In this Help Net Security interview, Itamar Friedman, CEO of Codium AI, discusses the integration of AI into DevOps practices and its impact on software development processes, particularly in automating code review, ensuring compliance, and improving efficiency.
Despite the benefits, challenges in incorporating AI into software development persist, including concerns around data privacy, skill gaps, and model consistency, which must be addressed through policies and ongoing skill development.
How is AI integrated into DevOps practices, and what are the most significant changes you’ve observed in software development processes?
AI tools are now used to automatically review code for bugs, vulnerabilities, or deviations from coding standards. This development helps to improve code integrity and security while decreasing the need for manual intervention and minimizing human error.
Additionally, AI systems can now enforce compliance requirements such as PRs being linked to a specific ticket in the project management system. They can also make sure that changes are automatically documented in the change log and the release notes documentation. Lastly, AI tools can automatically locate, diagnose, and translate to natural language, and respond to CI/CD build issues in real-time, often also resolving them without human intervention.
These changes have led to increased efficiency and speed in coding by automating repetitive tasks, which in turn reduces development cycles, and costs and accelerates time to market. It’s also improved the quality, compliance, and reliability of software through automated testing, documentation, and code reviews, ensuring higher-quality code with fewer bugs.
What are the primary challenges faced when incorporating AI into software development and DevOps, and how can these be addressed?
Incorporating AI into software development and DevOps still poses challenges we need to overcome.
Most AI services are cloud SaaS so there are multiple risks in the area of data privacy and security. In addition to the normal risks of data leaks and breaches, which can be mitigated by ensuring vendors comply with appropriate standards like SOC 2, there are several generative AI-specific concerns. One potential issue is that your proprietary data can be used to train an AI model, and ultimately be leaked by the model in the future.
Similarly, if the AI tool you use was trained on another organization’s proprietary data, that IP can be leaked in generated code and can end up in your code base. Clear policies around data retention and use in training are crucial for mitigating these risks.
Additionally, we can’t forget that LLM technology is still new, and as such there are gaps between existing skill sets and the expertise required. AI systems are not optimized when used in a 1-shot manner — they require iterations with its human operator to get the best of the tool, and this has to be conveyed and reflected in the organization processes.
Lastly, model capabilities need to become more consistent to mitigate liability. Currently, model capabilities don’t fit for systems that require close to zero errors without a human in the loop, and systems where you need ownership of the processes.
What skills should software engineers focus on developing to work with AI-driven tools and environments?
Software engineers need to develop not only technical skills but also an understanding of how to effectively communicate with AI systems and integrate these interactions into organizational workflows, here are the main two skills needed:
1. Iterative learning and interaction with AI: Understanding that AI tools and models often require iterative feedback loops to optimize performance. Engineers should be skilled in working with AI in a way that involves continuous testing, feedback, and refinement.
2. Improved prompt engineering: Developing proficiency in crafting effective prompts or queries for AI systems is critical. This includes understanding how to structure information and requests in a way that maximizes the AI’s understanding and output quality.
How is AI influencing secure coding practices among developers, and what are the implications for software security standards?
Mitigating security issues early in the software development lifecycle leads to more secure software. Automated vulnerability detection, powered by AI, enables real-time analysis of code for potential security issues, reducing the reliance on manual code review that is time-consuming for developers and prone to human error.
Relying on cloud-based solutions requires the organization to plan the usage of these tools in correspondence with its own security and IP guidelines to ensure full compliance. Some companies may only use on-premise models, others may put a threshold on the amount of code that can be completed (to avoid IP infringement), while others may request SOC 2 and zero retention policies. The risks companies face when using cloud-based SaaS AI solutions require more attention.
With the acceleration of software development cycles through AI, how can organizations ensure that security remains a top priority without compromising development speed?
Organizations should adopt several strategies, including continuous security monitoring, automated compliance checks, and secure AI operations.
Utilizing AI-driven security monitoring tools that scan for vulnerabilities and compliance issues throughout the development and deployment process will be vital. These tools can automatically enforce security policies and standards, ensuring that security considerations keep pace with rapid development cycles. This needs to be coupled with a concerted effort to ensure that the AI tools and models themselves are secure and in keeping with the best deployment strategy for the specific organization (on-prem, in the cloud, etc.) and will keep organizations aware of risks as they arise.
Organizations shouldn’t abandon regular security procedures such as: (a) Educating developer teams on secure practices, and the potential risks associated with AI tools and (b) Maintaining regular security assessments and penetration testing which are crucial to uncover vulnerabilities that AI or automated systems might miss.