Not Everything Should Use AI
Generative AI is useful when imperfect output is acceptable and constrained. Most software still needs deterministic control paths.
I feel insane typing that title, but here we are. If you believe the marketing departments, everything needs, has, or is AI. I should preface this rant by acknowledging that “AI” is a huge catch-all, but at this point most of us assume we’re talking about generative AI, often agentic generative AI.
Determinism
To build tooling appropriately, you should know what AI is and is not good at. I’ll oversimplify: generative models do not give you a general guarantee of determinism. Settings such as temperature and seed can make output more reproducible, but even OpenAI’s API documentation describes deterministic sampling as a best effort and explicitly says it is not guaranteed. If correctness requires the same result every time, do not put a generative model on the authoritative decision path unless deterministic validation constrains its output. Are you okay with your software occasionally lying to you?
Most software should remain traditional, deterministic software. You do not need AI in the middle of most use cases. Can, and possibly should, you use AI to help build that traditional deterministic software? Yes.
I saw a LinkedIn post describing the “need” to replace traditional automation with AI and make it “mostly deterministic.” A system can reasonably be called mostly deterministic if only some paths are stochastic, but the phrase avoids the question that matters: can stochastic output cause a consequential change without deterministic validation?
Where It Fits
AI can help you build prototypes of traditional software. It can accelerate code review and vulnerability discovery. It can also produce a useful first pass for many kinds of work that have traditionally required security professionals, with a qualified person still responsible for validating the result.
If imperfect output is acceptable, AI can sit inline in many workflows, but always ask whether it should. Do you have a fail-safe? Is it providing consistent value? Does an occasional imperfection create material risk? Are you collecting enough logs and evidence to establish what it did, which inputs and tools were involved, and what changed as a result? Maybe most importantly, can traditional deterministic software achieve similar results with less uncertainty and operational complexity?