Hi everyone,

When was the last time there was a quiet news day? Keeping politics aside, the rapid changes in the generative AI space seems to be doing more than its share over the last 6 months or so. As an architect that has dabbled in the InfoSec space over the years, it does feel almost like the AI companies (OpenAI and Anthropic in particular) have discovered how to split the atom. Not to create a super weapon, at least I hope not, but just to see if they could.

As we are still dealing with this first-order consequence and learning how to embrace it, the second order consequences are slowly coming about, and that will take some time to address. For now, we’ll focus on just the first order ramifications from the post-acquisition integration side. For a look at the second order, here’s a post from over the weekend.

Just like fission, there are positive and negative impacts. With the rapid rise of Codex and Claude Code, it is now possible for someone with no technical background to throw together a working prototype to demonstrate functionality and get a PoC out there rapidly. For those who do have technical abilities, it allows them to multiply their productivity going from 1x to 10x and 10x to who knows where. From a productivity standpoint, this is a complete game changer.

To describe the negative impacts, it helps to understand the concept that source code is ultimately a recipe for the computer. When you are staring out or keeping it simple, it is easy to keep everything in your head. Over time, it can become quite complex, and then you begin to lose track of how certain parts work. For humans, this is where we spend more time trying to review and we can still make mistakes. For the generative AI, this is where they also struggle and can make mistakes. There is a difference for now: as humans, we know where our limitations are, and when to look up or ask for help. For the generative AI models, there is no failure mode. If it doesn’t have a good answer, then it will make it up as it goes along. Unless you have some technical expertise, you will not catch this failure mode until you run the program and wonder why it doesn’t behave as expected. You can try to fix it by generating more code, and it may appear to work, but then something else unrelated breaks.

Now, we can go back to the original concept I teased at the beginning. From the post-acquisition integration standpoint, I do see the generative AI coming in real handy for speeding up the creation of the migration programs needed to on-board the new users and data into your systems. For simple migrations, this is something that your team can do without needing an expensive consultant or firm such as mine.

Here’s the but: it won’t be the most efficient (will take several days instead of hours), and it may not account for all of the business processes that have been built up over the years. It may even help with the necessary modifications to make the apps being conveyed work in your environment, but will your team know or understand how much of the changes are necessary and if they are safe/secure?

Lastly, as a teaser into the second order consequence, as we begin to experiment and start utilizing agents to interact with various systems on our behalf, these pose new challenges from how we handle them from an identity standpoint (are they users, are they apps, are they admins, etc.). Once we move beyond the PoC phase for these new patterns, they begin to pose challenges on how we authenticate them, how we authorize their access, and from my standpoint, do we bring them over, and how.

Let me know what you think by hitting reply!

Cheers, Chris