Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
•
IT Security NachrichtenBetrüger phishen mit vermeintlicher Reisebestätigung - IT-Markt(24.09.2026 um 23:41 Uhr)
••
Sicherheitslücken (CVE)IT Security News Daily Summary 2026-09-24(24.09.2026 um 23:55 Uhr)
•
Sicherheitslücken (CVE)IT Security News Roundup: 2026-09-24(24.09.2026 um 23:57 Uhr)
•
Sicherheitslücken (CVE)IT Security News Hourly Summary 2026-09-25 00h : 9 posts(25.09.2026 um 00:00 Uhr)
•••
IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)
•••
IT Security NachrichtenBetrüger phishen mit vermeintlicher Reisebestätigung - IT-Markt(24.09.2026 um 23:41 Uhr)
••
Sicherheitslücken (CVE)IT Security News Daily Summary 2026-09-24(24.09.2026 um 23:55 Uhr)
•
Sicherheitslücken (CVE)IT Security News Roundup: 2026-09-24(24.09.2026 um 23:57 Uhr)
•
Sicherheitslücken (CVE)IT Security News Hourly Summary 2026-09-25 00h : 9 posts(25.09.2026 um 00:00 Uhr)
•••
IT NachrichtenMicrosoft puts Brad Smith in charge of communications(25.09.2026 um 00:08 Uhr)
••
Intelligence View
⚡ tsecurity.de Intelligence

Where AI Fits in the SDLC — and Where Humans Still Own the Decision

AI is becoming part of software delivery, but responsibility still lives at the human decision boundaries that define quality, risk, and accountability. By Lakshmi Priya Gopalsamy Core idea: AI can support almost every stage of the…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

AI is becoming part of software delivery, but responsibility still lives at the human decision boundaries that define quality, risk, and accountability.



By Lakshmi Priya Gopalsamy



Core idea:

AI can support almost every stage of the software delivery lifecycle, but the decisive control points—problem framing, architecture, approval, rollout, incident tradeoffs, and long-term accountability—still belong to humans.



An AI assistant can turn a ticket into a pull request faster than many teams can review it. That is the opportunity and the trap.



AI is now part of the software delivery lifecycle whether teams planned for it or not. It drafts code, explains unfamiliar modules, generates tests, summarizes logs, and reduces the friction between idea and implementation. In many organizations, it is already showing up in requirements drafting, IDE copilots, code review, feature-flagged rollout, and incident analysis.



But faster execution is not the same thing as sound engineering.



Software delivery is not just the act of producing code. It is the act of defining the right problem, making tradeoffs under constraints, managing risk, protecting customers, and owning what happens after release. AI can accelerate many parts of that workflow. It still does not own the decision.



The right question is no longer whether AI can write code. It clearly can.



The better question is: where AI fits in the SDLC, and where humans still need to exercise judgment.


















































Stage Where AI helps Human decision boundary Example tools
Discovery Summarizes notes, drafts requirements, structures input Define the real problem, align stakeholders, set success criteria Jira Product Discovery, Confluence AI
Architecture Compares patterns, drafts options, surfaces tradeoffs Choose boundaries, resilience, cost, maintainability AI design assistants, RFC tools
Implementation Generates boilerplate, tests, refactors Validate correctness, preserve domain intent, maintain coherence GitHub Copilot, Gemini Code Assist, Amazon Q
Review & Governance Summarizes PRs, flags obvious issues Approve risk, enforce standards, protect trust boundaries CODEOWNERS, branch protection
Release Drafts notes, rollout plans, rollback steps Decide go/no-go, rollout strategy, blast radius LaunchDarkly, CI/CD
Operations Summarizes logs, correlates signals Balance impact, mitigation, accountability Sentry Seer, Datadog Bits AI


The shift is real — but so is the responsibility



I see AI as the next major productivity shift in software engineering. We have seen major shifts before: better IDEs, version control, CI/CD, cloud platforms, infrastructure as code, automation, and observability. Every one of those changed how teams worked. None of them removed the need for engineers to think, decide, and own outcomes.



AI belongs in that same category, with one important difference: it compresses execution faster and more visibly than most previous tools. When the cost of generating artifacts drops, the value of judgment rises. Teams should use AI, but they should use it with clear decision boundaries.



Discovery and requirements



Where AI fits. This is where strong engineering begins, and it is also where AI can be deceptively helpful. Tools such as Jira Product Discovery and Confluence AI can help summarize stakeholder input, organize user feedback, draft RFC sections, and turn rough notes into more structured requirements.



Where humans still own the decision. Humans still need to define the actual problem, resolve ambiguity, align stakeholders, and decide what success means. They also need to surface non-functional requirements early: security, latency, compliance, availability, cost, and operational support. An AI system can help refine a requirement. It cannot tell you whether the requirement is solving the right problem in the first place.



Architecture and design



Where AI fits. Architecture is where tradeoffs become real, and AI can help teams compare common patterns, draft architecture decision records, and surface standard pros and cons more quickly. It is useful as a thinking partner, especially when teams want to pressure-test options before a design review.



Where humans still own the decision. Humans still decide service boundaries, data ownership, scaling strategy, resilience patterns, privacy posture, cost constraints, and long-term maintainability. Architecture is not pattern matching. It is constrained decision-making in a specific environment. An assistant can suggest event-driven design, a caching layer, or a microservice split. It does not own the consequences of extra complexity, eventual consistency, or a wider blast radius when something fails.



Implementation



Where AI fits. This is the most obvious place where AI adds value. Tools like GitHub Copilot, Gemini Code Assist, and Amazon Q Developer can help with boilerplate, repetitive code, refactors, test scaffolding, documentation, and familiar implementation patterns. Used well, they reduce blank-page friction and speed up execution.



Where humans still own the decision. Humans still need to validate correctness, preserve domain intent, choose appropriate abstractions, and make sure the code fits the existing system instead of merely compiling in isolation. Generated code often looks plausible. That is not the same as production-ready. The job of implementation is not just to produce code. It is to produce code that belongs in this codebase, for this problem, with these constraints.



Testing and verification



Where AI fits. AI can suggest test cases, generate fixtures, improve coverage around common edge cases, and help engineers think through alternate flows that might be easy to miss. It can accelerate verification work, especially for routine patterns.



Where humans still own the decision. Humans still define the test strategy, identify high-risk behaviors, and decide what level of evidence is needed before merge. A passing test suite is a useful signal. It is not proof that a system is safe. Teams still need to think about integration behavior, performance regressions, migration risk, data integrity, backward compatibility, and when a change requires more than automated checks.



Code review, security, and governance



Where AI fits. AI can summarize pull requests, explain unfamiliar logic, flag obvious issues, and help reviewers move faster through routine parts of a change. It can be a force multiplier for teams that are already disciplined.



Where humans still own the decision. Humans still review intent, hidden risk, trust boundaries, authorization behavior, and whether the change is acceptable for the system and the business. This is also where engineering standards matter: CODEOWNERS, branch protection rules, approval paths for sensitive areas, and security scanning all preserve the human control point before merge. AI can support the review process. It should not quietly become the review process.



Release and change management



Where AI fits. AI can draft release notes, summarize change impact, build rollout checklists, and help teams prepare rollback steps. Feature management platforms such as LaunchDarkly make it easier to separate deployment from release, which becomes even more valuable when code moves faster.



Where humans still own the decision. Shipping is still a decision, not a mechanical step. Humans make the go or no-go call, assess blast radius, choose rollout strategy, decide whether a canary or feature flag is required, and determine when rollback is safer than pushing forward. A pipeline can move code automatically. It does not remove accountability for production risk.



Operations and incident response



Where AI fits. Production is where all abstractions get tested, and AI can help teams move through large volumes of information more quickly. Tools like Sentry Seer or Datadog Bits AI can help summarize logs, correlate signals, surface likely incident paths, and retrieve runbook context faster than manual digging.



Where humans still own the decision. Humans still establish incident priorities, balance mitigation tradeoffs, assess customer impact, decide whether to fail over or disable functionality, and communicate clearly under pressure. Incident response is not only analytical. It is operational and social. An assistant can suggest likely causes. It cannot own the judgment call when the tradeoff is revenue, data integrity, customer trust, or service availability.



Postmortems and continuous improvement



Where AI fits. AI can summarize timelines, cluster recurring failure patterns, organize notes, and help convert a messy incident record into a cleaner postmortem draft. It can save teams time in the synthesis step.



Where humans still own the decision. Humans still determine what really failed, distinguish proximate cause from systemic cause, decide what needs to change, and prioritize the follow-up work. Good postmortems are not documentation exercises. They are learning exercises. The important decisions are about process, architecture, investment, and team habits. AI can help with synthesis. Humans still own learning.



What changes for engineering leaders



As AI becomes more embedded in delivery, engineering leaders need to get more explicit about decision rights. The goal is not to resist the tools. The goal is to operationalize them responsibly.



Treat AI output as a draft, not a decision. Generated code, tests, documents, and analysis should enter the workflow as inputs to review, not as self-authorizing artifacts.

Keep human ownership visible at every control point. Requirements sign-off, architecture approval, security review, release approval, and incident decisions should have clear human accountability.

Raise the bar on judgment as execution gets cheaper. If implementation becomes faster, teams should invest more in problem framing, tradeoff analysis, review quality, and operational discipline.

Protect the development of junior engineers. One risk of AI-heavy workflows is that teams remove the learning loops that build intuition. Mentorship, debugging, design discussion, and review feedback still matter.

Measure outcomes, not novelty. Do not measure success by how much AI a team uses. Measure rework, defect rates, cycle time, operational stability, onboarding effectiveness, and decision quality.



The real shift: judgment becomes more valuable, not less



The more easily code can be produced, the more important it becomes to ask whether the code should exist, whether it is safe, whether it solves the right problem, and whether the team can support it over time.



That is why I do not see AI as the end of engineering. I see it as an amplifier. It amplifies speed, output, and access to implementation help. But it also amplifies the cost of weak judgment. When teams confuse generation with understanding, they move faster in the wrong direction.



AI belongs in the SDLC. It belongs in discovery support, design exploration, implementation acceleration, verification, release preparation, operational triage, and postmortem synthesis. What it does not replace is ownership. Humans still own the decision. And in a world where execution is cheaper, that human responsibility becomes even more important.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Where AI Fits in the SDLC — and Where Humans Still Own the Decision
id: b779406f-5bcc-4d32-9064-4d76e576360b
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Where AI Fits in the SDLC — an" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Where AI Fits in the SDLC  and Where Hum")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Where AI Fits in the SDLC  and Where Hum*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Where AI Fits in the SDLC  and Where Hum"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Where AI Fits in the SDLC — and Where Hu.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Where AI Fits in the SDLC — and Where Humans Still Own the Decision

Thematisch verwandte Begriffe: Where, Fits, SDLC, Humans · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-87722 | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search q…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle