Anthropic sécurise un SDLC où l'IA écrit 80 % du code : le cycle redevient le socle
SFEIR decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) after-action report published five days earlier — already logged in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value is not in the facts, it is in the thesis that rereads them**: if Anthropic's controls hold, it is because there exists **a cycle with named stages to hang them on** — "the SDLC is the foundation, not the formality." Demonstration through a rereading of the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**) followed by a **four-part anaphora**: (1) *without an SDLC, productivity gains do not arrive* — Clinton cites **Amdahl**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic did not gain by distributing agents but by **identifying the stage that was blocking (Test) and rebuilding it** — "you do not optimize a bottleneck you have not mapped" (a callback to the **mirror effect** from DORA 2025); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **FinOps token** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes are paid for and where a SAST suffices), otherwise "token spend is not steered, it is observed at month-end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented on, one third of past incidents intercepted) exist only because there are stages where a counter can be placed, absent which one produces only **usage figures** (licenses, tokens) silent on quality and risk. Two strong points outside the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)