AI at Work: A Reality Check for Engineering Leaders
The Early adoption of Generative AI sped up first drafts but in many organisations it has also increased security risk, technical debt, and hollowed out the junior talent pipeline.
Generative AI delivered fast prototypes in 2023–2025, but most pilots didn’t translate into measurable business value. Forbes
AI‑generated code introduced security flaws in nearly half of tested tasks, with some languages far worse. The Register
At the same time, entry‑level hiring and on‑the‑job training opportunities for new engineers have contracted, threatening the talent pipeline. The Generative AI has brought seniority-based disproportionate change. Harvard Paper
Is LLM a Logical Land Mine ?
Most pilots fail to deliver ROI: MIT’s Project NANDA found that about 95% of enterprise GenAI pilots did not produce measurable P&L impact, with only about 5% scaling to meaningful revenue or efficiency gains. MLQ.ai
Security is a major blind spot. Veracode’s 2025 GenAI Code Security Report tested 80 curated tasks across 100+ models and found vulnerabilities in 45% of AI‑generated code; Java showed failure rates above 70% in some tests. Veracode
Quality and review burden rose. Analysis of real PRs shows AI‑coauthored pull requests contain ~1.7× more issues (≈10.8 vs 6.4 issues per PR), with higher rates of critical and major defects. Business Wire
Technical debt is systemic. CAST’s global study of >10 billion lines of code estimates organisations would need 61 billion workdays to remediate accumulated technical debt; nearly 45% of code is classified as fragile. CAST
Junior hiring and early‑career roles are shrinking. Multiple analyses, including Stanford/ADP work, show significant declines in employment for younger workers in AI‑exposed roles, reducing the pipeline that trains future senior engineers. ADP Research
Key Takeaways
Short‑term speed often masks long‑term cost: Faster first drafts can create more review, remediation, and security work downstream. Metaphorically, you're asking the AI to build a Bhurj-Khalifa on a Seismic Zone 5 based on no practical knowledge and standard materials.
Sustained governance matters more than model size. Larger models didn’t meaningfully reduce security failures in Veracode’s tests. Veracode analysis reveals security performance pass rate across programming languages: Python: 62% ; JavaScript: 57% ; C#: 55% ; Java: 29%. Veracode
Talent strategy is a risk vector: Cutting entry‑level hiring saves payroll now but starves future leadership and institutional knowledge. Former Nestlé CEO Peter Brabeck-Letmathe often recalls his formative years in the company’s ice cream sales division in Vienna, suggesting this early proximity to the customer gave him insight that has proven invaluable later in his career. IMD
Quick playbook for leaders (3 actions)
Treat AI output as a draft: Mandate additional architectural reviews, classify the Services (AAA+, AAA, AA), automated SAST/DAST, human sign‑off gates and additional checks as mandated by Service classification before merge.
Measure full lifecycle cost: Tokenmaxxing is not a badge of honour. Track maintenance hours, security incidents, and debt remediation alongside delivery speed.
Protect the pipeline: preserve onboarding tasks for juniors, formalise mentorship, and measure hiring funnels.
Comments