---
title: "We now build in three months what took us three years. That is where the hard part begins. | Guardian360"
description: "In three months a handful of people rebuilt our Lighthouse platform with more new functionality than we used to deliver in three years. AI removed our oldest constraint and exposed a new one: when building is no longer scarce, implementation is."
url: https://guardian360.net/blog/we-now-build-in-three-months-what-took-us-three-years/
locale: en
source: guardian360.net
---
[← All posts](https://guardian360.net/blog/)

Opinion

# We now build in three months what took us three years. That is where the hard part begins.

By Jan Martijn Broekhof · 12 October 2026

Something has changed in our development team this year, and I am still getting used to it. In the past three months, a handful of people at Guardian360 have rebuilt our Lighthouse platform and extended it with more new functionality than we used to deliver in over three years. We did not hire a larger team and we did not find a bigger budget. AI-assisted software development simply removed the constraint that shaped every roadmap decision we ever made: a shortage of people and tools.

That sounds like good news, and largely it is. But it has exposed a new constraint, and it is not where I expected to find it. When building is no longer scarce, implementation is. Our partners, the managed service providers (MSPs) who deliver our cybersecurity platform to their customers, cannot absorb new functionality at the speed we can now produce it. And two further questions keep me busy. Is software built this fast actually secure? And could more functionality erode the simplicity that has always set us apart?

## What changes when building is no longer the bottleneck?

For most of Guardian360’s history, our roadmap was a list of things we wanted to build, ranked by what we could afford to build. Partners asked for certain features for years, and many of them had to wait.

Today our developers work alongside AI for code generation, testing and documentation. We started with Claude, Anthropic’s model, and are increasingly moving that work to Hermes. Hermes is not a model but a layer we built ourselves. It uses open-source large language models to power what we call a company brain, and it facilitates the AI agents that help us with a wide range of tasks. Hermes, and the open-source models it uses, run in our own server cluster in the Netherlands, and that is a matter of principle as much as practicality. Claude has never had access to customer data on our platform, because our partner agreements do not allow that data to leave the EU. Moving more of our work to infrastructure we control follows the same logic.

We are far from unusual. According to Veracode’s 2026 GenAI Code Security Report, AI now generates roughly half of all committed code. The question is no longer whether software teams use AI, but what happens next.

## Is software built with AI actually secure?

This is the concern I take most seriously, and I suspect it is the first question many readers will ask. The research gives little reason for comfort. Veracode found that roughly 44 percent of AI code generation tasks introduced a risky vulnerability, with an average security pass rate of 56 percent, barely changed from 55 percent in its first report. IOActive’s April 2026 study analysed nearly 20,000 code samples and found that 31.6 percent of AI-generated samples were fully exploitable; no model produced entirely secure output.

What worries me even more is the gap between perception and reality. The Cloud Security Alliance reports that over 75 percent of developers in one survey believed AI-generated code is more secure than human-written code, while 56 percent admitted it frequently introduces security issues. Speed feels like competence. It is not.

IOActive’s conclusion is that organisations must treat AI output as untrusted input and enforce mandatory security review before deployment. That is exactly how we work: AI may write the code, but every change is reviewed by a person who understands it before it reaches production. We are now going a step further by turning our own AI pentesting on ourselves, including crystal box analysis of our own source code, where the testing agents have full access to the code. We run that analysis with several different models, so that the blind spots of one model are less likely to go unnoticed.

The same principle shapes the AI pentesting we are bringing to our partners, where the AI performs the test and the partner’s consultant signs it. Developers appear to share this instinct. In Stack Overflow’s 2026 Developer Survey, nearly half of respondents said they trust AI output when they can verify it, while only 6.6 percent would trust AI with an important decision.

## Why do more features not automatically mean more value?

The second concern is less technical but just as real. No Jitter recently described a “feature flood” in communications software, where vendors release hundreds of new features every year while adoption falls behind. Pendo’s benchmarks suggest that around 80 percent of built features never achieve meaningful adoption, and that 6.4 percent of features generate 80 percent of all clicks. That pattern existed long before AI. AI simply makes it cheaper to repeat.

Guardian360 has always tried to offer a platform that an MSP can explain to a board member in a few minutes. Every feature we add makes that harder. The cost of building a feature has collapsed; the cost of understanding it has not.

Our partners are already carrying plenty of complexity. Research by CRN, published by the security vendor Coro, found that MSPs manage between 6 and 20 or more vendors to deliver security services, rate integration between those tools at just 6.2 out of 10, and that only 7 percent are happy with the return on their security tools. The last thing they need from us is another layer of complexity, however well intended.

## Where has the bottleneck moved to?

Google’s DORA research offers a useful lens. Its 2025 report found, for the first time, a positive relationship between AI adoption and delivery throughput, but AI adoption still correlated with lower delivery stability: more change failures, more rework and longer recovery. DORA also concluded that AI tends to mirror and amplify existing organisational traits, for better and for worse.

I would extend that observation beyond the development team. A feature only creates value when a partner understands it, configures it, explains it to a customer and builds a service around it. That chain runs at human speed. AI accelerates the first link and leaves the rest untouched, which means the queue simply moves downstream, to our partners and their customers.

Stack Overflow’s survey points in the same direction: people trust what they can verify. A partner who has never seen a feature work cannot verify it, cannot explain it and will not sell it.

## Should we simply slow down?

Some partners would argue exactly that: stop for a while, stabilise, let us catch up. It is a fair argument and I partly agree with it. A vendor that releases faster than its channel can follow is optimising for its own satisfaction, not for its partners.

Yet slowing down artificially would waste an opportunity that small European vendors rarely get. The answer, I believe, is discipline rather than braking. That means deciding what not to ship, treating simplicity as a design requirement rather than an afterthought, and involving partners before a feature is finished rather than after.

Part of that discipline is built into the platform itself. We are introducing workspaces: rather than presenting every feature on one screen, we group functionality by task, so a partner sees only what the work at hand requires. The AI-driven interface takes this further. Pages, reports and navigation become definitions rather than code, and an agent builds the view a user asks for within the limits of their role. This is no longer a concept. We will show it working on 3 November, and we want honest feedback from our partners on whether it actually helps them.

There is a second way to keep complexity down: let the platform do more of the work. Today Lighthouse tells you what could be improved. In the future it will also fix it, where the partner and its customer allow it to. Every task the platform takes over is a task a partner no longer has to learn, explain or schedule.

## Why we are opening the doors of the control room

Guardian360’s logo contains a lighthouse, and the metaphor has never felt more accurate. A lighthouse is only useful if its light reaches the shore. We can build the brightest light in the world, but our partners are the ones who carry it to their customers.

That is why we are hosting [“A view from the control room”](https://guardian360.net/a-view-from-the-control-room/) on Tuesday 3 November 2026, from 09:30 to 13:00 at the Van der Valk Hotel in Woerden. We will show what we have built, running live rather than on slides, and give a first look at what Guardian360 delivers in 2027. Attendance is free, there is room for about 50 guests, and registration is open until 30 October. More than the demonstrations, I value the conversation. I would rather hear on 3 November that something is too complex than discover it in adoption figures a year from now.

## So, what is your constraint now?

If building is no longer your constraint either, and for many MSPs that moment is closer than it seems, what is? For us, the answer is clear. When building is no longer scarce, implementation is. That is where the hard part begins, and it is work we can only do together with our partners.

## Sources

- Veracode: 2026 GenAI Code Security Report: AI Is Writing More of Your Code but Security Hasn’t Caught Up (July 2026)
- IOActive: The Security Gap in AI-Generated Code (April 2026)
- Cloud Security Alliance: Vibe Coding Security Debt: AI-Generated Vulnerabilities at Scale (April 2026)
- IT Brief UK: Stack Overflow survey finds developers wary of AI tools (October 2026)
- Google Cloud / DORA: Announcing the 2025 DORA report: State of AI-assisted Software Development
- No Jitter: Vendors ship thousands of features, users adopt dozens (July 2026)
- Coro / CRN: Your Tool Stack Is Eating Your Margins (August 2026)
- Guardian360: A view from the control room, event 3 November 2026