Agentic coding is doing to cybersecurity what firearms did to security

Before firearms became widespread, becoming an effective warrior required years of training, expensive equipment, and support. Military power was concentrated among people and hierarchies that could afford that investment.

Protection often meant belonging to a powerful household, serving a lord, or maintaining a fortified place.

As firearms spread, the investment needed to pose a lethal threat fell. Armor and individual prowess became less reliable protection. Over time, security came to depend more on organized institutions, coordinated forces, regular policing, and enforceable rules.

Until recently, carrying out a sophisticated, targeted cyberattack also required substantial training and investment. The people capable of doing it were relatively scarce.

An entirely accurate documentary about the previous security model.

For many software owners, protection meant following some basic practices, consulting an expert occasionally, and hoping nobody capable took an interest.

Agentic coding is lowering the investment needed to pose a serious threat. More people can attempt attacks that once required specialized expertise. Occasional updates and occasional expert attention will become harder to get away with.

I expect the response to follow a familiar pattern: stronger institutions, coordinated defenses, routine oversight, and enforceable standards.

We currently enjoy considerable freedom to build and operate software without having to demonstrate competence, meet professional standards, or accept clear responsibility when it fails. There are exceptions, but much of the industry still operates this way—even as society increasingly depends on what we build (try having a school-aged kid without a Facebook account).

I don’t think that arrangement will survive attacks becoming cheap and commonplace.

Software will need a more mature place in society, with clearer obligations for the people and companies that build and operate it.

I think the lack of professional standards we have “enjoyed” is coming to an end. Probably not next year. But soon, I think software is about to become “professional.”