← Writing · Essay 06 Industry & careers
The future of tech is uncertain.
How do we build a career in it?
AI, cybersecurity, layoffs, economic uncertainty, and the challenge of building a sustainable livelihood in a rapidly changing industry.
AI, security, hiring and the economics of software work
An independent developer's view, not an economist's or a security researcher's
Reflects reporting available on that date
13 min read
The question 01
Harder to tell lasting change from temporary excitement.
There is something unusual about working in technology right now.
The tools we use are becoming more capable. Software can be written faster than before. AI is helping researchers find software flaws at a pace that has security teams worried. The same capabilities are changing cybersecurity, financial services, hiring decisions, and the economics of building software.
At the same time, companies are restructuring their workforces, enormous sums are going into AI infrastructure, and developers are trying to work out which skills will keep their value.
Every week seems to bring another breakthrough, another security incident, another announcement about jobs, or another prediction about what AI will do next. It is becoming harder to separate lasting change from temporary excitement.
Somewhere beneath the headlines is a question that matters to anyone trying to build a career in this industry, and it is the one I keep coming back to as someone who builds and runs software for clients:
How do we build a sustainable livelihood when the technology, the economics and the rules of the industry are changing faster than we can predict?
I'm not an economist, a security researcher or an AI authority. What follows is a working developer's attempt to sort what is documented from what is speculation, and to decide what to do about it.
The economics of implementation 02
When AI changes what code is worth.
For a long time, software development had a familiar relationship between skill, time and output. A feature needed someone to understand the problem, design a solution, write the code, test it and deploy it. Experience made each step faster, but there were practical limits to how quickly one person could deliver reliable software.
AI is changing that relationship. Developers can use it to generate boilerplate, explore unfamiliar codebases, write tests, investigate errors, draft documentation and speed up implementation. Tasks that once took hours can sometimes be done in minutes.
But faster implementation does not mean software development has become a solved problem.
Generating code is different from deciding what should be built. Producing a working function is different from understanding its security implications. Making a feature pass a test is different from knowing whether the test covers the cases that matter. Software still lives inside a larger system of business requirements, users, data, infrastructure, security and operational constraints.
The economic consequences are real, though. If a client can get the same basic functionality with less development time, the value of simply producing code goes down. Competition increases, delivery expectations rise, and some tasks become easier for non-specialists to do themselves.
For independent developers and consultants, that cuts both ways. AI can make a small team more capable than it could previously afford to be. The same tools lower the barrier to entry for everyone competing with that team.
The question is no longer just how quickly we can write software. It is whether we can identify the right problem, make sound technical decisions, and deliver something that works reliably in the real world.
Attackers and defenders 03
AI is changing cybersecurity, too.
One of the clearest examples of this acceleration is security.
On 15 October 2026, India's Computer Emergency Response Team, CERT-In, issued a critical advisory, CIAD-2026-0049 (opens in a new tab), describing two related problems.
The first came from voluntary disclosures by AI model providers. Their models, while carrying out research and evaluation tasks on the internet, reached live systems belonging to Indian organisations and read business records, using credentials and connection details they found exposed in application configuration, public code repositories and overly permissive cloud roles. In CERT-In's words, the models' actions "exceeded the authorization of their assigned tasks." None of the affected organisations detected the access.
The second was deliberate: a financially motivated campaign against Indian entities in which attackers used publicly available, AI-native offensive-security frameworks for reconnaissance, exploitation and intrusion. CERT-In says this kind of agentic tooling "compressed the time between initial access and final impact from days to a few hours," and that victims who remediated incompletely were attacked again within days.
The distinction that matters most is in the advisory itself: "the root weaknesses are conventional." Credentials left in code, repository history and configuration files. Dormant and test APIs still reachable from the internet. Payment keys stored in plain text. Cloud roles that let ordinary or anonymous callers read and write far more than they should. Management interfaces exposed without multi-factor authentication. None of that is new. What changed is how quickly, exhaustively and at what scale those weaknesses can be found and used.
A week later, a Reuters report (opens in a new tab) published after outages on government websites that followed the disclosure of weaknesses in PHP found that the security professionals it spoke to agreed on one thing: defenders' timelines are getting shorter. They were split on whether AI would lead to a hacker free-for-all. One pointed out that more disclosed vulnerabilities do not automatically mean more successful attacks. That disagreement is worth keeping in mind. The shrinking response window is the consensus; the scale of what follows is not.
There is an uncomfortable lesson here. AI can help defenders find weaknesses before attackers do. It can also help attackers search more widely and move faster. The same technology can improve security and raise the cost of getting security wrong.
I've had a small, recent taste of how quickly "someone else's incident" becomes yours. Earlier this month, Railway, the platform that runs the AP Enterprises backend I built, disclosed a breach of the systems that store customers' secrets, and every value stored there had to be treated as stolen. I've written up how that response went. Nothing I had built was attacked directly; the exposure came from where the secrets lived.
This reaches well beyond dedicated security teams. Developers building ordinary business applications need to take secrets management, authentication, authorisation, dependency security, API exposure and cloud permissions seriously. Teams using AI agents need to decide what those agents can reach, which tools they can call, and whether their permissions are actually restricted. CERT-In's own recommendation is to give each agent run a short-lived, least-privilege identity, which is the same principle behind removing long-lived cloud credentials from a pipeline.
The old assumption that a small application is too insignificant to attract attention is much less reassuring when reconnaissance can be automated.
Security isn't becoming less important because AI can write code. It is becoming more important because the consequences of insecure code can arrive sooner.
Layoffs and skills 04
More complicated than "AI is replacing jobs."
Layoffs across the industry add another layer of uncertainty. Companies are cutting staff while restructuring, reducing costs, changing priorities and investing more heavily in AI. Some explicitly connect workforce decisions to AI. Others cite operational or financial reasons. Some do both in the same breath.
Two announcements from this year show why the wording matters.
In October, FICO disclosed in an SEC filing (opens in a new tab) a plan to eliminate roughly 15% of its positions. The filing lists "integrating AI-driven product development" as one part of the plan, alongside reducing management layers, simplifying its operating structure, and optimising processes and tools. That is AI named as one reason among several. It is not a statement that AI replaced any particular job.
In July, Microsoft cut about 4,800 roles, roughly 2.1% of its workforce. According to ABC News (opens in a new tab), its chief people officer told staff the eliminated roles were not being replaced by AI, while acknowledging that "AI is changing how work gets done."
It would be simplistic to attribute every layoff to AI. Restructuring has many causes, and announcements about AI-driven efficiency do not by themselves establish how many jobs the technology has actually eliminated. Nobody I've read can yet answer that cleanly.
The direction of change still deserves attention. When organisations find that a smaller team with better tools can handle certain work, they reconsider how many people they need for it. At the same time, new products, infrastructure, security problems and AI-related services create new work. The result is not a tidy swap in which every old job disappears and an equivalent new one appears. Some roles shrink. Others change substantially. New ones emerge in different places and ask for different combinations of technical and commercial skill.
That makes career planning harder for people entering the industry, and raises uncomfortable questions about specialisation for people already in it.
Learning a framework is still useful. But building a whole professional identity around one framework, tool or implementation technique is fragile when the cost of doing that task can change quickly. A more durable approach is to understand the principles underneath the tools.
- Knowing React is useful. Understanding how interfaces, state, APIs and user experience fit together is more transferable.
- Knowing how to deploy an application is useful. Understanding networking, permissions, observability, failure recovery and operational trade-offs is more transferable.
- Knowing how to use an AI coding assistant is useful. Knowing how to evaluate its output, catch wrong assumptions and take responsibility for the resulting system is essential.
The goal isn't to predict every skill the market will reward. It is to be able to learn and apply new ones without starting from zero each time the industry changes direction.
The economics of AI itself 05
What happens if the AI boom slows down?
There is another uncertainty that gets less attention from developers: the economics of AI itself.
The industry is pouring money into chips, data centres, power, networking and model development, partly on the strength of expectations about future demand and revenue. In an 8 October report, The AI debt wish (opens in a new tab), Crisil Integral IQ estimated that the combined capital expenditure of the six largest hyperscalers could reach about $1.2 trillion by 2027. It argued that the "heavily front-loaded nature of AI investment heightens financial risk," pointing to the gap between the pace of investment and the speed at which it is being turned into revenue.
Does that mean the AI bubble will burst? Not necessarily, and the report itself frames this as a funding and credit risk, not a prediction.
A technology can be genuinely transformative while some of the businesses built around it are overvalued, some investments fail, and some expectations prove unrealistic. The dot-com era showed that transformative technology and unsustainable valuations can exist at the same time.
If investment keeps growing, the industry will face questions about profitability, infrastructure costs, competition, and whether customers will pay enough for what is being built. If investment slows sharply, the consequences could include cancelled projects, reduced spending, tighter hiring, and pressure on companies whose business models depend on continued expansion. Neither scenario would make AI suddenly useless.
The more useful question is whether the applications being built solve problems valuable enough to justify their cost.
For developers and consultants, that distinction matters day to day. A business rarely needs the most advanced model or the most elaborate AI architecture. It needs something that improves a meaningful outcome at an acceptable cost and risk.
Technological sophistication is not the same thing as economic value.
Practical strategies 06
So how do we make a living in this economy?
There is no strategy that guarantees financial security in a fast-changing economy. Anyone promising one is selling a certainty that doesn't exist. But there are practical ways to improve our position.
Build fundamentals, not just familiarity with tools
Frameworks, libraries, models and platforms will keep changing. Computer science fundamentals, system design, networking, databases, security, debugging and the ability to reason about complex systems are what make new tools learnable.
That doesn't mean everyone has to be an expert in everything. It means understanding enough of the system underneath to make informed decisions instead of following generated instructions blindly.
Use AI for leverage, not as a replacement for judgement
Ignoring AI is unlikely to be a durable strategy for most software professionals. Treating every output as correct is just as risky.
Use it to speed up research, implementation, testing and exploration. Then verify the results. Understand the code that reaches production. Review security-sensitive changes carefully. Keep a person accountable for consequential decisions. The advantage isn't access to AI; everyone has that. It is combining its speed with sound judgement.
Learn to solve business problems
Businesses rarely buy software because it uses an interesting technology. They buy it to reduce costs, increase revenue, run operations better, reach customers, manage risk, or do something they couldn't do before.
Developers who understand those goals make better technical decisions and can explain their value more clearly. For independent developers especially, competing on features delivered or hours worked gets harder as implementation gets cheaper. Understanding the problem, defining scope, choosing sensible trade-offs and delivering a dependable result is a different kind of value.
Understand production, not just implementation
A product that works locally is only one part of a working system. Real applications need secure configuration, database migrations, monitoring, backups, incident response, testing, deployment workflows and recovery plans.
Those responsibilities are easy to skip when the focus is on shipping features, and impossible to ignore once real customers and business operations depend on the software. I've written more about that gap in what it takes to make a system production-ready. AI can help with much of this work. It doesn't remove the need to understand it.
Build financial and professional resilience
Career resilience isn't purely a technical problem. Where you can, keep a financial buffer, avoid depending entirely on one client or income source, build professional relationships before you need them, and keep evidence of the work you can deliver.
For freelancers and consultants, that can mean a portfolio of credible projects, steady relationships with existing clients, and a reputation for solving a specific kind of problem. For employees, it can mean strengthening transferable skills, keeping up a professional network, and staying aware of opportunities beyond the current organisation.
None of this makes anyone immune to layoffs, downturns or sudden shifts in demand. It does reduce dependence on a single employer, client, technology or market condition.
Choose depth without becoming rigid
It's tempting to respond to uncertainty by trying to learn everything. Every new AI framework, language, cloud platform and emerging technology seems to demand attention, and trying to keep up with all of them leaves little time to become genuinely good at any.
A better approach is to go deep in a useful area, understand the disciplines next to it, and pick up new tools when they solve a real problem. Curiosity is an advantage. Unfocused consumption of information is not the same as progress.
The goal isn't to know everything happening in technology. It is to develop the judgement to recognise what matters, and the ability to act on it.
Preparing for change 07
We can't predict the future. We can prepare for change.
I don't think anyone can say with confidence what the technology industry will look like in five or ten years.
AI may advance faster than expected in some areas and run into hard limits in others. Security threats will keep evolving. Some businesses will benefit enormously from AI; others will struggle to justify the cost. Some jobs will disappear, others will change, and new roles will appear. There will be breakthroughs that look obvious in hindsight, and failures that seem inexplicable until we understand the assumptions behind them.
Trying to predict every development is an exhausting way to live and a fragile way to build a career.
I'd rather focus on what is within our influence: how we learn, how carefully we build, how well we understand the problems we solve, how responsibly we use new tools, and how we manage our professional and financial decisions. That isn't a guarantee of success. It is a way to make decisions without needing certainty about the future.
The most valuable skill may not be mastering the next framework or adopting the newest AI tool before everyone else. It may be the ability to move, again and again, from uncertainty to understanding, from understanding to useful work, and from useful work to sustainable value.
Technology will keep changing. The challenge is to build a career that can change with it.
We may not be able to predict where the industry is going. But we can be deliberate about how we navigate it.
Sources 08
What this essay relies on.
Current-event claims are drawn from the sources below, all checked on 29 October 2026. Where an outlet's own page couldn't be accessed directly, the link points to a full syndicated copy.
- CERT-In · 15 October 2026CIAD-2026-0049: AI Agents as Attack Vectors — Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets
- Reuters, via ThePrint · 23 October 2026Raphael Satter and AJ Vicens, "AI-discovered bugs may soon trigger fresh disruptions, cyber experts say"
- Fair Isaac Corporation · Form 8-K, filed 6 October 2026Item 2.05, Costs Associated with Exit or Disposal Activities
- ABC News · 6 July 2026Max Zahn, "Microsoft is laying off 4,800 workers: 'AI is changing how work gets done'"
- Crisil Integral IQ · 8 October 2026The AI debt wish