Why Rest Alone Rarely Resolves Chronic Pain

Why Rest Alone Rarely Resolves Chronic Pain

If you have been living with chronic pain, chances are someone—perhaps even a well-meaning doctor—told you to “take it easy” and get plenty of rest. It sounds reasonable. When your body hurts, resting feels like the logical response. But here is the problem: for most people dealing with persistent pain, rest alone does not resolve the issue. In many cases, it actually makes things worse.

Physical therapist working with patient on gentle movement exercises

As a physician who has worked with hundreds of chronic pain patients, I have seen this pattern play out repeatedly. Patients spend weeks, months, or even years resting, waiting for the pain to disappear—only to find themselves more debilitated than when they started. The frustration is real, and the discouragement is understandable. But there is a better path forward, and it begins with understanding why rest falls short and what actually works.

The Rest-Pain Paradox

Acute pain—the kind you experience after an injury or surgery—does typically improve with rest. A sprained ankle needs time to heal. A post-surgical incision needs stillness to close. In those scenarios, rest is appropriate and necessary because the tissue itself is damaged and requires a period of protected recovery.

Chronic pain, however, operates under different rules. By definition, chronic pain persists beyond the normal healing window, typically lasting three months or longer. The original tissue damage may have resolved, yet the pain signals continue firing. This means the problem is no longer just about the tissue—it is also about how the nervous system processes and amplifies those signals.

This distinction matters. When we rest indefinitely in response to chronic pain, we are treating a nervous system issue as though it were a tissue damage issue. The result is a cycle of deconditioning, fear of movement, and worsening pain that keeps people trapped.

What Happens When You Rest Too Much

Muscle Weakness and Joint Stiffness

The human body is designed for movement. When we stop moving, our muscles begin to atrophy—sometimes noticeably within just two weeks of inactivity. Joints lose their normal range of motion because the surrounding tissues stiffen. The less you move, the harder movement becomes, and the more painful it feels when you try. This creates a downward spiral where rest leads to more stiffness, which leads to more pain, which leads to more rest.

Changes in Pain Sensitivity

Prolonged inactivity actually changes how your nervous system responds to sensation. Research has shown that when people avoid movement due to fear of pain, their nervous systems become more reactive to any stimulus—a process called central sensitization. A gentle touch might feel uncomfortable. A mild stretch might register as threatening. Your brain and spinal cord essentially turn up the volume on all incoming signals, making everyday activities feel more painful than they should.

A landmark review published in JAMA highlighted that fear-avoidance behavior is one of the strongest predictors of long-term disability in chronic pain patients. The message is clear: avoiding movement does not protect you. It primes your system to hurt more.

Mood, Sleep, and the Downward Spiral

Chronic inactivity also takes a toll on mental health. Physical activity stimulates the release of endorphins, serotonin, and other neurochemicals that regulate mood and reduce anxiety. Without regular movement, people are more vulnerable to depression and anxiety—both of which amplify the pain experience.

Woman experiencing back discomfort while sitting on couch

Sleep quality often deteriorates too. Without the physical fatigue that comes from healthy movement, falling and staying asleep becomes harder. Poor sleep, in turn, lowers your pain threshold, creating yet another feedback loop that keeps you stuck.

The Evidence: Movement as Medicine

If prolonged rest worsens chronic pain, then what helps? Decades of research point consistently toward active approaches—particularly graded exercise, physical therapy, and progressive movement retraining.

Graded Activity

Graded activity means starting with small, manageable amounts of movement and gradually increasing over time. Rather than jumping into an exercise program that feels overwhelming, you begin where you are and build from there. The goal is not to push through pain, but to gently challenge your body in a way that builds tolerance and confidence.

A comprehensive Cochrane review found that exercise therapy reduced pain severity and improved physical function in adults with chronic pain across multiple conditions, including low back pain, fibromyalgia, and osteoarthritis. The effect sizes were modest for any individual session, but the cumulative benefit over time was meaningful and lasting.

Neuroplasticity and Pain Reprocessing

One of the most promising areas of chronic pain research involves neuroplasticity—the brain’s ability to reorganize itself based on experience. When chronic pain persists, the brain develops well-worn neural pathways that associate movement with danger. But just as these pathways were created, they can also be reshaped.

Gradual, repeated exposure to safe movement helps the brain learn that activity is not a threat. Over time, this retrains the nervous system to dial down its alarm response. This is not about ignoring pain or pushing through it aggressively. It is about careful, supported re-engagement that teaches your body a new normal.

The Role of Education

Understanding how pain works can itself be therapeutic. The National Institute of Neurological Disorders and Stroke emphasizes that pain neuroscience education—learning about why chronic pain persists even after tissues have healed—helps patients shift from a fear-based mindset to a more confident, active approach. When you know that hurt does not always equal harm, you are more willing to engage in the movements that will ultimately help you recover.

Building a Smarter Recovery Plan

Abandoning the rest-only approach does not mean jumping into intense exercise that leaves you flaring for days. A smart recovery plan is thoughtful, progressive, and adapted to your starting point.

Start Lower Than You Think

One of the most common mistakes people make is doing too much too soon, experiencing a flare, and concluding that movement does not work. Instead, begin at a level that feels almost too easy. If that means a five-minute walk, that is a perfectly valid starting point. Consistency matters more than intensity, especially in the early stages.

Pace, Do Not Push

Pacing means spreading activity throughout the day rather than cramming it all into one burst. If you can walk for ten minutes but feel worse afterward, try two five-minute walks instead. The total movement is similar, but the demand on your system is distributed more gently. Over time, you can extend those windows as your tolerance grows.

Include Variety

Group of people exercising together in a wellness class

Different types of movement serve different purposes. Gentle stretching maintains joint mobility. Walking builds endurance and cardiovascular health. Resistance training—yes, even for people in pain—strengthens the muscles that support and protect vulnerable joints. Mindful movement practices like yoga or tai chi can improve balance, body awareness, and relaxation. A varied approach prevents overuse in any one area while building broad resilience.

Work With a Professional

If you have been resting for a long time, returning to movement can feel daunting. A physical therapist or movement specialist experienced in chronic pain can design a program tailored to your needs, help you interpret your body’s signals accurately, and adjust the plan as you progress. You do not have to figure this out alone.

When Rest IS Appropriate

None of this means rest is never helpful. There are absolutely times when scaling back is the right call:

  • During an acute flare, brief periods of rest (hours, not weeks) can help you settle before resuming gentle activity.
  • Immediately after a new injury or surgery, protected rest supports initial healing.
  • If a specific movement causes sharp, shooting, or escalating pain, it makes sense to modify or pause that activity—and consult a professional about what is happening.

The key distinction is duration and intention. Short, targeted rest is part of a balanced recovery strategy. Prolonged withdrawal from movement is not.

Moving Forward With Hope

If you have been told that rest is the answer for months or years and your pain has not improved, that is not a personal failure. It is a signal that the approach needs updating. The encouraging truth is that your body is adaptable. Your nervous system can change. And you can gradually reclaim activity and quality of life—even if it does not feel possible right now.

Recovery from chronic pain is rarely linear. There will be better days and harder days. But by shifting away from rest as the default and toward progressive, supported movement, you give your body the conditions it actually needs to adapt and heal. That is not wishful thinking—it is what the evidence supports, and it is what I have witnessed in practice time and again.

Frequently Asked Questions

How long should I rest after a pain flare before trying to move again?

For most chronic pain flares, brief rest of a few hours to a day is usually sufficient to let the most intense symptoms settle. After that, gentle movement—such as short walks or easy stretching—tends to help more than continued inactivity. If a flare lasts longer than a few days or keeps recurring, it is worth discussing with your healthcare provider.

What if movement causes more pain—does that mean I am causing damage?

Not necessarily. During a return to activity, it is common to experience some discomfort as your body adapts to demands it has not handled in a while. This is different from sharp, acute pain that signals tissue injury. A good rule of thumb: mild soreness that resolves within a few hours is likely acceptable, while pain that spikes sharply or lingers for days may mean you need to adjust the dosage or type of movement. A physical therapist can help you tell the difference.

Can someone who has been inactive for years still benefit from starting a movement program?

Absolutely. Research shows that even people who have been sedentary for extended periods can make meaningful gains in pain reduction and function when they begin a progressive movement program. The key is starting at an appropriate level and increasing gradually. It is never too late to begin, and the benefits are real at every stage of life.

GitHub Copilot’s Agent Mode vs. Cursor: A Senior Engineer’s Honest Field Report After 90 Days

The Setup: Why I Decided to Actually Test Both

Three months ago, I did something that probably made my manager nervous. I decided to spend 90 days treating GitHub Copilot’s freshly announced Agent Mode and Cursor as serious contenders for my primary development environment. Not as side projects or weekend experiments, but as the actual tools I’d use to ship code that would end up in production systems. I’ve been writing software professionally for long enough to know that the gap between a tool’s marketing narrative and its real-world utility is usually measured in disappointment, so I wanted to find out whether either of these could genuinely change how I work.

The timing felt right. GitHub announced Copilot Agent Mode in public preview back at GitHub Universe in October 2024, and it promised something that had previously lived in the realm of science fiction: multi-step autonomous task execution happening directly inside VS Code without ever leaving the editor. Meanwhile, Cursor had just completed a Series B raise at a $2.5 billion valuation in August 2024, which suggested that serious money was betting on AI-native IDEs as a fundamental shift rather than a passing trend. When 76% of developers are either using or planning to use AI coding tools according to the Stack Overflow Developer Survey 2025, it feels less like a prediction and more like a statement of where the industry is already headed.

Agent Mode: Watching the Code Write Itself (Mostly)

Here’s what surprised me most about Copilot’s Agent Mode: it’s genuinely more capable than I expected, and genuinely more limited than the marketing suggests. The feature works by letting you describe a task in natural language, then it orchestrates multiple steps to accomplish it. You can watch it branch out, explore your codebase, make edits, run tests, and iterate. It feels like having a junior engineer at your shoulder who can actually type faster than you and doesn’t need coffee breaks.

The real win is that everything happens inside VS Code with no context switching. You don’t open a separate window, you don’t paste code into a chat interface, you don’t wait for API responses to load in a browser. For experienced engineers, that friction reduction matters more than you’d think. I found myself using Agent Mode for boilerplate work, test generation, and refactoring tasks that would normally require three context switches to get through. The tool uses GitHub’s remote repository graph for indexing, which gives it visibility into dependency trees and cross-repository relationships that a locally-indexed tool wouldn’t have.

The limitation? Agent Mode works beautifully for tasks that fit neatly into its mental model. Generate tests for this class. Add this feature to the API. Refactor this module. But when I tried to use it for exploratory work, for decisions that required me to validate assumptions about system behavior, or for problems where the right answer was genuinely ambiguous, it would confidently charge forward and write code that required my full attention to debug. It wasn’t exactly wrong. It just operated at a lower resolution than my thinking required.

Cursor: The Integrated Alternative That Actually Ships

Cursor arrived with a different philosophy. It’s not trying to be VS Code with a plugin. It’s a purpose-built IDE that treats AI assistance as the fundamental organizing principle of the editor, not a feature bolted on afterward. The Composer mode does something conceptually similar to Agent Mode, but with a crucial difference: it uses local embeddings for codebase indexing rather than hitting GitHub’s remote graph. That means faster queries on large codebases, fewer API round-trips, and a different tradeoff profile on privacy and latency.

What I noticed immediately was that Cursor feels less like a powerful autocomplete and more like an actual collaborator. The Composer interface lets you describe multi-file refactorings, and Cursor walks through the changes with you before applying them. You see the diffs. You can push back. You can say “no, that’s not quite right, here’s what I meant.” It’s collaborative in a way that Agent Mode, despite being more autonomous, isn’t. There’s something genuinely satisfying about working with a tool that invites you to shape its thinking rather than just watching it execute.

That $2.5 billion Series B valuation wasn’t just venture hype. I watched Cursor handle a three-file refactoring on a legacy service that would have taken me an hour to think through and debug. It took Cursor roughly five minutes of back-and-forth conversation. That’s not hyperbole. That actually happened, and I’m still thinking about what that represents across a full year of development work.

The Numbers Worth Knowing

GitHub has been transparent about scale. Copilot had surpassed 1.8 million paid subscribers by early 2025 and was generating over $100 million in annual recurring revenue, making it one of Microsoft’s fastest-growing developer products. Most developer tools plateau at user counts that would be disappointing for a consumer app. That many paid seats suggests teams have already decided the investment pays for itself.

The shift from 44% in 2023 to 76% in 2025 according to the Stack Overflow Developer Survey is the kind of adoption curve that usually precedes a fundamental reshaping of how work gets done. It’s not early adopters anymore. It’s not even early majority. This is becoming table stakes in the same way version control became non-negotiable after GitHub and Git proved their value.

The Honest Assessment: Which One Should You Actually Use

If you’re already deep in the GitHub ecosystem, already paying for Copilot, and already comfortable in VS Code, Agent Mode is a genuine productivity multiplier. It’s not going to replace your thinking, but it will eliminate categories of busywork that have accumulated around the edges of development. You can check out the GitHub Copilot agent mode documentation to get started, and I’d specifically recommend testing it on test generation first. That’s where I saw the most consistent value.

If you’re willing to migrate your environment and you work on large codebases where local indexing makes a real difference, Cursor is hard to dismiss. The privacy model is cleaner for teams with compliance requirements. The UX for multi-file changes feels more thoughtful. The integration with your actual development workflow is tighter because the entire editor was designed around AI assistance from the start. You’ll probably switch back and forth a few times before deciding, and that’s fine. Both tools are good enough that the differences come down to preference and architecture.

The real story is that the 90-day experiment changed how I think about what a development tool can be. These aren’t replacements for expertise. They’re not going to make good engineers out of people who aren’t willing to think deeply about problems. But they do represent a genuine shift in velocity for experienced engineers who know how to direct them. Both tools are well-funded, adoption is accelerating, and the underlying assumption of the entire category, that AI assistance belongs at the center of your workflow rather than the periphery, seems like it’s settled now.

What’s your experience been with these tools? Have you found workflows where one clearly outperforms the other? Drop a note in the comments or find me on your platform of choice. I’m genuinely curious what patterns other senior engineers are seeing in their own experiments.

Salt Typhoon’s Gift: How a Year-Long Telecom Breach Is Forcing Engineers to Build Better

The Breach That Shouldn’t Have Happened (But Did, For a Year)

Late 2024 brought one of those moments in security that makes you simultaneously angry and unsurprised. The FBI and CISA confirmed what researchers had been tracking: Chinese state-sponsored actors, operating under the label Salt Typhoon, had compromised at least nine major US telecommunications carriers including AT&T and Verizon. The real gut-punch? They’d been inside some of these networks for over a year before detection. Not weeks. Not months. A year. This is the kind of dwell time that makes you question every assumption you’ve made about network visibility.

Salt Typhoon's Gift: How a Year-Long Telecom Breach Is Forcing Engineers to Build Better
Salt Typhoon’s Gift: How a Year-Long Telecom Breach Is Forcing Engineers to Build Better

What makes this particularly instructive for those of us building network-adjacent systems is how boring the actual attack vectors were. No zero-day exploits requiring three simultaneous hardware failures. No quantum computing nightmare scenarios. The CISA Salt Typhoon advisory methodically outlined the actual toolkit: legacy SNMP configurations still broadcasting default credentials like it’s 2003, unpatched edge devices from Cisco and Fortinet sitting in production waiting to be exploited, and network segmentation that was either nonexistent or so poorly implemented it may as well have been. This is what happens when you bolt security onto systems that were never designed for it. And then wait years to fix it.

Illustration for Salt Typhoon's Gift: How a Year-Long Telecom Breach Is Forcing Engineers to Build Better
Illustration for Salt Typhoon’s Gift: How a Year-Long Telecom Breach Is Forcing Engineers to Build Better

The CVE That Became a Masterclass in Why Patching Actually Matters

Cisco disclosed in November 2024 that attackers had exploited CVE-2023-20198 in IOS XE. Perfect CVSS score: 10.0, meaning literally as bad as it gets. The timing detail that should keep you up at night? A patch existed for over a year before anyone confirmed the exploitation. We’re talking about a window where the technical community knew exactly what was broken, exactly how to fix it, and yet those patches somehow never made it onto carrier-grade equipment managing the backbone of US telecommunications.

I want to be careful here about blame allocation. It’s easy to sit in 2025 and wonder why patches weren’t applied. The reality is far more interesting from an engineering perspective. Carrier networks aren’t like your SaaS infrastructure where you can push updates during your maintenance window. These systems move packets that route emergency calls, financial transactions, and yes, military communications. A failed patch doesn’t cost you a few users refreshing their browsers. It costs millions in revenue within minutes and potentially lives in the worst case. But that constraint cuts both ways: it’s precisely because the stakes are so high that security needs to be architected in, not bolted on. The fact that a patch sat available for over a year while the vulnerability remained exploitable tells me the patch evaluation and testing process was bottlenecked somewhere critical.

Enter the Mandate: How 2025’s FCC Rules Are Reshaping the Game

This is where things get genuinely interesting for engineers building systems that touch telecom infrastructure. The FCC, in a rare moment of regulatory decisiveness, issued new cybersecurity rules in January 2025 under Section 105 of the Communications Act. For the first time, carriers now face a binding mandate to submit annual cybersecurity risk management plans. This isn’t a suggestion. This isn’t a voluntary framework. This is a legal requirement with teeth.

What does this mean for you if you’re designing network management interfaces, monitoring systems, or anything that interfaces with carrier-grade infrastructure? Your threat model just got a lot more formal. The FCC cybersecurity rulemaking proceeding established specific documentation requirements around network segmentation, access controls, and incident detection capabilities. These requirements are going to cascade down to vendors. If you’re selling network management software to a carrier that needs to submit a credible risk management plan in 2026, that carrier’s procurement team is going to start asking very specific questions about your architecture. Can you prove network segmentation? Can you demonstrate that legacy protocols are properly isolated? Can you show that unpatched systems are actually unpatched systems and not critical infrastructure?

The 47-Million-Dollar Question: What Post-Breach Remediation Actually Costs

A February 2025 Mandiant report studied organizations in Salt Typhoon’s wake and found something sobering: 73% of affected organizations needed a complete re-architecture of their carrier-grade network management interfaces. The average remediation cost per carrier? 47 million dollars. Let that sink in. Forty-seven million dollars per organization. That’s not including legal settlements, regulatory fines, or the institutional knowledge lost to teams that became hyperfocused on containment and recovery for months.

This number does something important. It transforms cybersecurity from an abstract threat into a concrete business problem with a price tag attached. When you’re in a design meeting debating whether to implement proper network segmentation, whether to retire a legacy SNMP implementation, whether to enforce stricter access controls on management interfaces, you can now point to a specific number. Not as a scare tactic, but as data. The cost of doing it right up front is always less than the cost of doing it wrong and paying for it later. Always.

What This Means For How You Should Build Tomorrow

If you’re designing systems that touch telecommunications infrastructure, the message from 2025 is clear: segmentation isn’t optional anymore, legacy protocols need explicit justification and encapsulation, and patching pipelines need to be treated as first-class infrastructure problems rather than operational overhead. The systems that survive the next wave of regulatory scrutiny won’t be the ones with the fanciest features. They’ll be the ones where security was woven into the architecture from day one, where assumptions were validated rather than inherited, and where the cost of complexity was weighed against the cost of vulnerability.

Salt Typhoon was a failure. Full stop. But failures have a peculiar value if you’re paying attention. They expose the gap between how we think systems work and how they actually work. They show us which assumptions were dangerous and which were sound. The teams currently rebuilding carrier networks at 47-million-dollar scale aren’t learning these lessons for theoretical reasons. They’re learning them because the cost of not learning is too high to ignore. Worth thinking about before your next architecture review.

What’s your read on this? If you’ve worked on carrier-adjacent systems or large-scale infrastructure, I’m curious whether the new regulatory pressure feels like a forcing function for genuine improvement or just bureaucratic overhead. Drop your thoughts in the comments or reach out if you want to dig deeper into any specific attack vector or remediation strategy.

GitHub Copilot Workspace Six Months In: The Hype-Reality Gap Is Smaller Than You Think

The Numbers Don’t Lie, But They Don’t Tell the Whole Story Either

Six months into general availability, GitHub Copilot Workspace has become the kind of product that generates strong opinions at standup meetings. Some teams swear by it. Others have quietly shelved it after a week of experimentation. Microsoft’s latest earnings report showed GitHub Copilot driving a 21 percent year-over-year revenue jump, with Workspace specifically cited as the engine behind enterprise upsells, so the business case is clearly resonating somewhere. The paid enterprise subscriber base jumped from 1.3 million last October to 1.8 million now. That’s genuine momentum.

But here’s where I pump the brakes. Revenue growth doesn’t automatically mean the product solves the problem we thought it solved. I’ve watched enough “revolutionary” tools get adopted at scale only to discover people were using them in ways that had nothing to do with the original pitch. So let’s dig into what the actual data reveals about Workspace adoption and, more importantly, what it suggests about where AI-assisted development is actually heading.

The Pull Request Acceleration Is Real, But You’re Paying for It Somewhere

GitHub’s own engineering data shows that Workspace-assisted pull requests go from issue to creation in roughly 1.8 hours on average, compared to 4.2 hours using traditional workflows. That’s a 57 percent reduction in cycle time. As someone who’s spent years trying to optimize development velocity, I’ll admit that’s compelling. Faster feedback loops genuinely matter, especially for teams shipping on tight cadences.

The catch is that reviewer burden on complex pull requests climbed by 18 percent. This is the part nobody wants to talk about at the product launch event. Workspace can generate code fast. Whether that code is correct, maintainable, and actually solves the problem at hand? That remains very much a human decision. The tool is essentially shifting work from the author to the reviewer, which feels like progress on a metrics dashboard until you realize your senior engineers are now spending more time reading AI-generated diffs than they would have spent helping someone think through the architecture in the first place.

The real question is whether you’ve optimized for actual productivity or just cycle time. Sometimes they’re the same thing. Often they’re not.

The Confidence Gap Is the Signal Everyone Should Be Watching

The Stack Overflow Developer Survey 2025 found something genuinely interesting: 62 percent of developers using AI coding tools reported increased output. That’s a solid majority. But only 34 percent reported higher confidence in code quality. That’s the real story hiding in the data.

We’ve built a system that makes developers faster at producing code they’re less sure about. In some contexts, that’s fine. Scaffolding boilerplate? Great. Expanding test cases? Useful. Refactoring a critical authentication flow? The fact that most developers don’t trust the output suggests we should probably slow down there.

This confidence gap has real implications. Reviewers work harder. Testing needs to be more rigorous. You can’t just measure success by looking at commit frequency and call it a win. The tool is introducing a new tax on code review that most organizations haven’t accounted for yet.

Enterprise Adoption Is Accelerating Faster Than Tooling Maturity

The 38 percent growth in paid enterprise subscribers in six months tells you that CTOs and engineering leaders see genuine value in Workspace. They’re voting with budgets. But adoption velocity and tool maturity don’t always move in sync. Right now, we’re in a phase where organizations are experimenting aggressively, trying to figure out where Workspace actually delivers and where it creates more work than it saves.

The GitHub Copilot Workspace documentation has expanded substantially since launch, but the real learning is happening in distributed engineering teams developing their own integration patterns. Some teams use it as an aggressive first-pass code generation tool with mandatory rigorous review. Others treat it more cautiously, deploying it primarily for well-defined, predictable tasks. There’s no consensus yet on best practices because the product is genuinely new in how it shapes development workflows.

What concerns me slightly is that revenue growth might be outpacing actual usage optimization. We’ve seen this before with other dev tools. Initial adoption is strong because the promise is compelling. Sustainable adoption depends on teams actually integrating the tool into working processes that make sense for their context. That’s harder work than the first six months of enthusiasm suggest.

Where This Actually Gets Interesting

The real test of Workspace isn’t whether it can accelerate code generation. It’s whether teams can integrate it without sacrificing code quality, maintainability, or the human judgment that separates code that works from systems that hold up over time. Six months in, the data suggests we’re genuinely making progress on cycle time. We’re also learning that the confidence gap matters more than the speed gain.

If you’re evaluating Copilot Workspace for your team, the honest answer is that it depends on your problem. For straightforward tasks with clear specifications, the acceleration is real and worth the review overhead. For novel problems or deeply architectural decisions, the tool is less helpful than your senior engineers arguing it out in a design doc. Most real work falls somewhere in between, which is where the interesting questions live.

I’m genuinely curious how organizations are solving this in practice. Are you using Workspace actively? What tasks are you trusting it with, and where are you drawing hard lines? The gap between enterprise adoption numbers and actual productive integration patterns is where the next chapter of this story gets written.

One Year In: Why Engineering Teams Are Botching the NIST CSF 2.0 Govern Function

The Govern Function Arrived With a Mandate Nobody Was Ready For

February 2024 feels like yesterday and five years ago simultaneously. That’s when NIST dropped Cybersecurity Framework 2.0, and with it, a sixth function that fundamentally shifted how we’re supposed to think about security architecture. If you’ve been through enough compliance cycles, you know the drill: frameworks arrive, consultants pivot their decks, security teams scramble, and then most organizations sort of half-implement whatever feels closest to their existing structure.

One Year In: Why Engineering Teams Are Botching the NIST CSF 2.0 Govern Function
One Year In: Why Engineering Teams Are Botching the NIST CSF 2.0 Govern Function

Except this time feels different. The Govern function isn’t a technical control you can bolt onto your infrastructure. It’s an organizational restructuring wrapped in risk language, designed to make cybersecurity everybody’s problem, starting with the boardroom. The function explicitly targets organizational accountability structures, documented risk tolerance statements, and the cascade of decision-making that determines whether your company ships a product with known vulnerabilities or holds the line.

Here’s the problem: engineering teams hate it because it requires them to articulate things they’ve never had to articulate before. Security leadership hates it because it exposes how much of what they do has been theater. And the C-suite hates it because accountability flows upward, not sideways.

Illustration for One Year In: Why Engineering Teams Are Botching the NIST CSF 2.0 Govern Function
Illustration for One Year In: Why Engineering Teams Are Botching the NIST CSF 2.0 Govern Function

The 31% Problem and What It Actually Means

SANS released their 2025 survey results, and the headline was predictable enough: only 31% of organizations have fully mapped their security programs to the new Govern function. You could read that and think “okay, adoption lag, same as always.” But that’s not what’s actually happening.

The real story is that 69% of organizations either haven’t started mapping to Govern or have done it incompletely and know it. That’s not a gradual ramp-up problem. That’s a structural misalignment problem. Govern isn’t an add-on to your existing security program the way you might add a new detection layer or implement a new SIEM. It’s a prerequisite for the other five functions working coherently.

Think about this: if you don’t have documented organizational risk tolerance, how are you supposed to know whether your Identify and Protect functions are even calibrated correctly? You’re flying blind with extremely precise instruments. You know your threat landscape. You’ve mapped your assets. You’ve implemented controls. But you haven’t actually told anyone what level of risk the organization is willing to absorb. That’s Govern, and it’s the foundation everything else rests on.

The friction happens because Govern requires conversations that most engineering teams have never been forced to have with leadership. “What’s our risk appetite?” isn’t a technical question. It’s a business question that requires business leaders to make explicit choices, document them, and accept the consequences when incidents happen.

Supply Chain Risk Got Real, And the Framework Finally Caught Up

SolarWinds. XZ Utils. MOVEit. Log4Shell in countless supply chains. The original CSF from 2014 treated supply chain risk like it was someone else’s problem. It existed in the periphery, mentioned in passing, never integrated into the core decision-making structure. That gap cost companies billions.

CSF 2.0 didn’t just add supply chain considerations. It created a dedicated subcategory under Govern specifically for supply chain risk management. GV.SC lives at the governance level, which means your supply chain risk strategy has to flow from your organizational risk tolerance statement, not emerge from a security working group’s wishful thinking.

This matters because supply chain attacks don’t respect the perimeter. They don’t care about your firewall rules or your IDS signatures. They arrive through trusted relationships, wrapped in legitimacy, often with code signing certificates and everything that makes them look internal. If your governance structure doesn’t explicitly account for supply chain risk and doesn’t make it a board-level concern, you’re operating with incomplete threat modeling.

By moving supply chain risk into Govern, NIST forced organizations to make supply chain decisions at the same level where they make strategic business decisions. That’s not paranoia. That’s recognizing that your supply chain is your perimeter.

Why the Human Element Keeps Winning

Verizon’s 2025 Data Breach Investigations Report landed with its annual gravity, and one number should be hammering on your brain: 68% of breaches involved a human element. Not 40%. Not 55%. Sixty-eight percent. That’s not a security problem. That’s a governance problem.

You can’t engineer your way out of a problem that’s fundamentally about how humans make decisions under pressure, uncertainty, and competing incentives. A developer shipping code faster than is wise. An operations person clicking a link because they trust the sender. A procurement team approving a vendor without proper scrutiny because the business deadline won’t bend.

The Govern function, when implemented correctly, creates the structural conditions where these decisions get made differently. Not because people become more virtuous, but because the decision-making framework itself has changed. You’ve documented your risk tolerance. You’ve made supply chain risk a governance concern. You’ve connected cybersecurity accountability to business outcomes. Now when someone asks “can we cut corners on this implementation?” the answer has to flow through a documented framework instead of being negotiated in the hallway.

That doesn’t eliminate human error. But it shifts the probability distribution in your favor.

The Signal vs The Noise: What’s Actually Worth Your Attention Right Now

If you’re an engineering leader reading this in 2025, here’s the signal worth extracting: that 31% adoption rate for Govern isn’t staying at 31%. Regulatory bodies are starting to reference CSF 2.0 explicitly. Insurance underwriters are asking about it. Customers with government contracts are making it a compliance requirement. Adoption will accelerate.

But the acceleration will be ugly because most organizations will try to Govern-wash their existing programs. They’ll create a risk tolerance statement that says “we tolerate all risks we haven’t discovered yet” and call it done. They’ll map their supply chain inventory to GV.SC and think the work is finished. They’ll miss the entire point, which is that Govern is supposed to change how your organization makes decisions, not create another checkbox on a compliance spreadsheet.

The organizations that will have genuine security advantages in 2026 and beyond aren’t the ones that adopt CSF 2.0 fastest. They’re the ones that use the Govern function as an opportunity to restructure how their security and business decision-making interact. The ones that use documented risk tolerance as a forcing function for real conversations between engineering, security, and executive leadership. The ones that treat supply chain risk as a core input to business strategy rather than an addendum to the security program.

If your organization is still in the 69%, now is the moment. Not because compliance demands it, but because your actual vulnerability surface depends on getting this right. Start with the documentation. Make it specific. Make it real. Make it the foundation of how decisions flow through your organization.

For more detail on what Govern actually entails and how it integrates with the other five functions, the NIST Cybersecurity Framework 2.0 official documentation is surprisingly readable. And if you want to understand what the human element actually looks like in real breaches, the Verizon 2025 Data Breach Investigations Report is mandatory reading for anyone making security architecture decisions.

What’s your organization’s Govern implementation status? Are you in the 31% or still building the framework? Curious what specific friction points you’re hitting with leadership on risk tolerance documentation. Drop a note in the comments.

OpenTelemetry Is Now Table Stakes: How the OTel 1.0 Stable Spec Is Reshaping Observability Vendor Lock-in in 2026

The Inflection Point We’ve Been Waiting For

There’s a specific moment in the lifecycle of every infrastructure technology where it stops being a bet and starts being table stakes. OpenTelemetry just crossed that threshold, and if you’re not tracking what this means for your career and your organization’s architecture, you should be. The stable 1.0 specification across logs, metrics, and traces landed in 2024, and by early 2026, the CNCF reported OTel as the second most active project in its entire portfolio by contributor count. Only Kubernetes operates at higher velocity. That’s not hype. That’s gravity.

I’ve watched enough technology cycles to know the difference between genuine adoption and analyst-driven narrative. This is genuine. When a specification reaches that level of momentum, backed by every major cloud provider and a majority of observability vendors, you’re looking at an architectural inflection point. The days of waking up locked into a proprietary agent instrumentation story are genuinely numbered. And more importantly for you as an engineer or architect, the career dynamics are shifting faster than most people realize.

Vendor Lock-in Just Became a Liability, Not a Feature

Let me be direct: the observability vendor community is having a very different conversation than they were eighteen months ago. Datadog reported that 34% of their new enterprise customers were arriving with existing OpenTelemetry instrumentation already in place, during their Q3 2025 earnings call. Their CEO acknowledged this was fundamentally changing the nature of their onboarding and pricing conversations. When the category leader’s growth math is getting disrupted by customers who’ve already instrumented themselves with open standards, the game has changed.

This isn’t theoretical. It’s already reshaping how contracts are negotiated, how technical evaluations are run, and how engineers position themselves. If you’ve spent the last five years architecting around a vendor’s proprietary SDKs and agents, you’re now maintaining legacy infrastructure. That stings to hear, but it’s true. The engineers who positioned for OpenTelemetry early, or who are making that migration now, are the ones building toward the 2026 reality. The ones doubling down on closed instrumentation are increasingly exposed.

Portability Has Become the Primary Motivation, Not Cost

Honeycomb’s 2025 State of Observability report surveyed a thousand engineers about their adoption patterns. What jumped out: 58% cited vendor portability as their primary reason for moving to OpenTelemetry. Cost reduction, which used to dominate these conversations, came in at 44%. That reordering tells you something important about how engineers now think about observability architecture. It’s not about squeezing another few basis points out of your observability budget. It’s about having the optionality to walk away from a vendor without rewriting your entire instrumentation layer.

That shift in motivation is career-relevant in a concrete way. If you’re involved in observability architecture decisions, portability is now your leverage point in vendor conversations. It used to be vendor-specific features. Now it’s “will this work with OpenTelemetry?” If a vendor can’t give you a clear answer, that’s a red flag. And for your personal brand as an engineer, understanding OpenTelemetry’s architecture and deployment patterns has gone from “nice to know” to “expected competency” for anyone working on observability at scale.

The Cloud Providers Just Locked in the Standard

AWS, Google Cloud, and Azure all announced native OpenTelemetry pipeline support in their managed observability services during 2025. Let that sink in. The three providers that collectively represent the vast majority of cloud infrastructure deployment have all essentially said: “We’re making OTel a first-class citizen in our platform.” That’s not a vote of confidence. That’s a declaration that proprietary agent instrumentation is now a legacy architecture decision for new projects.

In practical terms, if you’re building new infrastructure on managed cloud observability services, you’re going to get better performance, tighter integration, and lower friction if you instrument with OpenTelemetry. The cloud providers have aligned their engineering incentives with the open standard. They’re not going to continue maintaining separate, optimized pathways for proprietary agents when they can route everything through OTel and let their customers choose what observability vendor sits on top.

The Scale Has Become Undeniable

The OpenTelemetry Collector, the open-source component that handles ingestion and processing of telemetry data, was processing over 10 billion daily spans across known public deployments by late 2025. That’s a 4x increase from 2023 figures. Check the CNCF project metrics and devstats if you want to see the real-time velocity. This isn’t small-scale adoption anymore. This is infrastructure-grade adoption. The Collector is running in enterprises large enough that their span volume would make most engineers’ eyes water.

Here’s what actually matters: the network effects have locked in. OTel is no longer the “up-and-coming standard.” It’s the standard. The observability vendors you’re evaluating are all optimizing for OTel ingestion now because their customers demand it. The SDKs and exporters are battle-tested at scale. The documentation is solid. If you want to know where to invest your time and energy in 2026, understanding OpenTelemetry architecture and deployment patterns is as foundational as understanding containerization was five years ago. The OpenTelemetry project documentation is the right place to start getting fluent.

What This Means for Your Next Move

Here’s the pragmatic take: if you’re looking at observability infrastructure decisions in 2026, the question has shifted from “Should we use OpenTelemetry?” to “How do we instrument with OpenTelemetry and maintain optionality on the backend?” That’s a healthier architecture question. It separates the instrumentation layer from the vendor layer, which is exactly where that boundary should be.

For your career, pay attention to this signal. The engineers who are actively building, deploying, and operationalizing OpenTelemetry infrastructure right now are going to be the ones with the most relevant skills when this fully matures. The vendor lock-in game that dominated observability conversations for the last decade is being fundamentally reshaped. Get ahead of that curve.

What’s your current observability architecture looking like? Are you still primarily vendor-instrumented, or have you already started the migration? If you’re at that decision point, I’d be genuinely interested in hearing what’s actually blocking your OTel adoption. The obstacles aren’t usually what people think they are.

Cursor, Windsurf, and the IDE Wars of 2025: What a Grizzled Dev Actually Thinks After Six Months

The Market Just Got Interesting (and Weirdly Confusing)

Six months ago, I would have told you the IDE landscape was basically settled. VS Code owns the volume game. JetBrains owns the professional segment. Everyone else is fighting for scraps. Then 2025 happened, and suddenly we’re watching billion-dollar rounds and strategic acquisitions that suggest the entire category might be reshuffling in real time.

Cursor raised $900 million at a $9 billion valuation in early 2025. Let that number sit for a moment. That’s not venture enthusiasm about a category—that’s institutional conviction that AI-native development tools have become central to how code gets written. The valuation alone tells you that investors believe this is not a feature layer anymore. It’s an infrastructure shift.

What makes this especially spicy: Windsurf by Codeium launched as a direct competitor using its own distribution channel, and then OpenAI acquired them for a reported $3 billion mid-year. So now we have the model provider itself playing IDE vendor. That’s not fragmentation. That’s vertical integration in real time, and it changes the entire game theory.

Performance Metrics Are Starting to Matter More Than Hype

Here’s where my grizzled skepticism actually softened a bit. For years, AI coding tools were all marketing and vibes. Now there’s actual benchmarking. The research firm Arro ran tests on multi-file refactoring tasks and found something that surprised exactly no one who understands transformers but still deserves emphasis: context window size matters more than you’d think. Models with 128K or larger context windows outperformed smaller-context competitors by 34% on their benchmark suite. Parameter count alone didn’t predict performance. It was the window that mattered.

This has direct career implications, which is why I’m mentioning it. If you’re evaluating tools based on marketing copy and model names, you’re solving the wrong problem. The real question is whether your tool can hold your entire feature branch in working memory. Can it refactor across five related files without hallucinating API calls? That’s where the daylight opened up between the pretenders and the actual contenders.

Windsurf made specific claims about its Cascade agent model producing fewer hallucinated API calls than Copilot in internal benchmarks. Cursor users reported similar gains. Whether these claims hold across your actual codebase is something you have to test yourself, but the fact that vendors are now competing on false positive rates and not just “AI writes code” is genuinely healthier for everyone involved.

Adoption Patterns Tell a Story About Generational Splits

JetBrains’ 2025 State of Developer Ecosystem report landed with some fascinating numbers. VS Code is still at 73% adoption across all developers surveyed. But when you filter for developers under 35, the picture gets complicated. Cursor and other AI-native forks had reached 13% primary use in that demographic. That’s not a rounding error. That’s a cohort vote.

The thing that won’t get headlines but should get your attention: the adoption isn’t one-for-one replacing VS Code. Lots of engineers are running dual setups or context-switching by task. Cursor for new feature development. VS Code for debugging. Cursor Editor Official Site for exploratory work, JetBrains for serious refactoring. This suggests the IDE isn’t becoming commoditized—it’s fragmenting by workflow.

Career-wise, that matters. If you’re hiring senior engineers and you assume everyone uses the same tool, you’re already behind. The next generation isn’t unified around VS Code. They’re unified around “what gets the job done fastest for this specific task.” That’s actually more sophisticated than it sounds.

The Acquisition Game Changes Everything (And Nothing)

OpenAI’s acquisition of Windsurf is the move I keep coming back to because it’s structurally different from previous consolidation in dev tools. They didn’t buy a feature. They bought direct access to the distribution layer. They own the model. They own the IDE. They own the feedback loop. That’s a closed ecosystem in ways that Cursor can’t be, because Cursor still lives in a world where the underlying model comes from someone else.

Does this mean Windsurf is now automatically better? No. Organizational integration takes time, and there are real questions about whether OpenAI’s product instincts translate to developer tools. But the structural advantage is real. They can iterate on model-IDE co-design without negotiating with another vendor. That’s a multiplier.

What this should tell you as a career engineer: the tools you choose are increasingly bound up with vendor strategy and distribution control. Pick tools that have aligned incentives with your actual workflow, not just tools that feel good in the moment. This isn’t tribalism. This is pattern recognition from someone who watched Sublime Text eat the world and then watched JavaScript frameworks do it again.

What You Actually Need to Know for 2025 and Beyond

If you’re trying to decide between these tools or figure out where to invest your learning time, here’s my honest take: context window is now the primary performance lever. The tool that can hold the most of your actual codebase in working memory will feel the fastest and produce the fewest hallucinations. Test it with a medium-complexity refactoring task across 5-10 files before committing.

Second, watch the acquisition landscape like it matters, because it does. OpenAI now has direct IDE distribution. That changes the incentive structure for how models get trained and tuned. If you’re betting on a tool long-term, know who owns it and what their distribution strategy is. Tools without sustainable unit economics or clear paths to profitability historically don’t age well.

Third, and this is the mentorship bit: don’t get caught in the tribal wars. Use what works for your team’s actual ship schedule, not what gets the most Twitter engagement. I’ve seen enough tool rotations to know that the best IDE is the one that disappears into your workflow. Right now, that’s still different for different people.

The IDE wars of 2025 aren’t over. The consolidation will be brutal and the feature velocity will be ridiculous. Your job is to stay calibrated to what actually moves the needle on your work, not what venture capitalists and model providers are positioning as the future. Stay curious about the capabilities. Stay skeptical about the claims. And absolutely test before you trust.

Platform Engineering Is Eating DevOps — And Your Org Isn’t Ready for the Reorganization That Comes With It

The Shift Nobody Planned For

Five years ago, if you told a seasoned DevOps engineer that their entire function would be reconceptualized into something called “platform engineering,” they would have nodded politely and continued optimizing Kubernetes manifests. Today, that same engineer is either retraining or quietly updating their LinkedIn. The transition from DevOps to platform engineering isn’t a terminology refresh or a rebranding exercise. It’s a fundamental inversion of how we think about infrastructure, tooling, and organizational structure.

The numbers paint a clear picture of velocity. Gartner’s 2025 analysis suggests that roughly 80% of large software engineering organizations will have established dedicated platform engineering teams by 2026, compared to just 45% in 2023. That’s not gradual adoption. That’s an inflection point. What makes this interesting isn’t the forecasting itself, but the organizational chaos hiding beneath those statistics. Most teams pursuing this shift are discovering that the hard problem isn’t the technology. It’s the people and the permission structures.

I’ve watched enough infrastructure transformations to know that when adoption curves spike this sharply, it’s usually because a new model solves a genuine problem that people have been articulating badly for years. In this case, the problem is this: traditional DevOps treated infrastructure and tooling as a supporting function that reacted to development demands. Platform engineering flips that. It treats the internal developer experience as a first-class product, with dedicated teams owning the platforms that other engineers consume.

What Platform Engineering Actually Means in Practice

Platform engineering teams own the full stack of developer experience: they design internal developer platforms (IDPs), maintain golden paths, manage deployment infrastructure, handle observability, and they do this with a product mentality. They have roadmaps. They conduct user research with their internal customers. They measure adoption metrics. They iterate based on feedback. This is conceptually tidy and organizationally devastating in ways that most leadership still doesn’t appreciate.

The DORA 2025 State of DevOps Report quantifies what this product-centric approach actually yields: teams operating with mature internal developer platforms report 2.4x higher deployment frequency and 60% lower change failure rates compared to organizations without centralized platform tooling. Those aren’t incremental improvements. A 2.4x deployment frequency means you’re shipping roughly every other day instead of every few days. A 60% reduction in change failures is the kind of metric that actually gets CFO attention because it correlates directly to revenue stability.

But here’s where the organizational friction begins: hitting those metrics requires platform teams to have genuine authority and investment. They need to make decisions about which tools get adopted, which paths get deprecated, and how development teams are guided toward best practices. They need budget that isn’t constantly raided for fire-fighting. They need to be able to say no to requests that don’t fit the platform strategy. Most organizations have never given infrastructure teams that kind of autonomy, and most developers have never had to consume a carefully designed platform instead of building their own artisanal snowflake.

The Standardization Problem That Nobody Wants to Admit

Platform engineering requires standardization. Not the soul-crushing, lowest-common-denominator kind, but thoughtful, opinionated standardization that trades some flexibility for speed and reliability. Internal developer portals like CNCF Backstage project and adoption data have become the de facto standard for surfacing this standardization in a user-friendly way. Backstage now powers over 3,200 organizations, and that adoption curve is still steep. It works because it solves a real problem: giving developers a single pane of glass for discovering services, understanding dependencies, checking deployment status, and accessing documentation without needing to know thirty different tools.

But standardization is where the political economy of organizations becomes visible. Development teams that have spent years building bespoke deployment pipelines, custom monitoring dashboards, and homegrown deployment tools suddenly need to adopt a platform-provided way of doing things. Teams that have thrived on autonomy and the freedom to choose their own tech stack now have to work within guardrails. The platform team, meanwhile, becomes the gatekeeper for that freedom. This creates friction that tooling alone cannot fix.

The 2025 job market reflects this shift. Platform engineer has become one of the five fastest-growing job titles in software, and the compensation data tells you how hard these roles are to fill: median salaries in North America hit $178,000, roughly 14% higher than traditional DevOps engineer roles. Companies are competing for platform engineers because they understand, at some level, that this role has become strategically important. What they’re often underestimating is how difficult it is to actually perform that role within most organizational structures.

Why Most Transformations Are Actually Failing

Here’s the part that separates the hype from the reality: according to Puppet’s 2025 State of DevOps Report, 67% of organizations attempting platform engineering transformations cite internal team resistance and unclear ownership boundaries as their primary failure mode. Not tooling. Not technical debt. Not cloud costs or security compliance. People and organizational design.

This deserves to be said plainly: you can have the most elegant platform, the slickest developer portal, the most sophisticated observability stack, and it will still fail if the organizational structure around it is ambiguous. When development teams don’t understand which decisions are theirs and which belong to the platform team, when platform team members have unclear reporting lines or divided loyalties, when success metrics aren’t defined or mean different things to different stakeholders, the entire system becomes friction. I’ve seen this movie twice now, and it ends with a half-abandoned platform and a demoralized team.

The organizations getting this right are making explicit choices about ownership, investment, and decision-making authority. They’re defining what “platform” actually means in their context. They’re being clear about which teams own which parts of the developer experience. They’re giving platform teams the authority to enforce standards and the resources to evolve those standards over time. They’re measuring platform adoption and quality as product metrics, not infrastructure metrics. This requires leadership alignment that most organizations simply haven’t achieved yet.

The Organizational Redesign That’s Actually Required

If you’re seriously considering a platform engineering transformation, think of it as a reorganization, not a tool upgrade. This means explicitly removing decision-making authority from some teams and granting it to others. It means redefining what “done” looks like for development teams — they’re done when their code deploys to the platform, not when they’ve configured their own deployment infrastructure. It means accepting that some of the flexibility and customization that individual teams have grown attached to will need to go away in service of platform coherence.

It also means staffing the platform team as if it’s a revenue-generating product team, because in many ways it is. The faster and more reliably other teams can ship, the faster your organization ships. The more confidence development teams have in the deployment process, the more they iterate. These aren’t nice-to-haves. They’re business drivers that should factor into budget allocation.

The transition from DevOps to platform engineering is a genuine paradigm shift in how mature organizations structure their technical operations. The numbers suggest this shift is coming, and coming fast. The tools are ready. The organizations, mostly, are not. If you’re thinking about making this move, start with organization structure and decision-making authority. The technology will follow.

Deno 2.0’s First Year in Production: Where It Delivered and Where Node.js Still Wins

The Philosophical U-Turn That Changed Everything

There’s a moment in every technology’s lifecycle when its creator has to confront a hard truth. For Deno, that moment arrived around the time Ryan Dahl realized that ideological purity, while intellectually satisfying, doesn’t pay the bills. The Deno 2.0 launch announcement in October 2024 represented something almost unthinkable: a complete reversal of the original design philosophy. The runtime that had rejected Node.js compatibility as a matter of principle suddenly embraced full npm compatibility and built-in support for the entire Node.js ecosystem.

This wasn’t a bug fix or a minor feature addition. This was Dahl essentially saying, “We were right about the problems, but wrong about the solution.” And here’s the thing that separates seasoned engineers from the perpetually outraged: that kind of pragmatic pivot is actually a sign of maturity, not failure. The team recognized that adoption in the real world matters more than winning philosophical arguments on Hacker News.

The immediate effect was significant for teams sitting on the fence. Suddenly, you could take existing Node.js code, point Deno at it, and it would work. No rewriting your entire stack. No choosing between Deno’s benefits and your production requirements. The calculation changed overnight from “Deno or Node” to “Deno and Node, with Deno handling the parts where it actually excels.”

Edge Performance: Where Deno’s Architecture Finally Matters

Here’s where the technical debt from Deno’s early decisions actually paid dividends. The runtime was built from the ground up with edge deployment in mind. That architectural decision, combined with V8 snapshot technology that pre-warms execution contexts, produces startup times that matter at scale. In synthetic benchmarks running realistic cold-boot scenarios, Deno shows consistent 20 to 40 percent improvements in latency compared to Node.js equivalents.

For context: Platformatic’s 2025 Node.js ecosystem survey found that startup and cold-boot latency was the top performance concern among teams deploying to edge environments. This wasn’t a theoretical problem or a micro-optimization obsession. This was the loudest complaint from production teams running serverless workloads. Deno Deploy, the team’s edge runtime platform, reported handling over 300 billion requests monthly by late 2025, putting it in direct competition with Cloudflare Workers. That volume isn’t a vanity metric. That’s proof that something is working.

The architecture advantage shows most clearly in environments where you’re spinning up thousands of isolates per second. The gap between a 2-millisecond cold start and a 5-millisecond cold start looks academic until you’re billing for it or watching your p99 latency spike. Deno’s snapshot approach changes the economics of edge computing enough that it becomes a genuine factor in platform selection decisions.

The Package Ecosystem Question: Growing, But Still Uneven

One of Deno’s longest-standing vulnerabilities was the package ecosystem. Node’s npm had a decade-plus head start and millions of packages. Deno had… fewer. The team built JSR package registry as their answer to this problem, with a twist: it enforces TypeScript-first publishing and generates documentation automatically. No more scanning through hastily written readme files or guessing what a function expects.

The growth numbers are hard to ignore. From roughly 2,000 packages at launch in 2024, JSR surpassed 8,000 published packages by early 2026. That’s the kind of acceleration that suggests genuine adoption, not just enthusiast tinkering. For common patterns like HTTP frameworks, database clients, and CLI utilities, you can now find well-maintained options in JSR without compromising on quality or features.

But here’s the uncomfortable truth: for specialized or niche packages, npm still wins by default. You need an obscure integration with a SaaS platform from 2015 that’s barely maintained? npm probably has three competing packages for it. JSR might have zero. This isn’t a dealbreaker for most applications, especially now that Deno can consume npm packages directly. It just means the ecosystem advantage isn’t yet decisive.

TypeScript: The Turning Point That Wasn’t

One of Deno’s most compelling advantages heading into 2024 was native TypeScript support. You wrote in TypeScript. It ran. No build step. No mysterious configuration file with 47 options you didn’t understand. Node.js developers spent years managing ts-node, tsx, or complex webpack configurations to achieve something Deno made automatic.

Node.js listened. In 2025, Node.js 23 and 24 shipped with native TypeScript type-stripping, closing a gap that had been cited repeatedly as a primary reason teams were evaluating Deno. It’s not quite identical to Deno’s approach, but it eliminates the most painful part of the TypeScript story for Node developers. The advantage didn’t disappear, but it contracted enough that the “TypeScript native” selling point lost some of its persuasive power.

This is worth examining because it’s instructive about how technology leadership actually works. Deno didn’t have to ship a perfect feature. It just had to be different and better enough that competing runtimes felt pressure to respond. And they did. That competitive pressure benefited the entire ecosystem, including Node developers who never intended to use Deno.

Where the Tradeoffs Become Clear

After twelve months of production deployments and real-world engineering, the picture has become genuinely complicated. Deno excels in specific circumstances: edge computing, fresh serverless deployments, greenfield projects where you’re not inheriting twelve years of npm decisions. Node.js remains the default choice for established applications, mature frameworks with extensive third-party integrations, and teams that have already made substantial investments in the ecosystem.

The honest assessment is that Deno’s first year in production proved something important: it’s viable. It’s not a side project anymore. It’s not a sandbox where idealists explore how things could be different. It’s a runtime that can handle serious workloads, particularly at the edge. Whether it becomes the dominant platform depends on factors outside technology: community momentum, corporate backing, and whether the marginal benefits actually move the needle for most teams most of the time.

If you’re making infrastructure decisions today, neither runtime is obviously wrong. The question is which tradeoffs align with your constraints. I’d be genuinely interested to hear about your own experience with either platform in production. What actually mattered? What turned out to be irrelevant? The patterns in those answers are more valuable than any benchmark chart.

GitHub Copilot Agent Mode in 2025: The Productivity Paradox That’s Rewriting Code Review

The Speed Trap We All Saw Coming

Let me cut to the chase because we both know why you’re here. GitHub Copilot Agent Mode hit the market sometime around mid-2025, and by the time Q3 earnings rolled around, Microsoft was announcing that the platform had crossed 1.8 million paid subscribers. That number should make you sit up straight. Not because it’s objectively huge (it is), but because it represents something we’ve been circling around for three years now: we’ve collectively decided that velocity matters more than we initially admitted.

GitHub Copilot Agent Mode in 2025: The Productivity Paradox That's Rewriting Code Review
GitHub Copilot Agent Mode in 2025: The Productivity Paradox That’s Rewriting Code Review

Here’s where it gets interesting. GitHub’s own telemetry showed that teams using Copilot Agent Mode were merging pull requests approximately 55% faster than their peers. That’s not a marginal improvement. That’s not “oh, nice, we saved a few minutes.” That’s a fundamental reshaping of how fast code gets into production. Fifty-five percent faster. Say that out loud and think about what your sprint velocity would look like if you could hit that delta on day one.

The problem, and I want to be direct here, is that speed has always been the seductive metric. It impresses executives, pleases customers, and makes you feel like you’re finally executing at the level you’ve always believed you could. When agent mode started delivering that at scale, adoption became nearly inevitable. The market chose velocity. We’re still living with that choice.

Illustration for GitHub Copilot Agent Mode in 2025: The Productivity Paradox That's Rewriting Code Review
Illustration for GitHub Copilot Agent Mode in 2025: The Productivity Paradox That’s Rewriting Code Review

The Security Reckoning Nobody Wanted to See

Now let me tell you about the part that keeps me up at night, though honestly, not in the way you might think. Snyk’s security analysis of repositories that adopted agentic coding tools in 2025 documented a 40% increase in AI-generated vulnerable code patterns. That’s material. That’s the kind of number that gets flagged in risk reviews and makes CISO offices nervous. But what actually bothers me: we’re not even sure if that’s the floor, or if we’re still in the discovery phase of how bad this could get.

Google’s Project Zero team dropped a genuinely unsettling report in November 2025 that identified 14 novel vulnerability classes attributed specifically to agentic AI coding patterns. Fourteen. Not “variations on existing CVEs” or “well-understood risks in new packaging.” These are vulnerability archetypes that didn’t have names before 2025 because the attack surface didn’t exist. Agent mode doesn’t just generate code faster. It generates new categories of exploitable code. That distinction matters enormously.

The vulnerability pattern I see most often is what I call the “confidence hollow.” Agent mode produces syntactically correct code that passes unit tests and static analysis, but it misses the distributed systems failure mode because it was trained on patterns from monolithic architectures. It generates authentication checks that look secure but have race conditions in concurrent scenarios. It writes race-condition-free code in single-threaded contexts, then gets deployed at scale where it becomes a dagger pointed at your infrastructure. The agent saw the pattern, executed it flawlessly, and nobody caught the category error until it mattered.

The Review Ecosystem Is Fracturing

Code review in 2025 is becoming a two-tier system, and we need to talk about what that means. Stack Overflow’s 2025 Developer Survey found that 82% of professional developers were actively using AI coding tools, up from 62% just the year before. That’s not adoption anymore. That’s market saturation. But here’s the part that reveals the real problem: 44% of those developers said they trusted the output only “sometimes” or “rarely.”

Sit with that number for a second. Nearly half the people using these tools don’t trust them. They’re not using them because they believe in the output. They’re using them because they have to keep pace with teams that are. That’s not technology adoption. That’s competitive duress masquerading as innovation. And it’s rewriting what code review actually looks like in practice.

Senior engineers at companies shipping with agent mode are now spending review cycles trying to validate whether the agent understood the problem correctly, whether it caught the edge cases, whether it made implicit architectural assumptions that don’t hold in your specific deployment model. That’s not code review. That’s code archaeology. You’re not reviewing for style or best practices anymore. You’re reverse-engineering the reasoning of a system that doesn’t leave breadcrumbs. The cognitive load has shifted, and most organizations haven’t equipped their review processes to handle it.

The Regulatory Response Is Real and It’s Too Late

NIST updated the Secure Software Development Framework in late 2025 to explicitly address AI-assisted code generation risks. Let me translate what that means. NIST doesn’t typically move fast. NIST is the organization that shows up to the party after it’s already a week old, documents what happened, and publishes a 200-page framework about preventing it next time. When NIST moves, it’s because something has already broken badly enough that the federal government noticed.

That update isn’t a vote of confidence in agentic tooling. It’s an acknowledgment that we shipped something into production that we don’t fully understand, and now we need guardrails because the industry won’t self-regulate. You can read the specifics in the NIST Secure Software Development Framework, but the subtext is clear: organizations using AI code generation are now operating in a compliance gray zone, and the government is setting boundaries retroactively.

Here’s what that looks like in practice. If you’re shipping code using agent mode into any regulated vertical (healthcare, finance, defense, critical infrastructure), you’re now supposed to maintain additional audit trails specifically documenting the AI’s role in code generation. You need to demonstrate that humans reviewed it according to these new standards. And if something goes wrong and it traces back to an agent-generated pattern, you’re not just liable for the bug. You’re liable for potentially negligent deployment of an insufficiently validated tool. The liability model just changed, and most organizations haven’t noticed yet.

Where We Actually Stand and What You Should Be Thinking About

Here’s my honest assessment after watching this unfold for the better part of 2025: GitHub Copilot Agent Mode is genuinely useful, and it’s also genuinely dangerous, and both of those things are true at the same time. The productivity gains are real. I’ve seen teams use it effectively, and when it works, it’s almost like having a junior engineer who never needs sleep, always knows where to find the documentation, and has read every Stack Overflow answer ever written. That’s valuable. Undeniably valuable.

But the security implications are also real, and we’re still in the phase where we’re discovering new categories of failure rather than mastering existing ones. The vulnerability classes that Google Project Zero documented are essentially the first wave. We haven’t seen the sophisticated exploitation patterns yet. We haven’t seen what happens when adversaries start training their own models to generate code that looks secure but has deliberately hidden weaknesses. That’s coming, and it’s going to make 2025 look quaint.

If you’re using agent mode right now, the responsible move is to treat it as a tool that enhances velocity in non-critical paths while maintaining human-first review for anything touching authentication, authorization, data integrity, or cross-boundary communication. That’s not sexy. It won’t max out your sprint velocity. But it won’t get you featured in a postmortem titled “How We Shipped a Vulnerability Class That Didn’t Have a Name.”

The real question for 2025 and beyond isn’t whether agent mode is good or bad. It’s whether we can build review practices and organizational cultures that maintain skepticism while capturing the productivity benefits. That’s harder than choosing a side. It requires discipline. But it’s the only move that doesn’t end with you explaining to your board why a pattern that looked secure wasn’t. Read through the GitHub Copilot Agent Mode documentation with your team and ask hard questions about where you’re deploying it. Your future self will appreciate the rigor.

I’m curious what you’re seeing in your own systems. Have you deployed agent mode? What’s your review process actually catching that you didn’t expect to have to catch? Drop it in the comments or reach out directly. The collective intelligence on this is still being written.