sdlc

2 posts · all tags

  • AppSec in the age of AI-Native SDLC

    AI in software development turned everything upside down, and the way we write code has changed for good.

    The math of productivity and scale is not the same anymore. We used to budget one appsec engineer for every 50 devs. Now 50 devs means 500 agents.

    Traditional software security practices, tools, and strategies simply do not work anymore.

    I took this time to share my take on what I have been seeing out there, and what I think is coming next.

  • Reviewing AI-Generated Code Without Rubber-Stamping It

    The uncomfortable thing about reviewing AI-generated code is that it looks right. Consistent naming, sensible structure, a docstring on every function. It reads like code written by someone competent and slightly bored — which is exactly the reading posture it induces in the reviewer.

    Human code announces its risky parts. It has a weird variable name, a commented- out block, a function that grew to two hundred lines. AI code is uniformly polished, so your attention has nothing to snag on. The bug is in there wearing the same clean shirt as everything else.