Which Open Source Tools Can Help Us with Vibe Coding in Cybersecurity?

This issue was brought to you by JupiterOne.

The emergence of large language models (LLMs) has transformed software development. What began as code completion and documentation assistance has evolved into a new development paradigm often described as vibe coding: a workflow in which developers express intent in natural language and allow AI systems to generate, modify, test, and sometimes deploy software on their behalf.

In cybersecurity, vibe coding presents both opportunities and risks. Security professionals increasingly use AI-assisted development to automate repetitive engineering tasks, generate proof-of-concept tooling, create detection rules, build integrations, and accelerate vulnerability research. At the same time, AI-generated code can introduce vulnerabilities, propagate insecure patterns, and create new attack surfaces if not properly governed.

Three scanners. Three verdicts. One CVE. JupiterOne UVM unifies every scanner, dedupes by asset, and tells you who owns it.

See what to fix first

For cybersecurity practitioners, the question is therefore not whether AI-assisted development will become part of the workflow. It already has. The more important question is which open source tools can support secure and transparent vibe coding practices while maintaining the visibility and control required in security-sensitive environments.

Understanding Vibe Coding in a Security Context

The term “vibe coding” typically refers to software development where developers describe desired outcomes rather than manually implementing every component. Instead of writing hundreds of lines of code, a practitioner might prompt an AI agent: “Create a Python utility that parses Suricata logs, extracts suspicious IP addresses, enriches them with threat intelligence data, and exports the results to Elasticsearch.”

The AI generates the implementation, while the human reviews and validates the output. In cybersecurity, this model is particularly attractive because practitioners often work across multiple programming languages and infrastructure platforms. Security engineers may need to switch between Python, PowerShell, Go, JavaScript, YAML, Terraform, Sigma, KQL, and Splunk SPL within a single project.

AI-assisted development reduces the cognitive overhead associated with these transitions. However, cybersecurity environments impose stricter requirements than general software development. Generated code must be evaluated for:

• Secure coding practices

• Supply-chain risks

• Data leakage

• Prompt injection vulnerabilities

• Privilege escalation opportunities

• Regulatory compliance

Research continues to highlight these concerns. Studies examining developer perceptions of AI coding assistants identify recurring concerns regarding insecure code generation, data leakage, licensing issues, and adversarial attacks such as prompt injection.

Similarly, NIST’s guidance on generative AI development emphasises that AI-enabled software workflows must be integrated into established secure software development practices rather than treated as independent systems. Consequently, open source tooling becomes especially attractive because organisations can inspect, audit, modify, and self-host these systems.

Sometimes, you’ve just got to build stuff. So why not join William Collins and John Capobianco for their upcoming talk on Engineering Agentic Network Operations? As a one of our lovely subscribers, you can also get a tasty discount as a thank you for your continued support - so make sure to make the most of the offer!

Don't miss out!

Why Open Source Matters for Cybersecurity Teams

Many popular AI coding environments are proprietary. While these tools may offer excellent developer experiences, they often introduce concerns regarding source code exposure, model transparency, and governance.