Software has never been produced faster. Yet many organizations understand less and less if the code they deploy every day

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

For decades, software development was constrained by a simple reality:

Humans could only write code so fast.

Projects were delayed because developers were scarce.
Features were postponed because engineering capacity was limited.
Architectural decisions mattered because implementation was expensive.

Then AI arrived.

Suddenly, the economics of software creation changed.

A single developer can generate in hours what previously required days.
Small teams can build applications that once demanded entire departments.
Prototypes appear almost instantly.
Documentation, test cases, integrations, APIs, and infrastructure code can be generated on demand.

From a productivity perspective, this appears revolutionary.

From a governance perspective, it may be one of the most significant risks organizations have ever introduced into their technology environments.

Because while we successfully automated coding, we forgot to scale understanding.

And understanding—not code generation—has always been the true limiting factor of software security.

The Wrong Question

Most discussions around AI-assisted software development focus on a familiar question:

“Does AI generate good code?”

The question sounds reasonable.

It is also increasingly irrelevant.

Whether AI-generated code is technically correct matters far less than whether organizations understand the systems they are creating.

Security failures rarely emerge because a single line of code contains a syntax error.

They emerge because nobody fully understands:

• how components interact
• where trust boundaries exist
• what dependencies are involved
• which assumptions have become invalid
• how a change affects the broader system

The greatest software failures in history were rarely coding failures.

They were failures of understanding.

AI changes this equation dramatically because it allows organizations to create software faster than they can comprehend it.

The New Bottleneck

For decades, software engineering operated under a predictable constraint.

The bottleneck was production.

Developers spent most of their time writing software.

Today, that bottleneck is rapidly disappearing.

The new bottleneck is comprehension.

Consider what happens when AI generates:

• a new microservice
• a database integration
• authentication logic
• infrastructure-as-code templates
• API gateways
• Kubernetes configurations
• cloud deployment pipelines

Generating these artifacts is increasingly easy.

Understanding their collective behavior remains difficult.

Every generated component becomes another object that somebody must:

• review
• secure
• maintain
• audit
• patch
• monitor
• explain

The challenge is no longer building software.

The challenge is retaining control over what gets built.

Security Has Always Been a Problem of Understanding

As CISOs, we often speak about vulnerabilities, malware, phishing, cloud risks, and insider threats.

But underneath all of these discussions lies a more fundamental issue.

Security is ultimately a problem of knowledge.

To secure something, you must first understand it.

You must know:

• what exists
• how it operates
• who depends on it
• what can influence it
• what can fail

This principle has not changed since the earliest computer systems.

What has changed is the speed at which complexity can now be created.

AI allows organizations to generate software complexity at unprecedented scale.

Unfortunately, human understanding has not accelerated at the same rate.

The Hidden Expansion of Attack Surface

Most organizations already struggle with visibility.

They have:

• unknown applications
• undocumented integrations
• unmanaged APIs
• abandoned services
• forgotten cloud resources

Now imagine multiplying software creation velocity by ten.

Or twenty.

Or one hundred.

The immediate result is not necessarily more innovation.

The immediate result is more complexity.

Every generated feature introduces:

• new logic
• new dependencies
• new trust relationships
• new failure modes
• new attack surfaces

The problem is not that AI creates vulnerabilities.

The problem is that AI creates systems faster than organizations can identify vulnerabilities.

There is a profound difference.

The Rise of Invisible Architecture

Historically, architecture emerged through deliberate design.

Architects defined standards.

Engineers implemented them.

Reviews ensured consistency.

Documentation provided institutional memory.

AI changes this dynamic.

Many development teams increasingly begin with a prompt instead of an architectural decision.

The result often works.

At least initially.

But software does not become dangerous because it fails immediately.

Software becomes dangerous because its complexity accumulates over time.

Organizations gradually lose the ability to answer basic questions:

Why was this implemented?

Who approved this dependency?

Why does this service exist?

What business process relies on it?

Who understands its failure modes?

When these questions can no longer be answered, software ceases to be engineered.

It becomes archaeology.

Understanding Is Becoming the Scarce Resource

For years, organizations competed for developers.

Soon they may compete for something else entirely:

People capable of understanding complex systems.

This distinction matters.

AI can generate code.

AI can explain code.

AI can document code.

But none of those capabilities automatically create understanding.

Understanding emerges from context.

It requires knowledge of:

• business objectives
• risk tolerance
• operational realities
• regulatory requirements
• architectural intent

The larger and more critical the organization becomes, the more important this distinction becomes.

A global enterprise operating across dozens of countries cannot govern technology through generated outputs alone.

It must govern through shared understanding.

Why CISOs Should Care

Many security leaders still view AI-assisted development primarily through a secure coding lens.

This perspective is too narrow.

The strategic risk is not merely insecure code.

The strategic risk is organizational loss of comprehension.

A future security incident may not begin with:

“We missed a vulnerability.”

It may begin with:

“We didn’t know this existed.”

Or:

“We didn’t realize how these systems interacted.”

Or:

“Nobody fully understood the architecture anymore.”

These are not technical failures.

They are governance failures.

And governance failures are precisely where cybersecurity becomes a board-level issue.

The Coming Governance Crisis

The software industry is entering a period where software production and software governance are diverging.

Software generation is accelerating exponentially.

Organizational understanding is not.

This creates a widening gap between:

• what exists
• what is documented
• what is understood
• what is governed

The gap may become one of the defining technology risks of the next decade.

Not because AI is inherently dangerous.

But because organizations are adopting AI as a production accelerator while neglecting its governance implications.

In many cases, software inventories are already incomplete.

Architecture repositories are already outdated.

Dependency maps are already inaccurate.

AI amplifies all three problems simultaneously.

A Different Measure of Success

Perhaps the most important question leaders should ask is not:

“How much faster are we developing software?”

Instead, they should ask:

“How much of our software do we genuinely understand?”

The answer may reveal more about organizational resilience than any productivity metric ever could.

Because software velocity is not a strategic advantage if understanding declines at the same time.

And innovation is not progress if governance disappears along the way.

The Real AI Challenge

The software industry often frames AI as a coding revolution.

I believe that interpretation is incomplete.

The real transformation is not happening in software development.

It is happening in organizational control.

For decades, software creation was constrained by human effort.

Today, software understanding is constrained by human cognition.

And cognition scales far more slowly than code generation.

That is why the most important question facing technology leaders today is not whether AI can write software.

We already know it can.

The real question is whether organizations can still understand the software they are creating.

Because the moment understanding disappears, control follows.

And when control disappears, security is usually not far behind.

Publication Note & Disclaimer
This article was originally published on LinkedIn on January 30, 2026 and may have been edited or updated for publication on this site.

It reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.