AI Is Writing Code Faster Than Ever. Your DevOps Tools Still Can’t Tell You What’s Running.
By John Viega, CEO, Crash Override
AI coding agents are accelerating development at a pace that would have seemed ridiculous two years ago. Copilots, autonomous agents and AI-assisted pipelines are generating pull requests, writing tests and shipping features with less human intervention than ever before. Enterprises are embracing the speed. But there is an uncomfortable truth hiding beneath the velocity: the DevOps toolchains meant to govern, secure and verify all of this output were never designed to keep up. They certainly weren’t designed to answer the questions that actually matter.
The Context Gap
Consider a question that should be simple: “Which clusters are running service X from commit Y?”
In most organizations, answering this requires checking a dozen tools. You start in your source control, move to your CI/CD system, check the artifact registry, cross-reference your deployment controller, consult your observability platform, maybe open a wiki or ping someone on Slack. Each tool holds a fragment. None of them hold the full picture.
This isn’t a tooling failure in the traditional sense. Each tool in a modern DevOps stack is excellent at what it does. Source control manages code. CI/CD runs builds. Registries store artifacts. Deployment controllers push workloads. Observability platforms monitor runtime. Security scanners flag vulnerabilities. The problem is that context evaporates between them.
The moment a build completes, the relationship between a commit, its author, its dependencies, its security scan results and its eventual runtime location begins to fragment. By the time an artifact is running in production, the provenance that would let you answer meaningful questions about compliance posture, security exposure or ownership has scattered across your entire stack.
Why This Matters Now
This has always been a nuisance. It becomes a crisis when AI agents enter the picture.
When a human developer writes code, there is at least an implicit paper trail. The developer knows what they changed, can explain why, and can trace the deployment if pressed. It is slow and manual, but the institutional knowledge exists somewhere, even if it lives in someone’s head.
AI agents don’t have institutional knowledge. They generate code, open pull requests and in many cases trigger deployments without the contextual memory that humans carry. The output is faster, but the gap between “code was written” and “we can explain what’s running and why” grows wider with every automated commit.
This creates real consequences for the teams downstream. Security teams can’t answer “are we exposed to this CVE?” without an eight-tool scavenger hunt. Compliance teams can’t produce audit evidence without weeks of manual spreadsheet assembly. Incident responders spend hours correlating data across platforms for problems that take five minutes to fix once understood.
The Architectural Root Cause
The root cause is architectural, not organizational. Modern DevOps toolchains were built as independent, best-of-breed systems. Each was designed to optimize a specific workflow. None were designed to maintain a continuous thread of context from the moment code is written to the moment it runs in production. Purpose built DevOps platforms promised to fix this issue, but in reality they lack the ability to connect the dots.
Think of it this way: your toolchain is a collection of capable, autonomous components with no shared nervous system. Each component reacts to its own inputs. None of them coordinate around a unified understanding of what your software actually is, where it came from, or what state it is in right now.
This means that compliance is inherently retrospective. It’s assembled after the fact from fragmented data rather than generated continuously from a single source of truth. Security posture is approximated through periodic scans rather than understood in real time. Incident response relies on human correlation rather than automated context.
A Different Architectural Pattern
Solving this doesn’t require replacing the tools you have. It requires embedding context directly into the artifacts themselves, at build time, and maintaining that context as artifacts move through the pipeline into production.
In practice, this means treating every container image, every binary, every deployed artifact as a carrier of its own story. Metadata – the commit, the author, the branch, the dependencies, the security scan results, the build timestamp – gets baked into the image as a signed attestation during the CI/CD process. That attestation travels with the artifact as it moves through registries, deployment controllers, and into runtime, so the context is never separated from the thing it describes.
This is the difference between asking “what’s running in production?” and having every artifact in production answer that question for you. Queries that previously required correlating twelve systems become lookups against a single, continuously updated data source.
The pattern shifts compliance from a periodic exercise to a continuous byproduct of the pipeline. It gives security teams real-time visibility into exposure. It reduces incident correlation from minutes of manual investigation to seconds of automated lookup.
The Trust Problem
Ultimately, this is a trust problem. Organizations can’t automate what they can’t trust. And right now, most teams don’t trust their toolchain data because it is scattered, stale and inconsistent. Fix the trust problem. Give every team a single, cryptographically verifiable answer to questions about what’s running, where it came from and whether it’s compliant. Implementing automation becomes not just possible but trivial.
As AI agents continue to accelerate the pace of development, the organizations that thrive will be the ones that solve the context problem. Not by adding more tools to the stack, but by giving the tools they already have a way to share a brain.
##
KubeCon + CloudNativeCon EU 2026 is taking place in Amsterdam, the Netherlands, from March 23-26. Register now.
ABOUT THE AUTHOR
John Viega is the co-founder and Chief Executive Officer at Crash Override, a venture-backed security startup founded in 2022. Viega is a well known security expert, author, and public speaker.
He has more than 25 years of experience in the security and software development fields holding executive leadership and technical leadership roles. He has published eight books on software and information security including the first ever book on software security, and several widely used open source tools like mailman and co-created GCM, a cryptographic algorithm standardized by NIST.
Prior to Crash Override he was the co-founder and CEO of Capsule8 (acquired by Sophos in 2021), EVP for products at Silversky (acquired by Raytheon) and the Chief Security Architect at McAfee. He has a Masters degree in computer science from the University of Virginia, and is an adjunct professor at NYU where he teaches cryptography. John lives in New York City.
