.

Of course, depending on the experience of the application developer, there are also plenty of instances where the code being generated might be better than the code that a human developer might have created on their own. As a result, the return on investment in AI tools and platforms will tend to vary widely from one DevOps team to the next.

Ultimately, advances in AI should bring about more positive than negative changes, especially as more AI agents that have been narrowly trained to automate a specific set of tasks become more widely employed. The simple fact is that there are still far too many manual tasks that make building and deploying software more tedious than anyone really enjoys, which only leads to higher turnover rates as software engineers inevitably become burnt out.

Conversely, however, DevOps teams should also be wary of becoming overly dependent on AI. After all, the one golden rule of application development that still applies in the age of AI is that no code should be deployed in a production environment that one or more humans don’t thoroughly understand.

May 15, 2025
Symbiotic Security Unveils AI Coding Tool Trained to Identify Vulnerabilities

Symbiotic Security, this week, launched a tool that leverages a large language model (LLM) specifically trained to identify vulnerabilities via a chatbot as application developers write code.

Company CEO Jérôme Robert said Symbiotic Security version 1 reduces the current level of DevSecOps friction that exists by identifying issues long before flawed code finds its way into a production environment.

Unlike a general-purpose large language model (LLM) that has been trained using samples of code randomly collected from across the web, the LLM created by Symbiotic Security has been trained using a proprietary dataset to provide more accurate results, including snippets of code that can be used to eliminate vulnerability, he added. Developers can accept, modify, or reject those recommendations as they then see fit, he added.

The overall goal is to eliminate reliance on a set of alerts generated by cybersecurity teams that are provided too late and lack any real context in favor of an approach that provides developers with continuous training in a way they are more likely to embrace, he added.

Additionally, Symbiotic Security version 1 provides the added benefit of providing application developers with continuous application security training that, over time, will help significantly reduce the number of mistakes being made in the first place, noted Robert.

Finally, addressing those issues earlier in the software development lifecycle (SDLC) will then reduce the number of remediation requests being generated by cybersecurity teams scanning for vulnerabilities that are being discovered sometimes even years after applications have already been deployed, said Robert. Arguably, much of the technical debt that is largely unaddressed in many organizations is traceable back to known vulnerabilities in applications that can now be eliminated as applications are constructed, he added.

As AI coding tools continue to evolve, it’s becoming apparent that a wave of tools that are specifically trained to address software development tasks is starting to become more widely available.

It’s not clear how widely AI coding tools based on general-purpose LLMs have been adopted, but it’s now only a matter of time before the next generation of these tools start to be more widely employed. In fact, a recent Futurum Research survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code, while 39% plan to make use of AI models based on machine learning algorithms.

Eventually, the quality of the code being generated by AI coding tools will improve as more LLMs are trained using data sets that are well vetted. In the meantime, however, it’s highly probable that much of the code being generated by general-purpose LLMs has known vulnerabilities. As such, the overall state of application security may likely become worse in the short term before ultimately becoming a lot better than anyone a few short years ago would have ever thought achievable.

The issue now is making sure the right AI coding tools find their way into the hands of the application developers that need them most as soon as possible.

April 17, 2025