The Bottleneck Just Moved to Security. Is Healthcare Ready?

AI Security Series

Laurie Voss has a thesis about where software development effort accumulates over time. Speaking at AI Engineer World's Fair, he laid it out in four stages: first the bottleneck was writing code, then it moved to code review, then it will move to operations, and finally — his five-to-ten-year horizon — it moves to security. His framing was descriptive, not alarming. But the data coming out of 2025 and 2026 suggests the timeline is compressed, and healthcare software security programs may not be ready for what's arriving.

The Economic Reality of Agentic Development

The clearest empirical picture comes from MIT and Wharton economists Mert Demirer, Leon Musolff, and Liyuan Yang. Their May 2026 NBER working paper tracked more than 100,000 GitHub developers alongside Microsoft AI usage telemetry across three generations of tooling: autocomplete, interactive agents, and autonomous agents.

The headline finding: autonomous coding agents increased commit activity by 240%. The number of projects grew 80%. Actual software releases grew 30%. The researchers frame this through what they call the weak-link hypothesis: AI productivity gains at the front of the production chain are absorbed by human bottlenecks downstream. Code is cheap. Shipping reliable, reviewed, production-safe code is not.

That attenuation is the story. And it has a healthcare security corollary.

What DORA 2025 Measured

The DORA 2025 State of AI-Assisted Software Development report added five hard numbers to the theoretical picture. These are not projections. These are measured changes in development organizations that adopted AI coding tools:

Metric	Change
Pull requests per developer	+98%
Bugs per developer	+54% (vs. +9% prior year)
Incidents per pull request	+243%
Median PR review time	+441%
PRs merged with no human review	+31%

The DORA team called the last figure — 31% of pull requests merged with no human review — the single most alarming number in the report. Net organizational output was flat. The teams that maintained strong review discipline saw 50% fewer incidents. Teams with weak review systems saw roughly twice the customer-facing incidents.

DORA also introduced a fifth engineering metric this cycle: Rework Rate. The addition is a signal in itself. Something new enough to need measuring has entered the production environment.

The bug acceleration is worth pausing on. The jump from +9% to +54% represents a six-fold increase in the year-over-year rate of defect growth. If that trend holds as autonomous agent adoption expands, the downstream security impact is not linear.

Verification Is the New Constraint

ProjectDiscovery's State of AppSec 2026 put the security dimension plainly: generation got cheap; understanding got expensive. Their report reframes the security bottleneck from detection to verification. Finding potential vulnerabilities is no longer the hard part — there are more of them than teams can process. Confirming whether a finding is exploitable in the current environment, with the current context, is now the constraint.

Aikido Security's 2026 research adds the operational reality: one in five organizations suffered a security incident traceable to AI-generated code. Sixty-nine percent found vulnerabilities in code their agents produced.

The traditional scan-and-report cycle — scan, triage, debate, remediate — was not designed for a code volume that doubles annually. When the AppSec backlog grows faster than teams can validate exploitability, the pipeline breaks regardless of how good the scanner is.

The Amazon Moment

In April 2026, Amazon experienced a 13-hour production disruption traced by analysts to an agentic coding session that misconfigured access controls. Amazon classified the events as user error. What followed was more instructive than the incident: Amazon mandated that all engineers review AI-generated output before shipping, and shortly after announced that Amazon Q Developer was being replaced by Kiro, a spec-first agentic IDE built on the principle that formal structure must precede code generation.

Kiro's core workflow requires three specification documents before any code is written: a requirements file in EARS notation, a design document capturing architecture decisions, and a tasks file of testable implementation units. The IDE also supports agent hooks — event-driven automations that fire on file save, handling tasks like security scans without manual prompting.

The significance for healthcare development teams: a major cloud vendor, after a production failure, concluded that the right answer to AI-generated code risk was not better post-hoc scanning. It was structured pre-generation governance baked into the development environment. That is a different architectural bet than most SDL programs are currently making.

Net Smart, a healthcare IT company, was among the organizations showcased at AWS Summit 2026 deploying Kiro in their development workflow. The healthcare sector is not on the sidelines of this transition.

The Healthcare SDL Gap

Software Development Lifecycle programs in healthcare were built around a human developer model. Code review meant a senior engineer reading code written by a junior engineer. Threat modeling was a workshop where humans articulated assumptions. Access control scoping assumed that the developer requesting a credential had identifiable intent, organizational role, and professional accountability.

Agentic coding breaks each of those assumptions in a specific way. Four questions expose where healthcare SDL programs are most exposed.

Who reviews AI-generated code, and at what volume?

DORA's review time increase of 441% reflects a real dynamic: reviewing code you did not write, that was generated by a system you do not fully understand, against a codebase that is growing at twice the rate it was last year, is harder than reviewing code a known colleague wrote. SmartBear and Cisco research consistently shows that defect detection falls sharply above roughly 500 lines reviewed per hour. Effective code review operates under 400 lines. When an agent generates a 2,000-line pull request, the review economics change regardless of the reviewer's skill.

Healthcare development teams operating in PHI-adjacent or PHI-touching codebases do not have the option of letting the 31% no-human-review rate into their pipelines. The question is whether current review capacity — headcount, tooling, and process — can absorb a 98% increase in pull request volume while maintaining the standard.

How should agentic tools be scoped for access?

Agentic coding tools require access to execute their work: repository access, environment credentials, API keys, sometimes database connections for context-aware code generation. The access control frameworks in most SDL programs were designed for human developers with bounded, comprehensible access needs. An agent's access footprint can be broader, less predictable, and harder to scope to least privilege in ways that do not break the agent's function.

For development environments that touch PHI-adjacent systems — patient-facing APIs, EHR integrations, claims processing infrastructure — the question of what an agentic tool can reach, and under what conditions, is not a configuration footnote. It is a HIPAA Security Rule question. The Security Rule's requirement for technical safeguards applies to systems that create, receive, maintain, or transmit ePHI. Development environments that connect to those systems, even indirectly, are in scope.

Who owns accountability when the code author is an agent?

Traditional SDL accountability is person-shaped. A developer commits code. A reviewer approves it. An incident traces to a decision made by an identifiable human. The accountability chain supports both internal governance and regulatory defensibility.

When an agent writes code, the commit still carries a human name — the developer who accepted the suggestion or triggered the generation. But the actual authorship is distributed across the developer's prompt, the agent's training data, the model's inference, and the review process that did or did not catch what the agent produced. Healthcare organizations operating under HIPAA, under state breach notification requirements, or under ONC certification obligations need to think carefully about what that accountability chain looks like in a post-incident review or regulatory examination.

The spec-driven development model that Kiro and similar tools are promoting is partly a governance answer to this question: if the agent operated within a formally documented specification that a human authored and approved, the accountability chain remains traceable. If the agent operated on a natural language prompt with no structured governance layer, it may not.

What do HIPAA development environment requirements actually require?

HIPAA does not have a specific provision for AI-assisted development. What it has is a set of principles — minimum necessary, access controls, audit controls, integrity — that apply to any technology environment that touches ePHI. The question is not whether HIPAA covers AI development tools. The question is whether your current risk analysis, as required under the Security Rule, accounts for the access patterns, data exposure risks, and accountability gaps that agentic coding tools introduce into development environments that are connected to covered systems.

Most risk analyses written before 2025 do not. That is a gap that security and compliance teams should be closing now, before an incident makes it urgent.

The Junior Developer Pipeline

Voss's closing argument was both forward-looking and uncomfortable: developers aged 22 to 25 have seen their employment decline roughly 20% from the late-2022 peak, according to Stanford research. The entry-level role that historically fed the security pipeline — junior developer who learns the codebase, gets mentored on secure coding practices, eventually moves into security-aware senior roles — is contracting.

Salesforce's forward deployed engineer postings were up 800% in 2026. That role — human with deep domain expertise who can direct, evaluate, and govern agent output — commands a median salary around $174,000. It is not an entry-level role. The career path that produced it is narrowing precisely when the demand for people who can fill it is accelerating.

For healthcare security specifically, this matters because the talent pipeline for healthcare security engineers has always been thin. The physicians, nurses, and clinical informaticists who understand both the clinical workflows and the security implications do not come from the same supply chain as general security engineers. If the junior developer path that could produce clinically-aware security engineers is contracting, healthcare organizations need to think now about how they develop and retain that expertise through a transition period that may last a decade.

What Healthcare Security Teams Should Do

The bottleneck migration Voss described is not a prediction about a distant future. The DORA numbers are from organizations operating today. The Aikido incident rate is from organizations operating today. The Amazon production disruption was in April. The question for healthcare security teams is not whether to prepare for this — it is whether to prepare now or after an incident forces the question.

Three actions are actionable in the near term.

First, update your risk analysis to include agentic development tools. The HIPAA Security Rule requires risk analysis to be current and comprehensive. If your organization uses AI coding assistants — and the DORA data suggests most organizations do — your risk analysis should account for the access patterns those tools require, the data they may touch, and the review process gaps they introduce. This is not a future-state exercise. It is a current compliance obligation.

Second, establish review standards for AI-generated code before they are needed. The 31% no-human-review rate in DORA represents organizations that did not establish those standards before adoption scaled. Healthcare organizations have enough regulatory structure — and enough downstream liability — to justify treating AI-generated code as a distinct category requiring explicit review policy. What review is required before AI-generated code is merged into a PHI-touching codebase? Who is qualified to perform it? What does the audit trail look like?

Third, evaluate whether your SDL program's access control model accounts for agentic tools. The access patterns of a developer using GitHub Copilot, Cursor, or Kiro are different from the access patterns of a developer writing code in a text editor. The IDE may be calling APIs, reading repository context, maintaining session state across files, or in some configurations accessing connected services. Least-privilege access control in a development environment now has to account for those patterns, not just for the human developer sitting at the keyboard.

The bottleneck just moved. The organizations that acknowledge it now — before the review backlog, the incident rate, and the accountability gap force the acknowledgment — will be better positioned than those that do not.

This is an entry in the AI Security series. For related coverage, see NIST's 10 Tenets for Agentic AI Identity in Healthcare.