Agentic Development and the Evolution of DevSecOps - Ken Toler - Cyber Smokehouse - Episode #28

So, yeah, I mean, if you look at some of the studies out there and some of the claims, you know, Microsoft says 50% of its code is now being built by, plus is being built by, by a genetic AI, right? And, yeah, Are you concerned about that we're going to lose capabilities to even write code? I mean, if we're relying so much on machines to do it.

And does that really matter? Do our developers just become kind of great prompters and designers, I guess, and architects as opposed

to actual developers? You know, that's a good question.

I don't, I'm on the fence about it.

I sort of waffle back and forth because on one hand, I do think that I do think that security engineers and developers should still know how to code manually.

There was a long time in my career where I didn't know how to code.

And I think that really leveled me up in terms of when it finally clicked for me and allowed me to drive automation.

And whether it was network pen testing or app pen testing, I used to say, I'm really good at reading code, but I'm not really great at writing code.

And I think that a lot of times people that have maybe quit computer science or have started to learn development and then fallen out, usually come back into it because of some layer of abstraction that made something click for them.

And, you know, for me, it was, I really hated C, but, you know, when Ruby, there are a lot of Ruby haters out there, but Ruby really sort of changed the perspective of like what development looked like for me.

And I think that on some level, this can help individuals come over their learning curve on development.

And I think people that use it like that will be better for it.

And I think that when it comes to diagnosing issues or understanding what the problems are inside of the code, you still need to be able to read code and reason about how it all fits together to be a good systems thinker around things.

And I think that if you are in security and you have that curiosity, that you might naturally gravitate towards trying to understand what are the components that make this thing up and And how do I break those things? And the more you understand about how things fit together, the more successful you'll be at prompting or at leveraging these tools.

So I do think that you need to have some level of expertise there and that you can operate in different layers.

I don't think that... like the next generation of developers will necessarily, well, I don't know, but it doesn't seem like they'll have the same opportunity to learn those things, especially with how fast we're moving.

I've seen some arguments, well, we've moved up layers of abstraction before, we've started in basic and we've used punch cards and we don't know how to do that anymore.

But the speed at which we're getting away from the abstraction of what it looks like to develop manually, I think is going to make this next generation maybe less likely to learn those things.

And I think we need to figure out how to teach those systems to people while allowing them to use these tools.

yeah, that's actually a good point.

I hadn't thought about it from terms of the abstraction layer.

Cause I think about when, you know, when I was, when I, you know, started, it was in college.

We were, we were, you know, we were, we didn't even have PCs back then.

Right.

So, and, and so coding was exactly, it was punch cards and, and, uh, And, you know, and then, you know, we got to, you know, WYSIWYG and all that, you know, so each time, you know, we got an object oriented programming and every time was kind of we're abstracting a layer up, a layer up, you know, getting it more and more.

So, yeah, I mean, if you look at some of the studies out there and some of the claims, you know, Microsoft says 50% of its code is now being built by, plus is being built by, by a genetic AI, right? And, yeah, Are you concerned about that we're going to lose capabilities to even write code? I mean, if we're relying so much on machines to do it.

And does that really matter? Do our developers just become kind of great prompters and designers, I guess, and architects as opposed

to actual developers? You know, that's a good question.

I don't, I'm on the fence about it.

I sort of waffle back and forth because on one hand, I do think that I do think that security engineers and developers should still know how to code manually.

There was a long time in my career where I didn't know how to code.

And I think that really leveled me up in terms of when it finally clicked for me and allowed me to drive automation.

And whether it was network pen testing or app pen testing, I used to say, I'm really good at reading code, but I'm not really great at writing code.

And I think that a lot of times people that have maybe quit computer science or have started to learn development and then fallen out, usually come back into it because of some layer of abstraction that made something click for them.

And, you know, for me, it was, I really hated C, but, you know, when Ruby, there are a lot of Ruby haters out there, but Ruby really sort of changed the perspective of like what development looked like for me.

And I think that on some level, this can help individuals come over their learning curve on development.

And I think people that use it like that will be better for it.

And I think that when it comes to diagnosing issues or understanding what the problems are inside of the code, you still need to be able to read code and reason about how it all fits together to be a good systems thinker around things.

And I think that if you are in security and you have that curiosity, that you might naturally gravitate towards trying to understand what are the components that make this thing up and And how do I break those things? And the more you understand about how things fit together, the more successful you'll be at prompting or at leveraging these tools.

So I do think that you need to have some level of expertise there and that you can operate in different layers.

I don't think that... like the next generation of developers will necessarily, well, I don't know, but it doesn't seem like they'll have the same opportunity to learn those things, especially with how fast we're moving.

I've seen some arguments, well, we've moved up layers of abstraction before, we've started in basic and we've used punch cards and we don't know how to do that anymore.

But the speed at which we're getting away from the abstraction of what it looks like to develop manually, I think is going to make this next generation maybe less likely to learn those things.

And I think we need to figure out how to teach those systems to people while allowing them to use these tools.

yeah, that's actually a good point.

I hadn't thought about it from terms of the abstraction layer.

Cause I think about when, you know, when I was, when I, you know, started, it was in college.

We were, we were, you know, we were, we didn't even have PCs back then.

Right.

So, and, and so coding was exactly, it was punch cards and, and, uh, And, you know, and then, you know, we got to, you know, WYSIWYG and all that, you know, so each time, you know, we got an object oriented programming and every time was kind of we're abstracting a layer up, a layer up, you know, getting it more and more.