Here’s the uncomfortable truth about modern software development: we’ve gotten really, really good at writing code fast. Securing it? Not so much.
Morey Haber from BeyondTrust breaks it down. We went from Waterfall to Agile to DevOps, and now we’re at “Vibe Coding” — where you just describe what you want in plain English and an AI builds it. Prototypes that used to take weeks now take minutes. Intent has become the programming language.
Sounds great, right? Anyone can build software now. But here’s the catch: democratizing creation doesn’t democratize security judgment.
The problem is obvious when you think about it. Code generated in seconds can still ship with vulnerabilities, architectural flaws, privilege escalation risks, and compliance gaps. The old security gates — code reviews, manual testing, threat modeling — they happen at human speed. AI writes at machine speed.
Haber traces the whole evolution. Waterfall was slow but predictable. Agile sped things up with iterative sprints. DevOps automated delivery. Each step reduced friction between idea and deployment. But each step also removed moments where security decisions traditionally happened.
Now with Vibe Coding, a non-developer can prompt an AI into existence. No requirements documents. No sprint planning. Just a conversation that produces working code. The developer role shifts from builder to reviewer and orchestrator.
That shift matters because the reviewer needs to catch security issues in code they didn’t write, generated by a model that doesn’t understand context. It’s a fundamentally harder job.
The takeaway? Speed of thought development is here. Security needs to evolve just as fast — or it’ll always be playing catch-up.
