AI Won't Save You If You Can't Code: Tom Stiehm's Warning

Episode Show Notes: AI Won't Save You If You Can't Code

Guest: Tom Stiehm, DevSecOps Expert & Software Engineering Veteran
Host: Kumar Dattatreyan
Duration: ~ 34 minutes

Here's something nobody in the AI space wants to say out loud.

If you learned to code using AI, you have no idea what to do when it fails. And it will fail.

That's not a doom prediction. That's Tom Stiehm — 30 years in software, former CTO of Coveros, now bringing those hard lessons to the public sector at Steampunk. Tom is one of the most grounded voices I've had on this show. No hype, no fear. Just a practitioner who has seen every wave of technology promise hit organizations, watched how they handled it, and has a very clear read on what's coming next.

This conversation got real fast. And it stayed there.

We started with a story about a hurricane.

A team at Fannie Mae was mid-sprint when federal legislation dropped: anyone in Houston affected by the hurricane would get mortgage relief. In the old world, that's a back-office nightmare. Manual workarounds, endless errors, people falling through the cracks.

This team did something different. They canceled the sprint. Went back to planning. And in three months — with a full month of testing to spare — they shipped the software that made it happen cleanly.

That's what real business agility looks like. Not the ceremonies. Not the certifications. The actual ability to turn on a dime when the business needs you to.

Tom had coached that team. He'll tell you it wasn't magic. It was a great Scrum Master, serious investment in test automation, and management that actually trusted the team to drive. All three had to be there. None of it happened overnight.

Then we talked about security. The thing everyone ignores until it's too late.

Tom called application security the poster child for third-class citizens in software development — behind even QA. Security was the thing you did in the last week before a release, when there was no time to fix anything. So you'd negotiate which vulnerabilities were acceptable to ship with. And then just hope.

DevSecOps flips that. Security moves left — into the daily build, not the last-minute gate. Tom has spent years making that shift happen at financial institutions and government agencies. The organizations that resist it aren't just creating compliance risk. They're creating business risk.

Here's where it gets uncomfortable for anyone betting big on AI right now.

Tom's framing is not boom or doom. It's something more useful. AI is a real productivity tool. Used well, it genuinely changes what a developer can accomplish. But here's his analogy for what it's actually like to work with an AI coding assistant:

A very enthusiastic, sometimes drunk intern.

They'll do a lot of things for you. Some of them brilliantly. And you have to verify everything, because when they get it wrong, they get it confidently wrong in ways that are hard to spot.

The problem isn't the tool. The problem is what happens when organizations skip the fundamentals and go straight to the shortcut. Tom calls it the vibe coding trap. He compares it to Visual Basic — Microsoft gave people a powerful tool, most people used it for things it wasn't designed to do, and when something broke they had no idea how to go one layer deeper to fix it. Those codebases became a mess. VB got a reputation. Sound familiar?

The Agile parallel is the part of this conversation I keep thinking about.

Tom made an observation that I think is one of the most important things said on this show this year. The way Agile adoptions failed is a near-perfect preview of how AI adoptions are going to fail.

The pattern is always the same. You want the benefit of a change. Doing it properly seems like a lot of work. So you do some of it and hope for the same result. With Agile, that meant bolting Scrum ceremonies onto existing structures without touching culture or incentives. With AI, it means handing everyone a license for a code assistant, skipping the training, and watching them spend six months in trial and error developing patterns that don't work.

Tom's prescription: smaller experiments. Active training. A safe place to practice — what he calls the dojo model. Get experience before you get burned.

We also talked about what the airline industry figured out that software hasn't.

Most commercial pilots will never face an autopilot failure in a 40-year career. But the industry puts every pilot through simulator scenarios for exactly those situations anyway. Because when it does happen, you need to know what to do without thinking about it.

Software teams need the same thing. Not for emergencies they'll face every day — for the AI failure modes they'll only see once in a while, but that will be catastrophic if no one knows how to handle them. Tom thinks we'll get there. We're just not there yet.

One more thing worth your attention: BDD and AI.

Behavior-driven development is a test-first approach where you write tests before you write software — grounding development in how real users actually move through a system. Tom co-authored research on using large language models to accelerate that process. It's structured, disciplined, and produces real value. It's the opposite of vibe coding. And it's a useful model for what AI-assisted software development looks like when there's an actual framework underneath it.

Tom closed with where he's headed.

After years in the commercial world, he's joined Steampunk — focused on bringing better software practices to government. Same work. Higher stakes.

If you lead teams, make technology decisions, or are trying to figure out where AI actually fits in your organization — this episode is for you. Hit subscribe. You won't want to miss what's coming next.

CONNECT WITH TOM STIEHM

• LinkedIn: https://www.linkedin.com/in/stiehm/
  
• Steampunk, Inc.: https://steampunk.com
• Tom co-authored a paper on using LLMs to automate BDD — reach out to him directly on LinkedIn for the link.

CONNECT WITH KUMAR

• LinkedIn: https://www.linkedin.com/in/kumardattatreyan/
• Website: https://www.agilemeridian.com
• Book a 30-minute call: https://tidycal.com/coachkumar/30-minute-meeting

New episodes every other Tuesday at 12:30 PM Eastern — live on LinkedIn, YouTube, and Facebook.

RELATED EPISODES WORTH YOUR TIME

Episode 166 — International by Design If the Fannie Mae agility story resonated, this one goes deeper on what systemic agility actually requires across teams and borders.

Episode 162 — When Doing Scrum, Don't Do Scrum The trap of following the framework instead of solving the problem. Everything Tom said about how Agile goes sideways lives in this episode too.

Episode 152 — From Agile to AI Avoiding the same transformation mistakes when the methodology changes but the culture doesn't. The perfect companion to this one.

The Meridian Point is hosted by Kumar Dattatreyan, co-founder of Agile Meridian and co-creator of the Disruptor Method. New episodes every Tuesday at 12:30 PM Eastern.