Verification After AI Code
Desmond Lim@mynameisdesmond
−7.6%
since Oct 7
The idea
My belief is that AI has made writing code cheap, so the real value shifts to proving that code is correct and safe before it ships. As code volume explodes and AI-written code carries more flaws, the tools that test, scan and monitor it in production become the toll booth. I spread this across four layers: the code pipeline itself, observability for production verification, application and vulnerability scanning, and large-cap security platforms as steadier ballast, with no single name dominating. I keep a small cash cushion since this is a multi-year structural bet, not a short-term trade.
What it owns
- Software shipped faster and in higher volume creates more surface area to scan for vulnerabilities, making continuous scanning a standing requirement rather than a one-time check. · TenableIt finds vulnerabilities in deployed applications, so flaw counts in production code drive demand for its scanning., CloudflareIt shields applications at the edge, catching what slipped past testing, and becomes more valuable if flawed code reaches production more often., QualysIt performs continuous scanning as an always-on check that replaces trusting the author, and more code shipped faster means more surface to scan on a scaling subscription., AkamaiIts API security business checks the connections between services, which multiply faster than the code itself when services are cheaper to write., Rapid7It sells application testing and attack simulation, the offense side of proving software safe, and stands to benefit if demand for app testing grows with code output.26%
- These tools sit in the path every commit must pass through, so higher code volume drives more paid usage across testing, scanning, and workflow tiers. · GitLabIt sells the pipeline every commit must pass through, and its security scanning tiers charge more as code volume grows., JFrogIt verifies that packages and artifacts going into software are safe, which matters more when automated tools pull in dependencies without human review., MicrosoftIt owns GitHub, where most code lands and where automated security checks run on every push, though this is a smaller part of the broader business., AtlassianIt runs the workflow rails that route code through review and approval, so more code means more tickets, more reviews, and more seats on those platforms.25%
- Large security platforms that span code to cloud give the take steadier footing by collecting across the entire verification chain rather than a single slice. · Palo Alto NetworksIt covers code to cloud in one platform, collecting on the whole verification chain rather than one slice of the stack., CrowdStrikeIt watches what software does once it runs on endpoints and in the cloud, serving as the production-side verification that complements the scanners., FortinetIt provides broad security across the stack, and demand rises with the volume of software to protect and the complexity of keeping it safe., Check PointIt is a steady cash generator in security that earns through the whole cycle, providing ballast against the swings of faster-growing point solutions.22%
- Watching software behave in production is how code gets verified after it ships, and billing scales with data volume and incident complexity. · DatadogIt bills on data volume from production monitoring, so growth in shipped code directly expands the volume it tracks., DynatraceIt catches problems in running software automatically, which becomes scarcer and more valuable when writing code gets cheap and verification grows critical., ElasticIt is where the logs go, and verifying software means searching a lot more logs for errors and security signals as code volume rises.19%
- Cash8%