Sonar and the Verifiers’ Moment (Category AI4SDLC)

Sonar has been around for almost twenty years, serving a well-established niche: static analysis, quality gates, and finding bugs, vulnerabilities, and code smells. Now the company is having a particularly good run. Agents are generating code at a frantic pace, for everyone at once, and checking its quality manually is becoming harder. Enter Sonar with its deterministic rules—and more besides. I watched a talk by Sonar CEO Tariq Shaukat at AI Engineer World’s Fair, where he discussed precisely this shift.

Models can tackle longer tasks, but reliability is lagging behind. In the METR data Shaukat presented, a task taking a human 16–20 hours corresponds to a 50% chance of agent success. At 80%, that horizon falls to 3–4 hours. A CTO at one of Sonar’s customers remarked that an employee who was right only 80% of the time would already be facing a performance review. Worse, functionally correct code can still be complex, vulnerable, and expensive to maintain. Review work and technical debt begin to eat into the initial speed gains.

Sonar’s response is the Agent Centric Development Cycle, or AC/DC. I have mentioned this acronym before, when covering another Sonar talk on a similar subject:

• Guide: give the agent context, architectural constraints, and a quality profile.
• Generate: the agent writes code.
• Verify: deterministic analysis checks data flows, secrets, and known patterns, while agent-based review checks intent and business logic.
• Solve: send the findings back to the agent so it can fix the code and repeat the cycle.

Verification should not live only in CI before a merge. Shaukat describes three connected loops: the agent’s inner loop, CI verification, and continuous maintenance of the codebase. There is an important shift here: clean code is now useful to agents as well as people. It is easier for an agent to navigate, takes fewer tokens, and leads to fewer mistakes. Sonar’s figures for reductions in defects and token use, however, remain the vendor’s own data.

My main takeaway is that good old static analysis is suddenly becoming infrastructure for the future.

#AI #AI4SDLC #Agents #Engineering #DevSecOps #Software