Samir Raiyani and Saskia van Ryneveld sit down with Disha and Saurabh from Titan Dev to unpack a question every CTO is now asking out loud: can AI actually ship code you'd trust in production and how do you keep it secure while it does?
When the developer they'd hired came back with a front-end that looked nothing like what they'd designed, Disha Gupta didn't go looking for a better developer. She started building it herself, using AI, and one day she showed Saurabh a fully working product. That moment — everything switched on, everything functional — was when the two co-founders of Titan Dev realized they didn't need to hire anyone at all.
That's a striking claim. Saurabh and Disha bring over 20 years of cybersecurity experience between them. They'd tried building a risk platform as far back as 2018, grinding through four bootstrapped years without much to show for it. Then, in late 2023, they started experimenting with generative models. They were planning an MVP for early 2024. They shipped version one in January.
We treat AI as our team.
The structure they built isn't a casual "use AI to help write code" setup. It's a deliberate software development lifecycle, fully staffed by agents. There's a developer agent, a code reviewer, a planner, a brainstorming agent. No in-house testers. No business analysts. Each agent operates within a set of skills, rules, and harnesses that Disha designed specifically to keep outputs consistent and correct.
The core problem she was solving was AI slop — the half-built outputs that came out of early LLM-assisted coding sessions and required extensive manual testing to fix. Her answer was to make the agents follow strict rules from the start, so the first iteration would actually work.
"AI needs guardrails. It needs restrictions. It needs rules. You would have to give AI certain rules that it has to follow, and those are non-negotiables."
The philosophy she landed on is minimal code with failing tests first. The agent writes only what's necessary, starts with test cases that should fail, and then builds code until those tests go green. Determinism, in her framework, isn't about reducing the LLM's role to 20% of the work. It's about building enough hard constraints into the pipeline that the output is verifiable at every step. When something breaks in CI/CD, she knows exactly where and why.
Saurabh frames the same idea differently: measure twice, cut once. Getting the rules right takes iterations, but once they're working, the velocity compounds. Agents start producing quality outputs consistently, and the team can iterate fast instead of backtracking constantly.
Eight weeks in, the conversation flipped. Saurabh and Disha weren't asking whether AI could replace parts of their team anymore. They were asking whether they'd ever replace one of their agents with a human. The answer, at that point, was obviously no.
That shift is worth sitting with. It's not the same as saying AI is better than humans at software development in the abstract. It's saying that once you've built the harness — the rules, the skills, the review loops, the recursive learning — the system gets better every few days and the cost of adding a human to that pipeline is almost impossible to justify.
Eight weeks in, the question became: would we replace one of our agents with a human? The answer was pretty obvious.
Samir Raiyani, Founder & CEO of IP Author, had been watching their process from the outside. His own team had been doing careful, artisanal prompt engineering, hand-crafting each building block. When he saw what Disha and Saurabh had built, the contrast was stark. They'd gone industrial while others were still crafting by hand. Their system had agents, skills, harnesses — robots, essentially — doing the work while others were still writing prompts one at a time.
Titan Dev is a CyberGRC platform: it helps organizations understand their cyber risk exposure, manage third-party risk, and translate security data into decisions that executives can act on. The defensive posture is built in. But as they were building it, they realized they also needed an offensive tool to test their own defenses continuously. That side project became a product offering.
The reason that matters is the scale of what they're tracking. The CVE count — the tally of known security vulnerabilities — is rising so fast that even switching to a logarithmic scale on the chart makes no visible difference. It still looks vertical. Where organizations historically did a penetration test once a year, let a consultant hand over a long list of findings, and revisited it a year or two later, that cadence is now dangerously obsolete. Titan Dev now offers continuous pen testing, running attack simulations against an organization's environment on an ongoing basis.
Saurabh's read on the underlying dynamic is clear-eyed: the problems were always there. Bad code has been written since the beginning. What changed is the speed and scale at which vulnerabilities can be identified and exploited. The attack surface hasn't fundamentally changed for most organizations — it's still email, websites, externally facing infrastructure. What has changed is the capability on both sides of that fight.
The problems were always there. It's just that the transparency of that bad code, now being identified and exploited — that speed and scale went up.
For someone using AI tools in a professional context — a patent attorney, an IP professional, a service provider — the practical risk picture is more manageable than the arms-race framing might suggest. The attack surfaces haven't multiplied wildly. What has grown is the importance of knowing who is handling your data downstream.
The key questions, in order: Are your external-facing surfaces (email, websites) secured? Are the tool providers you use taking AI and LLM security seriously, not as a checkbox but as a continuous practice? And critically, is there any point in your workflow where data that shouldn't reach a general-purpose LLM might actually be reaching one?
Disha describes Titan Dev's own approach: strip all PII before any data touches an LLM, run watchdog processes on the database to verify that access controls and authentication rules are enforced correctly, and run security audits against OWASP principles every night. The nightly audit doesn't just check for new vulnerabilities in the wild. It checks whether anything built that day created a new gap.
Saurabh's advice to practitioners goes one level upstream: know your own environment well enough to do basic threat modeling before any specialist gets involved. You know where your data lives, who touches it, and what your exposure points look like. Start there, then work outward to make sure every vendor in that chain is handling data with the same discipline you'd apply yourself.
Both Saurabh and Disha have carried the agent mindset into their personal lives. Saurabh's personal assistant is named Mira and handles social commitments, birthday messages, holiday planning, and tracking Lego sets he wants to buy. Disha's is Naina. For a trip to Turkey, Naina handled the full itinerary — restaurants, places to visit, shopping lists, and even suggested bargaining tactics for specific purchases at the market.
The children, apparently, are not fully on board. They've asked that the agents not take over all the conversation.
That detail, small as it is, says something about where this is heading. The same methodology that replaced their development team — build a capable agent, give it rules and context, let it run — is now general-purpose infrastructure for getting things done. The industrial process they invented out of necessity, because a part-time developer couldn't build what they needed, turned out to be a model for how they run their lives.
