AI is now part of how most software gets built. Coding assistants suggest and write code, generate tests, explain unfamiliar systems and draft documentation. At the same time, more of the software being built contains AI itself. The disciplines of software engineering, machine learning, cloud infrastructure and security are converging, and the organizations that manage that convergence well will ship better software faster. The ones that do not will ship more code with more problems.
The evidence so far is more nuanced than the hype on either side. AI clearly changes the work, but the productivity gains depend heavily on how teams use it, and the risks to quality and security are real. This article looks at what the research shows, how the software lifecycle is changing, and the guardrails engineering leaders should put in place.
What the evidence says about AI-assisted development
Adoption is near universal. In Stack Overflow’s 2025 Developer Survey, released in July 2025, 84% of developers said they use or plan to use AI tools in their development process, up from 76% the year before. Trust moved the other way: 46% said they distrust the accuracy of AI tools, compared with 31% in 2024.
Productivity findings are mixed. In a randomized controlled study published in July 2025, the research group METR found that experienced open-source developers working on their own large, mature codebases took about 19% longer to complete tasks when allowed to use early-2025 AI tools, even though they expected, and afterward believed, that the tools had sped them up. Other studies on smaller or less familiar tasks have found meaningful speedups.
The practical reading is that AI helps most with well-defined, self-contained work and unfamiliar code, and helps least, or even hurts, when deep context and high quality standards matter. Leaders should measure outcomes in their own teams rather than assume a fixed gain.
How the software lifecycle is changing
Design and planning. Engineers use AI to explore approaches, draft specifications and summarize existing systems. Architecture decisions, trade-offs and non-functional requirements remain human responsibilities, and they matter more when code is cheap to produce.
Coding. Assistants and agents can generate functions, refactor code and implement whole features from a description. The engineer’s role shifts toward specifying clearly, breaking work into reviewable pieces and judging the result.
Testing. AI can generate unit tests and test data quickly, which is valuable. But tests written by the same system that wrote the code can share its blind spots. Human-designed test cases for critical behavior remain essential.
Review. Code review becomes the main quality gate, and the volume of code to review increases. Teams need to keep changes small enough that reviewers can genuinely understand them.
Operations. Software that includes AI components has to be monitored for the quality of its outputs, not just uptime, and many systems now improve continuously from real-world use. Code, data and models together become a living system rather than a finished artifact.
The wider convergence around the code
The changes are not limited to the editor. Cloud platforms provide the compute and managed model services that AI features depend on. Edge devices and IoT sensors generate the data those systems learn from. Security teams have to defend applications that now include models, prompts and data pipelines alongside ordinary code. Software engineering is the discipline that ties these pieces into systems that work, which is why the boundaries between developer, data engineer, cloud engineer and security engineer are blurring.
What stays human is deciding which problems are worth solving, how a system should behave and what ethical and legal limits it must respect. AI can propose designs and generate code, but it cannot own the consequences. The engineers who thrive treat AI as a collaborator and keep that ownership firmly with themselves.
The new risks: quality, security and supply chain
AI-generated code introduces specific risks that engineering and security leaders should plan for:
- Plausible but wrong code. Generated code often looks correct and compiles, but mishandles edge cases, errors or concurrency.
- Insecure patterns. Assistants can reproduce common vulnerabilities, such as injection flaws, weak input validation or hard-coded secrets, from the code they learned on.
- Hallucinated dependencies. Models sometimes suggest software packages that do not exist. Attackers have begun registering such names with malicious code, a tactic researchers call “slopsquatting.”
- Larger changes. Because producing code is easy, changes grow. Larger changes are harder to review and more likely to fail in production.
- Data exposure. Pasting proprietary code or credentials into unapproved AI tools can leak intellectual property.
Guardrails for AI-assisted engineering
Engineering leaders can capture the benefits while containing the risks with a few concrete practices:
- Approve tools and set data rules. Choose AI coding tools with business terms that protect your code, and define what may never be shared, such as secrets and customer data.
- Keep humans accountable for every merge. The engineer who submits AI-generated code owns it and must be able to explain it.
- Keep changes small. Set expectations for change size so reviews stay meaningful.
- Automate security checks. Run static analysis, secret scanning and dependency verification in the pipeline, and block packages that are new, unknown or unverified.
- Measure delivery outcomes, not activity. Track lead time, change failure rate and defects rather than lines of code or number of AI suggestions accepted.
- Invest in fundamentals. Architecture, testing and review skills become more valuable, not less, when code is easy to generate.
For a look at the tools themselves, see new developer tools are reshaping software development, and for the human side of the shift, code, culture and the future of work.
Frequently asked questions
Will AI replace software engineers?
It is changing the job rather than eliminating it. Routine coding is increasingly automated, while problem definition, architecture, review, security and understanding the business become a larger share of the work. Engineers who use AI well will likely outpace those who do not.
How do we know if AI coding tools are helping our team?
Measure before and after on delivery metrics such as lead time, change failure rate and defect rates, alongside developer feedback. Self-reported speedups alone are unreliable, as the METR study showed.
Is AI-generated code a licensing risk?
It can be. Some tools offer filters that block suggestions matching public code, and some vendors offer contractual protections. Review your vendor’s terms and keep your normal open-source license checks in place.
Engineer the convergence deliberately
Delana Technologies helps engineering teams adopt AI coding tools safely, build AI into their products, and modernize the cloud and delivery pipelines underneath. Learn about our AI consulting services and cybersecurity and compliance services, call 239.414.5126 or contact us.
Sources: Stack Overflow 2025 Developer Survey (July 2025); METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity” (July 2025); Google Cloud DORA, 2024 Accelerate State of DevOps Report.