Code Review 2026: Three ways. Same time. Different result.
Time doesn't disappear. It shifts between preparation, creation and rework.
Code Review in CI/CD
Tools, reviews and tests check at defined points. That remains valuable. SAST, DAST, SCA and pentests provide evidence that no AI can replace. But each check only sees its own slice. None of them automatically answers the question of how everything works together, and answering it means considerable and unpredictable extra effort. Especially in large projects, where software is built from a wide range of business, technical, standards, compliance and legal requirements with different partners and suppliers, and where intellectual property and capabilities also play a role, the review becomes a strategic bottleneck with an unknown number of blind spots. The risk of "drift" arises. And so functions that are actually "forbidden", because they lack context and documentation, get built in, go undetected during the review and develop into a business risk.
Vibe Code and LLM Code Review
Produced fast, understood late. Efficiency demands and an early-access mentality aimed at early monetization are realistic today thanks to AI support, but they also have their pitfalls. We sent a deliberately vulnerable Node.js app (a test for vulnerability detection, open source) through several LLMs with an identical prompt and without any context, to understand what effect this has.
→ Of 8 known vulnerabilities in the file, the reviews found between 3 and 8.
→ On top of that came up to 9 additional findings of varying severity.
→ After the context check, 4 actionable findings remained.
Of the remaining findings: an architecture decision (risk acceptance), a honeypot (deliberately built in), a compensating MFA control (risk compensation), and another accepted risk. Without context, false positives become daily business. But clarifying them does not go away. It waits in the backlog. Without requirements and without understanding the intention behind the lines of code, you measure against everything that stands out, because in practice everything represents a risk. Every time. Again and again. Hence the term "finding production". This is also a good answer to the question "So where is it, then, the productivity from AI?" – here, too, the review becomes a strategic bottleneck because of overflowing backlogs.
Intentional Code Review
First build the requirements framework: requirements, threats, assets, compliance, acceptance criteria, specification and contract. This takes more time up front, but in return the review then checks against a benchmark instead of against a generic "What's wrong here?". It's about context – the new superpower. Every confirmed decision flows back as process memory into the next change. In short: the requirements are an effort you only make at the beginning, which performs better and better through deliberate learning and refinement, and is best understood as a 1x effort.
The table below is a qualitative target picture, not a measurement. It shows where the effort ends up in each case.
Bottom line: productivity is measured by the verified deliverable, not by the first build.
AI finds more, and faster. The lifecycle tells us which of it counts.
More on this: https://aigis.one/codex
**Images AI-generated; text and layout structured with the help of AI.
#CodeReview #AppSec #SSDLC #AI #Cybersecurity #DevSecOps