Controlled AI-assisted delivery, DevSecOps and compliance engineering, written from inside environments where somebody eventually has to answer for the outcome. 5 posts and counting.
Google publishes two billion lines of its own code, but the number that should worry you is how little of your product you wrote. Vulnerability submissions rose 263 per cent, NIST has stopped enriching all of them, and mean time to exploit is now negative. What an SBOM is, what one actually looks like, and why a filed one is worthless.
Microsoft shipped fixes for the better part of a thousand vulnerabilities in a single Patch Tuesday, including two already being exploited. That is not a story about Microsoft. It is what an industrial-scale problem discovery mechanism looks like, and it exposes the fact that we have spent thirty years measuring how fast we ship and never once measuring the quality of what arrived.
Stop calling it “automation” and start building a backbone: ingestion that tracks provenance, WORM that stays immutable, an access broker that hands out minimum access, and HMAC that proves nothing got tampered with.
Weve done the heavy lifting os you know what standard to align to - and more imprtantly - how to align in the brave new LLM world.
Compliance that sounds clever fails under pressure. AppGenie standards enforce behaviour, evidence, traceability, and survivability even with Vibe coding.
