Codex at Cisco: 95%+ of New AI Features Written

Cisco’s Codex rollout changed the pace of product work

Cisco says Codex wrote 95%+ of its new AI features. It also saved 1,500+ engineering hours per month, cut build times by about 20%, and increased defect-resolution throughput by 10-15x.

That is not a small productivity bump. It is a shift in how a large engineering org moves from idea to shipped code. Cisco’s own example matters because it is not a toy demo or a narrow pilot. The company says Codex now shapes the work of global teams, including AI Defense, where critical engineering work moved from several quarters to weeks.

The headline is obvious. AI coding tools can now produce real output at enterprise scale. The harder question is what that means for security, review, and control when the tool is not just drafting helpers, but writing most of the new product surface.

---

What Cisco says Codex actually did

The Cisco account gives a rare look at where an AI coding assistant moved from support role to production driver. Cisco says Codex wrote the majority of AI Defense and nearly every new feature the company is building. It also analyzed build logs and dependency graphs across more than 15 interconnected repositories, finding inefficiencies that were hard to catch by hand.

That matters because most enterprise code is not isolated. It lives across services, build systems, shared libraries, and release pipelines. When one tool can inspect that much surface area, it can also compress a lot of overhead. Cisco says Codex helped reduce build times by about 20% and turned work that once took weeks into hours.

This is the practical story behind the numbers. The benefit is not only that Codex writes code. It also helps teams see patterns across repos, cut down wait time, and route engineers toward design and validation instead of repetitive changes.

For a broader view of the risk side of this shift, see AI Coding Tools and AppSec Risk: What to Audit Now.

---

Why 95%+ matters for software teams

A tool that writes 95%+ of new AI features changes the ratio of human work to machine work. The old model was simple. Engineers wrote most of the code, and tools helped with search, tests, or snippets. The new model pushes humans toward review, orchestration, and final judgment.

That can be a good thing. It can also hide weak spots.

If the team trusts the model to generate most of the implementation, then review has to move upstream. The team needs to ask different questions:

• Did the tool follow the intended security pattern?
• Did it preserve auth boundaries?
• Did it introduce new dependencies or risky build paths?
• Did it change behavior in one repo that breaks another?

Cisco’s own example shows why this is not abstract. Codex analyzed build logs and dependency graphs across more than 15 interconnected repositories. In a system like that, a change that looks fine in one repo can still create a release issue elsewhere. The savings are real, but so is the need for stronger review.

That throughput jump is attractive. It means bugs can be closed faster, and teams can spend more time on design and validation. But speed does not remove risk. It just moves the bottleneck. If AI writes the code faster than humans can review it, the limiting factor becomes inspection quality, not coding speed.

---

How Cisco used Codex across repositories

The most useful part of Cisco’s report is not only feature generation. It is cross-repo coordination. Codex analyzed build logs and dependency graphs across more than 15 interconnected repositories, then identified inefficiencies that would have been hard to spot by hand.

That kind of work matters for enterprise software because build problems often come from interactions, not one file or one service. A package pin in one repo can slow a pipeline in another. A shared dependency can create inconsistent behavior. A release change can look safe locally and still fail in integration.

Cisco says that same approach helped compress engineering work for AI Defense from several quarters to weeks. That is a major operational change. It suggests Codex was not just filling in code blocks. It was helping the team reduce cycle time across the planning, implementation, and build stages.

If you are trying to understand what this looks like in practice, compare it with Codex at Ramp: Faster Code Review With GPT-5.5. The pattern is similar: enterprise teams are not using AI only to write code. They are using it to compress review and delivery.

The security lesson is direct. When AI handles more of the repo-to-repo reasoning, humans need better checks on dependency drift, privilege changes, and build pipeline outputs. A single repo review is not enough when the system is already acting across many repos.

---

What the build-time and throughput gains mean

Cisco reports three operational gains that all point in the same direction: faster delivery.

First, build times fell by about 20%. Second, engineering hours saved hit 1,500+ per month. Third, defect-resolution throughput rose by 10-15x.

Those numbers are not the same thing, and that is important. Build time reduction helps shipping. Hour savings help capacity planning. Throughput improvement helps support and quality work. Taken together, they show a tool that affects the whole development loop, not just the IDE.

That also means the return on investment is not limited to one team. If the same system speeds up implementation, triage, and build optimization, it can reshape how a large engineering organization allocates time. More time goes to design, validation, and strategic work. Less time goes to repetitive repair.

Still, faster defect resolution can create a false sense of safety if the upstream code generation process is not tightly controlled. Closing bugs faster is good. Preventing them from landing in the first place is better.

That is where a formal review process becomes essential. If you want a clear way to test whether your team can trust AI-generated changes at production scale, the next step is usually an AI Code Security Audit. It is most useful once you already know the tool is in the workflow and need a way to measure the risk it introduces.

---

Security questions teams should ask before scaling AI coding

Cisco’s numbers are strong enough to make any engineering leader ask the obvious follow-up: what needs to change before this goes wider?

Start with the control points that matter most:

• Require human approval for auth, crypto, and permission changes.
• Track which repos and services the model can read and modify.
• Review dependency changes separately from feature logic.
• Add build and release checks for cross-repo side effects.
• Measure defect escape rate, not just coding speed.

The point is not to slow AI down. It is to keep the org from mistaking output volume for code quality. Cisco’s experience shows how much work can move when Codex writes 95%+ of new AI features. That same scale means one bad pattern can also spread faster if nobody is watching.

Teams should also treat build systems as first-class attack surfaces. Cisco used Codex to analyze build logs and dependency graphs across more than 15 interconnected repositories. If your organization has fewer repos, the same risk still applies. Fewer repos does not mean fewer integration bugs. It only means fewer places to look.

The right takeaway is not “use AI less.” It is “inspect AI output more carefully where it can do the most damage.” That means privileges, dependencies, build pipelines, and release gates.

---

What engineering leaders should do next

Cisco’s results show what happens when AI moves from side task to core engineering work. The company says Codex wrote 95%+ of new AI features, saved 1,500+ engineering hours per month, and improved defect resolution by 10-15x. That is a serious operational shift.

For leaders, the action items are clear:

Define where AI can write code without extra approval.

Block AI-generated changes from bypassing review in sensitive paths.

Audit repos for shared dependencies and build coupling.

Measure whether faster output is also creating more rework.

Revisit your review process before you expand usage again.

If your team already uses AI coding tools, this is the right moment to test the control layer. The productivity gains are real. Cisco’s report proves that. But the more code a system writes, the more your security process has to keep up.

Start with the repos that matter most. Then check the build pipeline. Then check who can approve the final merge.