Where is Security's "Great Leap Forward?"

If your social media doom-scroll of choice is LinkedIn, you've doubtless been hit by a wave of hot takes about how Anthropic's Claude Code and OpenAI's Codex are the "canaries in the coal mine" for the death of SaaS. I won't be musing on that though.

I've been "AI-pilled" for a while regarding white-collar jobs and wages. When I'm asked, I parrot something like: if it took a team of ten, it'll now take five. But reading Matt Shumer's "Something Big is Happening" recently gave me some existential Sunday scaries. He describes how software engineers have seen their entire workflows change in just the past few months; they find a majority of their time is spent chit-chatting with a coding agent in natural language instead of writing code.

Shumer essentially is describing a "Great Leap Forward". The title is a wink. “Great Leap Forward” is a loaded phrase, and I am using it in a narrow, literal sense: the leap we are watching in software development, and the editorials arguing it is a preview of how other white-collar work gets reorganized next. That is as far as the analogy goes!! This is not a central authority forcing change. It is the market pulling it forward. I keep the word “leap” because it captures two things at once: a change in kind, not just in degree, and the uncomfortable truth that leaps can carry latent disaster and unintended consequences. All the vibes one gets from the now viral Citrini Research/Doomsday paper. I've read some interesting counter points to the more doom and gloom aspects of these pieces and I'm a bit more optimistic… but the revolutionary change they describe feels real.

And change for the software developer role is real. I'm seeing these workflow changes for devs occur in realtime within my own company's engineering workforce. A close friend of mine (masters in C.S and a FAANG SWE) described the phenomenon of making coffee and eating lunch while his development objectives were being choomed away by an agent burning tokens and following his instructions carefully. He is still in disbelief about how his role has changed. On a personal level, I'm not a developer at all and now vibe coding has become my new time killer when out and about (beats doomscrolling 😅). I have been building apps and websites (like this very one you're reading on) ALL ON MY PHONE using Claude.

The collapse of the stack is wild. A developer used to be paid the big bucks to context-switch across repositories, files, user stories, bugs, and PRDs to synthesize a single feature, and (oh yeah) write code. This LEAP for the developer has turned that on its head. Developers are moving toward a unified experience where they simply express intent in natural language. The agent orchestrates the complexity across those various layers to make it happen, waiting for feedback from their conductor to let them know they've done good. Software development is being flattened.

Yes, to call this a "Great Leap Forward" is hyperbolic, inaccurate, and dramatic considering what happened during that turbulent time. But it is an industrial revolution compressed into a few quarters where nobody knows what the end looks like. A developer from eighteen months ago, dropped into a modern AI-native workflow, would struggle to recognize the job. The tooling, the rhythm, the unit of work… all of it has shifted. What used to be a craft of careful, manual construction is now closer to conducting: setting direction, reviewing output, refining intent. The revolution has already happened for them. My question is: what does that window look like for security and are we close to it?

If this is where the world is going, and if the recent hype regarding Claude Cowork and the broader "agentic everything" push is any indication, then this revolution is heading my way soon too. I suppose I welcome my new AI overlords because frankly, I want to see that same level of leverage in my own work.

I'm not a developer, but I am a security manager for emerging tech companies. I lead "small but mighty" teams of two to four protecting SMB organizations. We do it all: SOC 2 compliance, endpoint security, cloud architecture, security awareness, and product security. And watching the developer role transform has forced me to look at my own workflow in jealousy: why can't I have this type of leverage yet?

I use AI all day, mostly as a co-pilot. My style of managing work through Phil Venable's "Risk = Hazard + Outrage" model remains the same, but the execution speed has multiplied. For example, troubleshooting a SASE or EDR policy/alert by sifting through logs used to be a slog; now, I dump a "Ctrl-A" copy-paste of context into ChatGPT and voice-narrate what I'm experiencing. Tasks that would have otherwise taken me 5x as long now happen in minutes. But I am still manually juggling between a dozen vendors, browser tabs, desktop apps, chat apps, dashboards, etc to bring together whatever it means for me to be "doing security".

I know I am stating the obvious and describing the problem that once solved will make <insert company here> a trillion dollars… but I'm doing the dashboard dance and I hate it!

So when I say I'm waiting for security's "Great Leap Forward," I'm not saying "I want AI to write my policies" or "I want a chatbot to explain alerts." (don't get me wrong I like that a lot). I'm interested in the same revolution that developers are experiencing: one place where I can express intent, and a system that orchestrates (most of) the rest. I want to have a new work experience where I look back that what I'm doing now looks unrecognizable to my old workflows, the same way that my developer peers do.

Security has enforcement. What we lack is orchestration. By "orchestration," I'm referring to the idea that employees in all disciplines exist to coordinate multiple independent systems, data sets, stakeholders, and objectives to achieve whatever their mandate is. Automation can be introduced to remove manual effort, improve consistency, and speed things up, but typically automations exist in different forms and in different places, and they're still orchestrated by the human operator. In security, that operator is the practitioner who wakes up and starts bridging disconnected systems by hand.

The developer world is giving us a glimpse of what happens when that "human bridge" role collapses into a unified interface. Claude Code doesn't just write a line of code; it understands the file system, the shell, and the git history. It even handles the inclusion of PRDs and the creation of documentation, connecting to various systems developers use. It #orchestrates the tools of development so the developer can focus on the intent of the software. It's not about a fancy chatbot. It's about a single place where intent turns into coordinated action across a messy stack. Scaffolding is how Daniel Miessler describes it and I think its spot on.

So that's the gap I keep circling: security has plenty of enforcement engines, and more signals than we can digest, but we don't have a control plane that makes the work feel flattened. We don't have a single place where intent becomes orchestration across the stack.

At a very high level, the thing I hope to see looks close to what we're seeing emerge in the broader agent space: a unified, browser-based experience where I can express intent in natural language, backed by real connectors into the tools I already use. It's the combination that matters. In practice, some of the security work is API-driven and clean, and some of it is still trapped inside dashboards and weird admin portals. The orchestration layer needs to be able to live in both worlds, otherwise it's just another chat window that tells me what I already know while I keep clicking myself.

Examples of things I would use this Orchestration Layer for include…

• "Pull up my EDR console and find every endpoint that doesn't have disk encryption turned on. Correlate it with ownership and last check-in time in MDM, then create a Jira ticket for IT outlining the discrepancies”
• "Pull up my CSPM, look for critical issues in our Infrastructure-as-Code that affect the production service. Open pull requests and insert proposed changes.”
• "For this month's security report, tell me how we're doing on SLA for endpoint vulnerabilities. Pull the counts by severity and age bucket, call out what's trending better or worse, and update this month's deck with the numbers and a clean narrative."
• "Crawl through every vendor security review performed in the past year in our GRC tool and flag issues that may still be open with the vendor or business owner. Create a tracker, send follow up emails where it makes sense, and propose next steps for each”
• “Fill out this 1 billion row security questionnaire based on this knowledge base. Let me know when you have <90% confidence on your answer”

Yes, you can cobble pieces of this together today with middleware tools like Zapier, Tines, and LLM of choice but the historical workflow model is so brittle and doesn't handle nuance well. The real million dollar solution is being able to express intent to an orchestration browser (the way ChatGPT Atlas and Claude Cowork are hinting at) and have it coordinate the work across my stack from one place.

This is Part One of a series because I'm still just musing on the desire, not prescribing the full spec. I'm very aware I might just end up describing a general purpose tool that OpenAI/Google/Anthropic are already working on but I feel like some security special sauce is there.

For now, I'll keep it simple: developers get IDEs that orchestrate their stack. Security is still doing the dashboard dance. I want one place where I can start my day, express intent, and the orchestration begins. A nice bonus will be if the apocolypse doesn't occur as well.