Case Studies — What Organisations Are Actually Doing #
- Four Case Studies in Vibe Coding (IT Revolution) — Gene Kim and Steve Yegge’s cases spanning individual (CNC firmware; a developer returning after 20 years away) through enterprise scale (Adidas 700-person GenAI pilot; Booking.com 30% efficiency gains). The Booking.com case is the strongest enterprise data point: 30% efficiency gains, 70%-smaller merge requests. These are companion cases to the Vibe Coding book.
- In 2026, Vibe-Coding Is Coming to the Enterprise (VMBlog) — Gartner forecast: 40% of new enterprise production software will use vibe coding techniques by 2028. The warning buried in the same report: without governance, organisations face a 2,500% increase in defects. Adoption is accelerating faster than governance frameworks — this gap is the structural risk of the moment.
- Vibe Coding Statistics 2026: Adoption, Productivity, and Security Data (Hostinger) — Useful stats reference: 92% of US developers using AI coding tools daily; 40% of new SaaS MVPs built primarily with vibe coding; Booking.com 70%-smaller merge requests. Aggregates data from multiple sources for easy citation.
Citizen Developers — Scale and Invisible Risk #
- How AI-Empowered ‘Citizen Developers’ Help Drive Digital Transformation (MIT Sloan) — Typical enterprises now run 4,500–6,000 AI-generated apps and workflows. 66% are undiscovered by security teams. The scale has crossed the threshold where traditional shadow IT governance can work: there are too many apps to enumerate, let alone audit. The citizen developer question is no longer a governance question at the individual app level — it requires architectural controls.
- Citizen Development at AI Speed: Governance Risks for Life Sciences (USDM) — Regulated-industry case: in life sciences, AI lowers the barrier from “can you code” to “can you reason about the problem” while compliance obligations remain unchanged. GxP requirements don’t have a citizen developer carve-out. The validation and audit trail expectations still apply regardless of how the code was generated.
COBOL / Legacy — The Mainframe Moment #
- The Mainframe Moment: How AI-Driven Modernisation Is Reshaping the COBOL Economy (domain-b) — Anthropic’s COBOL announcement sent IBM stock down 13%. 10% of COBOL programmers retire annually; AI modernisation tools are being pitched as the replacement for the expertise leaving the workforce. The economics are changing: modernisation projects that cost $50-100M are being pitched at a fraction of that with AI tooling.
- Claude Code and COBOL Modernization: What’s the Reality? (Thoughtworks) — Grounded assessment: Claude Code is strong on analysis and cost reduction, but the bottleneck is scale, architecture strategy, and the cognitive load of 220 billion lines of existing code. Human mainframe expertise is still essential — AI accelerates the translation step but can’t substitute for domain knowledge about what the code is actually supposed to do.
- How AI Can Fix Government’s Legacy Code Problem (GitLab) — US agencies (HHS, SSA, CMS) depend on COBOL systems; failure means stopped benefit payments and exposed citizen data. AI tools can shorten modernisation from years to months. The political pressure to modernise is intensifying as outages become more visible — 2026 is the year government COBOL risk became a mainstream policy discussion.
Comprehension Debt — Empirical Grounding #
- Cognitive Debt: AI Coding Agents Outpace Comprehension 5–7x (ByteIota) — Five independent research groups converge on the same finding: AI tools generate code 5–7x faster than developers can understand it. Comprehension checkpoints as the proposed mitigation — deliberate pauses to rebuild mental models before proceeding. This is the empirical grounding for Osmani’s comprehension debt concept.
- AI-Generated Code Is Creating a Technical Debt Crisis Nobody Is Auditing (dev.to) — 41% of new code being AI-generated ships without meaningful review. Comprehension debt doesn’t appear in DORA metrics or sprint reviews — making it uniquely dangerous compared to traditional technical debt, which at least surfaces in velocity degradation.
Security Risk — Concrete Numbers #
- Vibe Coding Security Risks: Enterprise Guide 2026 (BeyondScale) — 45% of AI-generated code fails basic security tests; 86% of samples contain XSS vulnerabilities (Georgetown CSET data); AI-assisted commits expose secrets at twice the rate of human-written code. These are the numbers that security and compliance teams are now citing in governance discussions.
Non-Technical Users — A New Constituency #
Cross-links #
- Vibe Coding Approaches The arXiv SDD paper (9.8%–42.1% vulnerability rates) is the formal evidence base for the security risk numbers above — the two journals are documenting the same problem from different angles.
- AI Impact on Society The 2,500% defect increase forecast (Gartner) and 66% undiscovered apps (MIT Sloan) are the vibe-coding-applications evidence for why the “anticipatory layoffs” story involves real downstream risk, not just headcount reduction.
- Claude Integrations Softr’s non-technical user platform sits in the integrations space too — the boundary between “integration” and “vibe-coded app” is blurring as the tooling productises around non-developers.
- Quality signal: The MIT Sloan citizen developer finding (4,500–6,000 apps per enterprise, 66% undiscovered) is the most alarming concrete number in this gather cycle. It makes the governance problem visceral — this is not a risk to manage, it’s a problem already in production.
- Emerging pattern: The comprehension debt story is accumulating empirical support (5–7x gap, 41% unreviewed, 45% security failure). These separate data streams are converging on a clear pattern: speed metrics are visible, comprehension metrics are invisible. The gap widens until a failure event.
- Author to watch: Gene Kim (IT Revolution) is now producing empirical case studies for vibe coding in enterprise contexts — the Vibe Coding book + IT Revolution article series is the most systematic case-study programme for this topic.