From Vibe Coding to Verified Engineering: A Realistic Look at AI in the SDLC

We’ve all heard the sales pitch. “AI will automate every stage of the SDLC.” “Vibe coding will change developers’ lives.” “AI in the SDLC will make development both faster and cheaper — no more choosing between the two.”

So, why are AI adopters seeing a rise in change fails and rework rates?

That’s the AI paradox for you. On the one hand, task throughput per developer goes up (+33.7%, according to a Faros report). So do epics completed (+66.2%) and PR merge rates (+16.2%). On the other hand, weekly deployments dip (-11%), and tasks get stuck “in progress” for longer (3x).

We probably don’t need to tell you: AI can’t do everything. AI-assisted software development can become a net positive only if you use it selectively, with human-in-the-loop validation, governance, and measurable productivity outcomes.

That’s exactly how we use AI at Exoft. Here are our lessons learned about the value of AI in the SDLC process, its potential risks – and the absolute need for human oversight.

How the Use of AI in the SDLC Has Matured

In 2026, it’s pointless to debate whether AI can generate code, documentation, tests, or deployment scripts. The real debate is where AI truly improves the software development lifecycle — and where it causes products to crash once they pass the 10,000-user threshold.

For better or worse, generative AI is now in the “trough of disillusionment,” as Gartner put it in its 2025 Hype Cycle. A year later, agentic AI in the SDLC sits at the “peak of inflated expectations,” with over 60% of CIOs and tech executives expecting to add AI agents to their toolkits.

As it’s often the case, there’s a kernel of truth under all the hype. For example, Morgan Stanley saves 280,000+ developer hours a year by automating reverse engineering for legacy code. Faire, Spotify, Canva, and Zapier also found AI use cases that save time and cut costs.

What separates companies that see >30% productivity gains from AI in the SDLC from the rest? According to BCG’s 2025 analysis, they:

• Use SDLC-specific agents and copilots instead of general-purpose chatbots
• Scale AI across SDLC phases, not just coding itself
• Proactively manage change by redesigning ways of working

As CGI highlights, implementing the AI software development life cycle requires proper governance. Plus, you need to be aware of the genuine limitations of each tool, like false positives and weak domain knowledge in AI testing tools.

Exoft’s takeaway: Select the right use cases instead of embedding AI everywhere “just in case.” For example, we turn to AI tools only in scenarios where their ROI is well-established.

AI in Requirements Gathering and Planning

How AI helps (really):

• Extracting requirements from natural-language documents, code comments, and legacy codebases (e.g., ReqSpell) or audio notes (e.g., Aqua)
• Structuring them into product requirement documents (PRDs)
• Aiding in requirements discovery (e.g., through app review synthesis)
• Analyzing requirements’ quality against industry standards (e.g., IBM Engineering Requirements Management)

Reality check: A 2025 systematic literature review identified three key barriers to AI adoption in requirements engineering: reproducibility, hallucinations, and interpretability. AI tools may make things up or produce inconsistent output, so human review and approval are still a must.

What remains human-owned: Prioritizing requirements and ensuring stakeholder alignment can’t be automated away, no matter how smart your AI tool is. Plus, while AI tools speed up content-heavy tasks like document synthesis, they don’t save time on content-light tasks (data gathering, presentations).

How we use AI at Exoft:

• Upstream, Claude helps us analyze user requirements and translate end-user needs into basic software functions. It also turns natural-language requirements into structured PRDs, saving our BAs and PMs valuable time.
• Downstream, Atlassian Rovo streamlines our work in Jira or Confluence. For example, it helps our BAs and PMs create tasks from briefs or quickly find information.

AI in Design and Architecture

How AI helps (really):

• Providing design recommendations (e.g., service decomposition, fault detection, resource scaling for microservices architectures)
• Generating design rationales (DRs) with explicit trade-off comparisons
• Creating first drafts of architectural decision records (ADRs)
• Producing architecture visualizations
• Generating documentation for UI/UX and frontend handoff
• Identifying baseline threats and novel threat scenarios and creating first drafts of threat models from technical design documents

Reality check: AI-driven architectural analysis and generative design remain an evolving field, for now. Microservices design recommendations, for example, struggle with distributed transactions and security. AI-generated ADRs aren’t as good as human-written ones yet. AI threat modeling, in turn, underperforms in negative pattern recognition.

What remains human-owned: Software architects review and improve upon AI-powered design suggestions and threat models, as well as all documentation (DRs, ADRs, etc.). They also make the final architectural decisions.

How we use AI at Exoft:

• Claude generates first drafts of design rationales and STRIDE threat models to help our architects analyze trade-offs and ensure security-by-design.
• Eraser generates diagrams from code written in Mermaid or PlantUML.
• Figma Make helps our UI/UX designers quickly iterate through wireframes and prototypes.
• Claude-Figma MCP integration enables Claude to take design context into account and Figma to support natural-language commands.

AI in Development and Coding

How AI helps (really):

• Accelerating development with AI code generation (55% faster task completion in the GitHub study, 21% in one involving Google developers)
• Explaining unfamiliar code (e.g., APIs) and summarizing logic for new developers (more effective than traditional search-based information seeking methods)
• Reducing context-switching during maintenance work on unfamiliar code and domains
• Scanning the generated or written code for signs of security and quality issues (in combination with human review)

Reality check: More developers distrust AI output (46%) than highly trust it (2.7%). Why? Well, AI-generated code may ignore edge cases, contain security vulnerabilities, or have zero database optimization; we wrote a whole guide to these mistakes.

What remains human-owned: Human oversight is crucial in AI-accelerated software development, and that’s what separates mature AI use from vibe coding. Developers review AI-generated code for security, legal compliance, stakeholder alignment, etc. They also decide when to generate code and when to write it — and what ships, too.

How we use AI at Exoft:

• Claude Code is our tool of choice, although we’ve also worked with secure, internally hosted AI development environments set up by our clients. Claude Code remains our preferred tool as it can streamline multi-file refactoring with Agent Teams orchestration.
• CodeRabbit, SonarQube, and GitHub Copilot Code Review are our layered safety nets. These code quality and security review tools pinpoint hidden vulnerabilities or quality issues in the generated code before our developers give it a final review.

AI in Testing and Quality Engineering

How AI helps (really):

• Turning requirements into test scenarios and cases
• Generating unit, API, UI, and regression tests, including self-healing scripts to improve test coverage and accuracy
• Predicting defects and identifying risks, a nascent use case (17.7% vs 60.7% for test case generation)
• Automatically detecting flaky tests and identifying root causes for their instability
• Providing suggestions for edge cases and test coverage during exploratory testing
• Summarizing failures during tests
• Generating structured testing reports
• Prioritizing risk areas for testing, including based on recent code changes

Reality check: AI-assisted testing entails redundancy, accuracy, and reliability risks. For example, LLMs may generate test cases that seem plausible but are in fact functionally incorrect or unoptimized. Generated tests may also lack context and miss edge cases.

What remains human-owned: As AI-assisted code quality engineering is still in its early stages, QA and product teams must validate that test scenarios align with real workflows and business intent. They also set the “definition of done” and quality thresholds and triage test failures and flaky-test patterns.

How we use AI at Exoft:

• Playwright’s Planner generates test plans, Generator turns them into test files, and Healer executes test suites and repairs failing tests.
• Appium’s AI self-healing helps us test mobile apps. The agent automatically detects UI changes and updates locators without interrupting test execution.
• Integrated with Claude Code, Postman streamlines our API testing. It automates collection, parses results, identifies the failed requests, and suggests fixes.

AI in DevOps and Release Management

How AI helps (really):

• Predicting build outcomes, defects, and release readiness using ML models
• Selecting and prioritizing tests based on recent code changes and predicted outcomes
• Analyzing test failures and identifying potential root causes
• Monitoring builds and tests in real time for deviations from expected performance
• Automating incident response and investigation (e.g., AWS DevOps agent users report up to 80% faster investigations with 94% root cause accuracy)
• Providing suggestions for optimizing CI/CD configuration

Reality check: As AI turns deployment into a weekly event for most organizations, toolchain sprawl and inefficient processes also slow down DevSecOps professionals by 7 hours per week. The implication? You need to rethink the operational framework for AI to save time.

Conclusion

AI isn’t a silver bullet that can magically halve development time. You need a comprehensive AI software development framework to turn it into an actual productivity enhancer. That framework should embed human oversight and guardrails alongside AI tools across the SDLC.