Select members of the local media were recently invited to the Amazon Web Services (AWS) Philippines office in BGC for an exclusive hands-on workshop centered around Kiro and the AWS Security Agent. The session was structured around “Build with Kiro and Secure with Security Agent” — a Level 200 (Intermediate) course hosted under the AWS Workshop Studio. Designed specifically to be accessible for people new to the cloud, the workshop promised to walk us through building an application, rapidly creating interactive content using vibe mode, and architecting a content publishing platform using Spec mode.

Coming from a developer background where my work historically focused on browser-level coding — though nowadays my technical routine is mostly limited to troubleshooting websites — I was curious to see how much the modern development lifecycle had truly evolved. Guided on-site by the expert AWS team led by Joel Garcia, Head of Technology for Singapore Enterprise at AWS, alongside Solutions Architects Joben Genesis Rara, Zenon Saavedra, and Kate Viloria, we jumped right into the environment

We began the first exercise using Kiro’s “Vibe Mode,” an intuitive interface designed for rapid iteration. To put it to the test, I decided to build a browser version of the classic Snake game, the iconic mobile title that dominated older Nokia phones of yesteryears. Through pure vibe coding, I prompted the IDE, evaluated its logic, and watched the application assemble itself in real time without writing the underlying boilerplate from scratch. Seeing how effortlessly the game came together, I even joked to Joel: where were these kinds of tools back when we were still in school taking up Computer Science?

For the second part of the workshop, we shifted gears from casual iteration to structured engineering by creating an application in “Spec Mode”. This approach addresses a fundamental challenge in generative AI development: natural language prompts are inherently ambiguous, and passing them directly to an AI agent often creates a chaotic web of decisions and unpredictable outputs. In Spec Mode, Kiro eliminates this ambiguity by automatically generating three core specification files prior to writing code: a requirements document (requirements.md), a system design document (design.md), and a task list (tasks.md). By allowing developers to iterate on these specifications first, Kiro shifts human judgment from manual coding to strategic architecture and governance. The tool also incorporates native Model Context Protocol (MCP) integration for external tools, project-specific steering files, and a timeline checkpointing mechanism to safely roll back code states.

The final segment of the workshop focused on Security Testing, tackling the growing tension where development velocity outpaces security verification. Industry metrics presented during the session revealed that while 60% of organizations update web applications weekly, 75% test application security monthly or less frequently, with traditional manual penetration testing costing between $5,000 to $50,000 per application and taking 3 to 6 weeks. Furthermore, modern AI agents have made it easier to chain minor vulnerabilities into multi-step exploits.

To demonstrate how to secure applications built at machine speed, we tested the AWS Security Agent — a tool within the AWS Continuum platform designed to automate proactive security across the software development lifecycle. Unlike traditional human penetration testing that typically targets only public endpoints late in development on an annual basis, the AWS Security Agent provides continuous, automated coverage across AWS, hybrid, multi-cloud, and SaaS endpoints. During our hands-on security exercises on a sample vulnerable web application, the agent executed threat model reviews in minutes, performed near real-time source code scans, and ran automated penetration testing to discover and chain multi-step attack scenarios in hours.

Stepping out of the AWS BGC office, the ultimate takeaway from the experience was crystal clear: software engineers aren’t going to lose their jobs to AI anytime soon, but the nature of the work is fundamentally shifting. Rather than replacing human talent, tools like Kiro and the AWS Security Agent redefine the developer’s role from manual, line-by-line code execution to high-level system governance.

While AI can scaffold application architecture or hunt down vulnerabilities at record speeds, it still lacks the critical business context, ethical reasoning, and nuanced strategy that only a person can provide. Having a human in the loop remains absolutely essential. At the end of the day, these autonomous systems are only as smart as the direction we give them; developers are still firmly in the driver’s seat, steering intelligent agents to build rapidly, make sound judgment calls, and secure applications continuously.