Defence might actually be your best offence in the agentic era

Defence might actually be your best offence in the agentic era

Agentic development promises something that has always been out of reach since the dawn of software development: infinite parallel development.

More agents = more code = more value?


And at first glance, this looks like a promising reality that could be solved by simply adding more compute. But in practice, something else happens.

As agent output increases, human capacity to review, understand and take responsibility does not. Throughput plateaus. Not because agents are slow, but because humans remain the final point of accountability. This is sometimes referred to as part of the AI productivity paradox or the human-in-the-loop constraint.

The illusion of adding “more AI”

Adding AI initially increases output and this is where most of us are right now in the AI era. Everyone becomes a bit more effective and feels boosted by having these AI tools as partners.

But eventually, expectations will adjust. A new baseline will be established. And unless the human side scales at the same rate, overall throughput stabilizes again. We have not removed the human bottleneck, we have only moved it.

In fact, adding more agents without changing our responsibility model will most likely increase friction. More output queues up behind the same human reviewer, who then feels pressured to constantly produce more, rather than seeing reduced workloads. The system feels faster because code can now be produced at lightning speed, but at the end of the day we deliver no more value than we did before and the only way we can actually increase productivity is, and here's the paradox, by adding more human reviewers.

This is where many organizations misdiagnose the problem. They assume the answer is more or better agents. But in reality, the constraint sits elsewhere, ultimately because:

Agents can generate code, but they do not,
yet, own the consequences.


When something breaks, leaks data, introduces risk or causes unintended system behaviour, responsibility does not fall on the agent. It falls on the organization that allowed the change to reach production.

As long as that responsibility is owned directly by humans through manual review and sign-off, scaling production will always hit a ceiling.

Defence as a scaling enabler

Traditionally, defence mechanisms like review, compliance, security and risk management has been seen as somewhat of a necassary brake in the software development cycle. Crucial, but slowing things down.

In an agentic world, defence could actually 
become the scaling enabler.


If defence could be systematized to the point where it can take full responsibility for agent output, then production would no longer need to wait for human review. Humans would only be involved when something is genuinely uncertain. 

This shifts defence from a pure cost center and safety mechanism to a scaling enabler. Human review shifts from being a bottleneck to become the exception handler.

Imagine a system that continuously assess whether agent-generated code behaves within acceptable boundaries. If such a defensive service could credibly take responsibility for agent outputs, production could scale almost indefinitely (in theory).

The reality as it stands

The critical requirement for this model to work is that the defensive layer must take full responsibility. Not 95%. Because as long as humans are needed to catch the final 5%, the human bottleneck remains.

Today, we are not there yet. There are many services out there that we can use for scanning code vulnerabilities, dependencies and perform automated security testing, but none that take full responsibility if something goes wrong or is overlooked. The responsibility usually sits on the DevSecOps teams, not the actual agent.

I believe most AI vendors today are making it way to easy on themselves by focusing purely on developing agents that write better code with no accountability for their output. 

I would argue that improving agents’ ability to write better code will have diminishing returns if they remain unable to take responsibility for the consequences of that code.


But it would not be surprising if this becomes the next major focus area for large AI vendors and services. If agentic development is to scale meaningfully, responsibility itself may need to become a product.

Who knows, Responsibility as a Service might be the next big thing.
Otherwise, we may be heading toward another productivity plateau.