AI Integration in Software Development | swampUP 2025

Hey everyone. We're back here at our Swamp Up 2025 coverage, a beautiful Napa Valley. We, we haven't started drinking the wine yet, so don't worry it's early.

But let me introduce you to our next, uh, guest here on Tech Drunk tv. To my immediate left, uh, kind of a VIP guest here. I hope I get his name right, 'cause he's the VIP Tar Tarik Shock.

Perfect. Thank you. Great to be here.

Tarik Welcome. Tarik is the CEO of Sonar, and if you watch Text Drunk TV or read any of our sites in Sonar and Sonar Source and everything, he is a pretty well known brand and company we cover. So thank you.

But I don't think I've had the pleasure of interviewing Tarek before. To my far left, I've the pleasure of interviewing him many times. My friend, gal Marter of of Jfr.

Gentlemen, welcome to techron tv. Thank you. Thank you.

Great to be here. So, Tark, you're the VIP guest. We're gonna let you go first.

You are up on the keynote with, with Shlomi this morning, along with, uh, folks from Nvidia and Service Now. Yeah. You know, I wrote a little article that's, I think it's up already, but, um, you know, my mom always told me, show me your friends.

I'll show you who you are. Right. And, um, where it's Lived by.

Yeah. Yes. And, and so that was a great grouping of, of companies up there as the CEO of Sonar.

Let's start there. Talk to us about the relationship with j Rog. How you're working together, how you're working with Nvidia and some of these other companies as well, and why that's important for our listeners and readers and watchers here.

Well, um, again, thanks for having, having us on. I think, you know, we were super, um, fortunate, very grateful, uh, to Shlomi for the invitation to join today. And, and it really what you saw on stage with Sonar, with Jfr service now, Nvidia really is this AI world.

It's like a complete lifecycle of the software, uh, of software development, right. Um, from a sonar standpoint, we start with, Hey, you are writing the code. You're a developer, you're writing the code, you're checking code in.

How do you make sure that that, um, code is high quality, whether a developer writes it or AI is writing it, or some combination you are then, um, uh, basically giving it to Jfr to build the artifacts and to secure them and to make sure that these are, you know, that they're rock solid for you. And to provide the evidence that these are great. And doing that in concert with, um, with ServiceNow and with Nvidia, you know, NVIDIA's powering all of this, but also an amazing software development shop in its own.

Right. Right. And so, so we really did think, uh, one of the expressions that Sami had as CEO of Jfr was, um, too integrated to fail, right?

And I think for us, the, i the idea of, you know, we're trying to serve our customers, the customers don't want silos. They want something that just works. And that's why we were here.

That's why Soner is here. And I think I speak for the others why they're here as well. I love it, gal.

You know what I, I stood I made like, just because I know you doesn't mean everyone out there helps you. Let me give you a chance to introduce yourself and your role at J Rog, and then we'll come back to what Tarek said and, and kind of show that up. It's True.

So I'm Gal Marder, I'm the Chief Strategy officer for J Rog. And, and the connection to what Tarik said is, uh, among other things, I'm responsible, uh, for the partnerships with other vendors, uh, within our industry, and we're honored to have Sona with us Thank you, at oneo this year. Absolutely.

Now, Shami said a few things up there. One, you know, that kind of struck with me. One was the single record, single source of record, but two, what he was really talking about is when you look five years out, and look, I'm not crazy enough to think I know what's going to be five years out.

None of us are not the way things are going now. Right? Right.

Lucky if we could see what's gonna happen at the first of the year. But if you look five years out, it, it's, it's not gonna be one company that's your AI company, even Nvidia, for as great as they are. And, and, and their greatness is more, almost as much in their software as much as it is in their chips.

Yep. But even Nvidia, you are going to need, it's gonna take a village to run tomorrow's development shops to run tomorrow's enterprises that are AI powered, that are AI enabled, that are like turbocharged, if you will, with ai. And that's why I think it's important, breaking down those silos, right?

com. But this is more than just breaking the traditional DevOps security silos. This is really bringing the whole business together.

Right. And that's why it's critical how beyond, you know, nice words up on a stage, where does the rubber meet the road? I mean, I think you have, at the end of the day, you need the people who are building the software to actually change the way they're doing something, right?

And to actually, um, to, to actually understand the changes that are happening from ai, from all these things and, and really kind of adapt. And so, you know, the, the, the notion we call, we, we call this sort of idea of vibe, then verify that we are talking about, which is you use AI and you have to have the qu the assurance steps. You need to have the evidence, you have to have all these other pieces.

That's the verification element. And you're exactly right. This is, is not, there's some companies out there that are just saying, Hey, it's our platform and nobody else, right?

And I don't, I don't believe that. I won't speak for gout, right? But, but we think that, you know, we, we believe that we are really good at what we do.

We invest a lot in it. We've got several hundred people who do nothing but think about code quality and quality assurance and code security in these areas. And we think that that is great.

I have zero expertise in artifact management, right? Um, or in what ServiceNow does in the ITSM world of things like that. So in order to get the value, I think you have to go to the best of breed.

And this is what we're hearing is that people are trying to consolidate not to one platform, but to a series of breast of breed, um, uh, capabilities that work well together. So I I, I definitely agree and I, I think that, you know, you said vibe, but verify. I, I love it by the way.

Thank, uh, but, but there are, uh, different aspects of software development. And the first thing that AI did was around vibe coding. And, you know, uh, no one right now codes by themselves, right?

Everyone has agents, some giving it more responsibility, others less responsibility. But the reason that we even give it a chance, gave it a chance, it's not a chance anymore. A AI is here, writing code is because we had this mechanism that allowed us to distill the verification process in it, right?

You had this vibe coding, then some kind of a pull request to a, a, a giving. This is the control point. And then, uh, a tool, a great tool like Sonar can come and verify the quality of the code and security and, and whatever it will be.

But we know, we all know it's the beginning of the journey. You said we don't know where, where it'll end up. But we already start seeing that journey extends not only to coding, but also to the release process.

Yes. So I have no doubt in my mind that we're gonna see pipelines like CICD pipelines changing to, um, include some aspects of AI making decisions or maybe orchestrating the whole thing altogether. I don't know, as you said.

But in order to allow that, we must have the same level of trust and control points in order to allow and delegate this responsibility to ai. And what I mean by that, that goes back to what you said as a system of record. We have the system of record for coding.

We now need to have the system of record for the release process itself. And I think this is what we're doing together. That's right.

Like, yeah. Sonar is, uh, giving us the, the, the, the results of their scanning, signing them, and then connecting them to the actual artifact where being there, the system of record to track these artifacts and verify at any stage all the different things that you need to, uh, verify. So no one will get into, nothing will get into production if sonar, for example, says that the code quality is not, uh, high enough, or if any other criteria is Not met, is not met.

And and I think that, just to build on this for one second, I think that this is becoming critical. We are past, you know, two years ago, there may have been a lot of magical thinking in the AI world, right? Of this is all gonna be perfect and no one's gonna have to worry about it.

And, you know, everyone will be out of a job and all this stuff. I think now we're realizing that, that the lack of trust, the lack of assurance, actually becomes an inhibitor to the adoption of AI inside of any responsible enterprise. And that's why this is, we think so important.

I I, I will tell you, you know, over the course of my career, I've seen a lot in technology innovation, the internet itself, probably much like you guys, we've seen the internet itself come and cell phones and cloud and, and a lot of these innovations they focus on, okay, I'm gonna code better or secure. I've been in security 25 years myself. So we, I've seen a lot move from network security to cloud security to endpoint security.

And we still don't do every of any of it, right? But, you know, but I've seen all of these things. Yes.

However, this ai, meaning this is so different 'cause it affects from here to there, right? I, I really think Satin at Microsoft said it best couple, maybe a month or two ago now. And he said, we are moving from becoming software companies to intelligence engines, right?

Where, you know, mark Andreessen famously said, software is eating the world. It ain't the world got a, got a little digestion maybe, but it ain't the world. But now we're moving from software factories, if you will, to AI factories, to intelligence engines.

And to do that, you need no one, I don't care. As I said before, I don't care who it is, no one company. I think this is going to, this whole AI thing is going to, it's, I was a biz deaf person for a lot of years, right?

I, chief strategy officer, all those things. This is gonna be the greatest thing for business development and strategy because who your partners are not comes back to what I started with. Who your partners are are gonna determine who you are, right?

You've gotta build, you've gotta build that and, you know, soup to nuts kind of partnership. Um, Tarik, I'd like to come back to you, talk a little bit about what Sonar is doing. You know, I, I had your ct, we were talking off camera, we had Andre's side.

He was fantastic. You guys had some new news. Thank you.

What can you share with the, with the audience, anything since then? Well, there's a, I mean, we've been doing a lot. The, the core of our business is code quality, code security, code governance, right?

Yes. Really focusing on that. One thing that really interested us, um, was, okay, if the models are the code are, are the brains of these AI agents, what kind of coders are they, right?

And what we found is that most of the, or what we believe is that most of the benchmarking that typically exists around coding models, whether GPT five or four oh or clouds on at four, et cetera, they are all focused on the, what, what I call the IQ of the models, right? Just can it solve this problem? Can it solve the math Olympiad of whatever, you know, things like this.

And it kind of misses the whole question of what's the personality, right? So you never hire a developer and say, they're really smart, they suck at security, they write really messy code, but it's really smart, so let's go ahead and do it. And we couldn't find anything that talked about that.

And so one of the things we've done very recently is really do a really deep dive on, on the models and what are the personalities of these models. And what you find is that the models are getting better is a little bit of a diminishing return curve that we're seeing. But, um, this question of functional completeness is only one dimension, right?

And for example, the more reasoning that you put into the models, at least right now, what you find is actually you get not only diminishing returns, but you may actually start hurting things like security and maintainability, the mod, not to overly, um, personify the models, but they kind of overthink the problem. And so you think about this from a code standpoint, from a development standpoint, you're gonna end up with models that write more code. We've shown this quantitatively.

They're very verbose. Um, that cognitive and, and climatic complexity goes up exponentially as you have more model. I'm more sophistication in the model model.

You've got more security issues, but the security issues are not the simple things you used to find. They're the hard things. So you could be lulled into complacency.

On the security side, same thing on the tech debt side. Same thing on the, on the bug side, right? And all of this points to, hey, the bottleneck, the really hard problem.

Now, one of them at least is going to be how do you review the code, right? Um, who reviews it? How do you review it?

How do you make it tractable? So that's something we've been spending a lot of time on. I mean, we saw this, right?

5 generation, we saw syntax errors. Yes. Right?

It doesn't make many syntax errors Anymore. It will not make a spelling mistake, and it won't make a grammar mistake, really, right? Yep, Yep.

But the errors, it makes good, they be pretty bad, right? And so, and that brings the human in the loop into the whole thing, right? And, and I think that's something we're still grappling with.

Yes. Right? Is, is where exactly is that human and is that human AI assisted or because it's, you know, the more code you generate the har the more, either the more humans you need or the faster the human has to be.

Well, that's just a, and and it is, it's more complex and it's more verbose. So the job a, I don't know any software engineer who went into software development to be a copy editor for ai. Oh, right.

It's just not the core skillset of these people, Nor what's gonna make them happy. No. Nor what's gonna make them happy.

And so you need the tooling and you need the trust, and you need then the verification. I've just done all of this hard work. How do I stamp it?

How do I make sure that now I'm shipping this, whether at the code level or at the artifact level, et cetera, so that you know that it's trusted. You know, it all, it all still comes down to one word. And I learned a long time ago about software and security quality.

Yeah. It comes down to the quality crap in it's crap out and bad quality makes for bad companies. Exactly.

And I, I kind of building up on that point, we create much more code and we have to somehow verify this code faster. So it cannot be manual, of course, otherwise it won't work. And this code, you know, it's not going directly to production.

It goes through a process. And this process should be scalable enough. Otherwise we'll just create a bunch of code, but we, it'll not get to its destination.

So it means nothing. So we'll have to take the full process, the full software supply chain and make sure we apply different practices, probably AI agenda, AI practices to scale the whole, uh, the whole thing. And I think, again, this is exactly where things come, uh, uh, come together.

If we focus only on the left, it's gonna stay on the left and not get, and That's exactly right on the Customer. I love it. Hey, we're outta time.

They're giving me dirty. Looks out there. I'm sorry.

I hope you've enjoyed this discussion. It was a great discussion. T it Thank you.

A pleasure meeting you. Come back on text anytime, Anytime, anytime. Thank you so much, my Friend.

It's good to see you. Thank you. Now keep doing what you're doing.

You're doing a great job. It's A great show they're putting Here. So yes.

Always, always. Okay, we are here at Swamp Up. Check it out.

We're gonna have a full day of coverage today. Another full day tomorrow. Stay tuned.

com. Techstrong it, tech strong ai, uh, digital CXO Cloud native now, even Security Boulevard. We've got Swamp up all over the place.

I'm Alan Shimel. We're back.