Vibe coding means building software by prompting an AI model and accepting what it writes, often without reading the code. Adoption of AI coding tools is close to universal, but the speed evidence is mixed and the security evidence is worrying.
Controlled studies range from a 19% slowdown for experienced developers on mature codebases to a 55.8% speedup on a small, isolated task. The real question is not whether your teams vibe code.
It is where the boundary sits between a throwaway prototype and code that touches production data or customers.
One blanket rule fails both ways. A tiered policy lets teams move fast in the sandbox and keeps unreviewed code out of production.
Prototypes, spikes, personal tools and synthetic data. Vibe coding is allowed here with approved tools only, no real credentials, no production data and automatic expiry. This is where product teams test an idea with users in days.
Internal tools on internal, non-regulated data. Code must be AI-assisted, not vibe-coded: a named code owner, pull request review, SAST, SCA, secrets scanning and SSO. The prototype becomes a specification someone is accountable for.
Customer-facing apps and anything touching PHI, cardholder data or financial reporting. No unreviewed code, full SDLC, a threat model, DAST and a pen test for major releases, with an audit trail auditors can follow.
Adopt a working definition and a three-tier policy that says where unreviewed AI code is allowed and where it is not.
Enforce human review, SAST, SCA, secrets scanning and least-privilege agent access for all code, whoever or whatever wrote it.
Follow a 15-step checklist to move a vibe-coded app into a governed repo, rotate secrets, test authorization and separate environments.
Use an eight-criterion scorecard to promote apps between tiers, and track delivery metrics instead of developer sentiment.
Building software by describing what you want to an AI model and accepting its code without reading it closely. Andrej Karpathy coined the term in February 2025, and Collins named it Word of the Year. Reviewed and tested AI-written code is better described as AI-assisted engineering.
For sandboxed prototypes and internal tools with no sensitive data, yes. For production or regulated systems, not without review. Veracode found AI models introduced OWASP Top 10 flaws in 45% of test cases, so require review, SAST, SCA and secrets scanning before anything ships.
Sometimes. A GitHub study found a 55.8% speedup on a small task and a Google RCT estimated about 21% on an enterprise task, but METR found experienced developers 19% slower on mature codebases. Measure delivery metrics on your own work.
App builders such as Lovable, Bolt.new, v0 and Replit Agent for non-engineer prototypes, and AI coding editors and agents such as Cursor, Windsurf, Claude Code and GitHub Copilot for professional codebases. Pick tools with SSO, admin controls and clear data terms.
Assign an owner, move the code into a governed repository and make it pass the same gates as any service. Rotate secrets, threat model, test authorization at the data layer, add tests, separate environments, remove agent access to production and launch behind a feature flag.
Injection and cross-site scripting flaws, missing authorization, hardcoded secrets and hallucinated dependencies that attackers can register. Veracode found models failed to prevent cross-site scripting in 86% of relevant tests.
Not on current evidence. It shifts effort toward review, architecture, security and operations. METR found about half of AI pull requests that passed SWE-bench tests would not be merged by maintainers.
CTOs, VPs of Engineering and AI leaders setting policy for AI coding tools, and the security and platform teams who will enforce it.
Drop your details and we'll send Vibe Coding in the Enterprise: Risks, Controls and Productivity Data straight to your inbox - no spam, unsubscribe anytime.
Talk through your AI coding policy and prototype hardening with our engineering leads. A working session, not a sales pitch. SECTION 7 - FAQ - 5 to 8 questions
Talk to our engineers