SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)
SFEIR analysis (consulting-firm voice, "an engineer's reading") articulating two frameworks too often conflated: the **SDLC** (Software Development Life Cycle — *building the software correctly and reliably*) and the **PDLC** (Product Development Life Cycle — *building the right product and succeeding in the market*). Central thesis: the two cycles are not competitors but **nested** — the SDLC is the subset of the PDLC **housed under its development phase**; when a product team reaches the "build" stage, a full SDLC cycle (design → build → test → review → deployment) runs inside it. The SDLC is standardized (**ISO/IEC/IEEE 12207**, 2017 and 2026 editions), with its lineage of models (Waterfall 1970, V-model, iterative/spiral, **Agile 2001**, **DevOps/DevSecOps 2009+**) and its **DORA** metrics (throughput, stability, MTTR, change failure rate). The PDLC, being the umbrella cycle, runs from **ideation/discovery** to **market withdrawal** (not to be confused with the marketing **PLC** of Theodore Levitt, 1965, which describes a *commercial curve*, not *organized work*: "the PLC observes a curve; the PDLC organizes work"). **Tipping point**: the SDLC natively addresses **only one risk in four** — via **Marty Cagan's "Four Big Risks"** framework (Value → PM, Usability → Designer, Feasibility → Lead Engineer, Business viability → PM) — an organization excellent at SDLC but blind to PDLC produces "software nobody wants" — John Cutler's **"feature factory"** (success measured by output, not outcome). **Why AI changes everything**: generative AI **compresses the SDLC** (Google/JetBrains data, May 2026: **~85% of developers** regularly use coding agents, **~41% of new code** is AI-generated; implementation goes from weeks to hours), so the **bottleneck shifts upstream** — deciding *what* to build (Marty Cagan, April 2026: "when the cost of delivery collapses, the bottleneck shifts to discovery"). Consequences: DORA 2025 (~5,000 professionals, 90% AI adoption) shows a **positive correlation with throughput but a negative one with stability** (more unvalidated features means instability and rework); Andrew Ng (AI Startup School, July 2025) reports teams **reversing the "1 PM for 4 engineers" ratio to "2 PMs for 1 engineer"**; and with **spec-driven development**, the PDLC/SDLC boundary becomes **porous** (the product spec becomes directly executable by agents). **What a CIO should take away**: an augmented SDLC becomes a **market standard, not a differentiator** — the junction with the product must be instrumented, **executable specifications** demanded as input, technical metrics cross-referenced with outcome metrics, and the role of "feature supplier" **refused**. For a CPO: the shift of the bottleneck toward discovery is both a **promotion** (product judgment becomes scarce again) and a **notice to act** (industrialize discovery to reach parity with the SDLC). SFEIR's in-house framework ("Designing and building in the agentic era" — **11-phase cycle** + **Software Factory 10x**) is positioned as the answer on the engineering side, with the **articulation of the two cycles** as the next lever. Conclusion: "as code becomes a commodity, margin shifts toward product judgment and governance."
In-depth opinion piece (point of view) published on **sfeir.com** on June 24, 2026, by **Didier Girard** (Managing Director, SFEIR). **Central thesis**: in 2024 everyone was betting on **AI4Business** (AI in business processes) as the great value reservoir; by 2026 the picture has **reversed** — it is **AI4IT** (AI to produce the information system: code, SDLC, software factory) that is creating **measurable** value. The article *grounds* this thesis in the firm's tech watch: AI4Business disappointment (the MIT study "95% of pilots without ROI," contested but revealing; an **organizational** blockage / Mollick's Hayekian problem) versus quantified AI4IT evidence (Salesforce, Intercom, Raiffeisen, AWS/Bedrock, Atlassian, DORA). Mechanistic explanation: **code verifies itself** (compilation, tests, CI) whereas business processes have neither a compiler nor an immediate feedback loop. **2027 budget consequence**: a **CapEx→OpEx** shift, token price dynamics (rising peak — Fable 5 at 2× Opus — vs inference ÷280 and downward pressure from open weights/desktop), and **AI FinOps** driven by **cost per outcome**. Closes with **4 recommendations for the COMEX**.
#AI4IT#AI4Business#reversal
**Didier Girard** — Managing Director (CTO / DG) de **SFEIR** · ESN française (~1 000 personnes, France · Belgique · Luxembourg · Suisse). Auteur de l'article ; voix éditoriale du cabinet sur la transformation IA des DSI.
SFEIR article (in French) that formalizes an **AI-driven SDLC in 11 phases (0 to 10)** and argues that the industry is converging toward it. Starting observation: in 2025, organizations added AI tools without transforming their operating model — producing a paradox of « everything changes… and nothing changes » (execution speed multiplies without proportional gain). The real answer is not the choice of tools but the **redesign of the cycle** for machine execution. The SFEIR cycle rests on **three immovable human gates** (Define, Plan, Ship), automatic phases between them, and **two capitalization moments** (Compound-1 pre-deployment, Compound-2 in production) that turn lessons into reusable rules. Three principles: **AI executes** (complete artifacts + proof of execution, never trusting the agent's own claims), the **human retains control of intent**, the **system learns cumulatively**. Measured results (redesign 6 months→1 day, **−30% of iterations** after ten cycles) and claimed convergence with ADLC, Google, and DORA 2025.
Chris Williams (@voodootikigod) opens his ADLC series arguing that running the human SDLC on models is a category error: the classic cycle was designed to counter human failure modes (ego, fatigue, forgetting) that are absent in LLMs. He catalogs eight load-bearing failure modes (F1-F8) and five exploitable properties (E1-E5), and lays out the founding principle: every phase of an agentic cycle must trace back to a failure mode it defends against or a property it exploits.
An arXiv paper (cs.SE) by Martin Monperrus arguing a radical thesis for the SDLC: coding agents have crossed a threshold of capability such that **human code review is no longer a necessary component** of a quality pipeline. Two claims: (1) autonomous LLM-based systems achieve all the goals of review (defect detection, quality, compliance) at lower cost and higher throughput; (2) the hybrid model "the agent writes, the human reviews" is untenable — it does not ensure real quality and does not scale with AI velocity, creating a "false sense of security". Monperrus contrasts inspection de Fagan (1976) with a **multi-agent adversarial verification pipeline** (generator agent + independent reviewer agents + tests/formal methods + vote-based consensus). The human refocuses on the spec, architectural trade-offs, approval of critical domains, and edge cases. Recommendations: pilot first on low-risk components, measure agent vs. human, make rejection decisions explicit.
Guide by Augment Code (Paula Hingel) describing how AI agents are restructuring the software development lifecycle (SDLC), stage by stage. Thesis: AI produces **higher throughput at some stages and higher instability risk at others** — a symptom of uneven adoption without redrawing review boundaries. Draws on **DORA 2025**: AI adoption correlates positively with delivery throughput and product performance, but **negatively with stability**. Six stages revisited (Requirements, Design/Architecture, Implementation, Testing/QA, Deployment, Maintenance), three major risks (erosion of the junior pipeline, **circular validation** of AI-generated tests, governance gaps at scale) and three emerging roles (**Intent Engineering**, Agentic DevOps, AI Governance/Assurance). Actionable recommendations: audit one stage before scaling, stress-test governance, make the **specification** central, define explicit rollback policies, redesign the junior role around review.
#SDLC#software development lifecycle#coding agents
Op-ed by **Olivier Rafal** (Consulting Director Strategy, **WeNvision** — **SFEIR** group; former editor-in-chief of *Le Monde Informatique*) published on **June 1, 2026** on **CIO-Online**, structured around a **paradox**: in the age of AI, software engineering **changes everything… and nothing changes**. **What changes is the operating model.** Roles are redefined: the **Product Owner** shifts from backlog breakdown to **generating context usable by AI**; the **developer** shifts from writing code to **framing, steering, and reviewing** agent execution; **QA** gains the ability to define **expected proof** upfront. Team structure shifts from *"double pizza teams"* (hand-off chains of ~8 people) to ***"sandwich teams"***: a **tight pairing of a business expert and a tech lead, both AI-augmented**, with other skills in support. Internal **Sfeir** figure: *"this pair now drives roughly 80% of the production chain,"* the remaining ~20% (architecture, data governance, security) being centralized. Pivot quote: ***"The issue isn't a tooling issue, it's an operating-model issue."*** **What doesn't change is the discipline of the cycle.** The **SDLC** phases (define → build → verify → deploy → maintain) remain identical and non-negotiable; AI removes none of them, it **intensifies** them: ***"all the slack that human pacing used to absorb, however imperfectly, becomes, at AI speed, industrial-grade defects"*** (an amateur-vs-professional sports metaphor). Hence **three inviolable *gates*** (human control): **specification, planning, delivery review**; validation **by proof** (not by AI's own assertions); **systematic capitalization** (each cycle feeds the next) → measured result: **−30% correction iterations after ~10 cycles**. Principle: ***"the faster the execution, the stricter the framework must be."*** Concepts invoked: **harness** (agentic rules adapted to context), **vibe-coding** judged **untenable in the enterprise**. **Third pillar = governance, FinOps & value-driven management**: **variable and recurring** AI costs (~**€10/hour** per augmented role), shift from flat-fee licensing to usage-based billing (a parallel with cloud in the 2010s); **FinOps** does not aim to cut costs but to *"optimize tool efficiency"* (cost relative to value); aligning **business metrics** upfront (time-to-market, features, performance, eco-design). **Conclusion**: acceleration makes the fundamentals **non-negotiable**; the challenge is **organizational and cultural**, not technological — without securing the business relationship and collective discipline, an AI-powered SDLC only **amplifies the problems** (driving into the wall faster). Extends the WeNvision doctrine of [[rafal-wenvision-ia-generative-produit-techno-pas-projet-2024-02-23]] and [[rafal-wenvision-tokenomics-foundation-finops-ia-2026-06-04]]; converges with *systems around the model* dropbox-okumura-beyond-code-generation-engineering-productivity-ai-agents-2026-05-28, *harness engineering* osmani-agent-harness-engineering-2026-04-19, agentic Salesforce, and the *agent manager* debate (BFM/Girard, SFEIR).
**Olivier Rafal** · *Consulting Director Strategy* chez **WeNvision** (groupe **SFEIR**). Ancien **rédacteur en chef du *Monde Informatique*** · et auparavant consultant analyste du marché IT (~10 ans). Tribune publiée dans la rubrique *Tribune* de **CIO-Online**. Publié le **1er juin 2026**.