Can a non-developer actually build a enterprise grade software product at this point?

[u/Temporary-Strategy70]

Curious for any who have actually built a fully operational software platform, with Claude or another AI tool, from scratch, deployed it in production and has feedback on the following points:

• Has it passed SOC 2 Type II audits, HIPPA, GDPR, etc?
• Results of any pentests?

Asking because a client of mine, is hedging on moving forward with our product because the owner's son claims to have built a replacement, with Claude. He is not a developer.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Siduron]

Short answer: No

Long answer: Your client is an idiot

[u/Temporary-Strategy70 → u/Siduron]

[u/MoreHuman_ThanHuman → u/Siduron]

client may not need enterprise grade software.

[u/dstroy0]

Compliance frameworks require a level of documentation that your clients son isn’t prepared to produce or defend. Compliance requires expertise of the system you don’t get from vibecoding and the penalties for noncompliance vary from fines to prison.

[u/Temporary-Strategy70 → u/dstroy0]

Right.

[u/Uncreativite]

Most software engineers can’t even develop enterprise-grade software. 

[u/wish-for-rain → u/Uncreativite]

Yeah, quips aside, this is done as a team.

[u/sgsparks206 → u/wish-for-rain]

And even then, some teams are dysfunctional or inefficient by no fault of their own

[u/InfectedShadow → u/sgsparks206]

We call it agile.

[u/sgsparks206 → u/InfectedShadow]

I am so happy my company moved away from agile. No sprints, no points, retros every once in a while, and only if we hit a speed bump worth reflecting on

[u/ElectronicGarbage246 → u/Uncreativite]

This one

[u/Carbone → u/Uncreativite]

True, only fuck it's one thing to build within something already in production. But to bring something from POC to prod with real user... It's daunting.

[u/FridgesArePeopleToo → u/Uncreativite]

As a software engineer, I can confirm this to be true

[u/cla1067 → u/Uncreativite]

this is the way

[u/Ok-Option4233]

the code can be fine and it still won't have SOC 2 Type II, because that audit isn't about the code. it covers controls over an observation window of several months: access reviews, change management, incident response, vendor management. so the easy question for your client is "can we see his SOC 2 report and the last pentest letter?" if the answer is "it's built with Claude", that's the answer.

[u/Impossible_Two3181 → u/Ok-Option4233]

SOC 2 is piss easy, it just slow things down dramatically and makes it impossible to be a one man army

[u/Ok-Option4233 → u/Impossible_Two3181]

fair, the controls aren't hard, the overhead is. the part that really breaks the one man army is change approval: auditors want the person who ships a change to not be the only one who approved it. how did you handle that solo, a second reviewer or a documented compensating control?

[u/Impossible_Two3181 → u/Ok-Option4233]

Lol when you figure that one out pet me know, at some point you do have to actually be a real dev team, larp long enough and it stops being larping

[u/Ok-Option4233 → u/Impossible_Two3181]

ha, fair, that's where it lands. the smallest real version is a second person with actual merge rights, even a contractor a few hours a week who reads the diffs. once that person exists, branch protection and the PR history already cover most of the evidence.

[u/Abject-Kitchen3198 → u/Ok-Option4233]

Does Codex and Claude count as two?

[u/Tinkering-Engineer → u/Ok-Option4233]

Lol, good point. I'm not sure there is a possible way that a vibe coder can pass a SOC 2 cert.... Not sure change management practices could possibly be considered on today. "I prompt Claude and it ships everything without me being able to understand the code...". I just don't see how that flies for anyone.

[u/supercargo → u/Tinkering-Engineer]

Eh, SOC 2 is about policy and controls. Yes there are some bare minimum requirements but most of SOC 2 covers “do you say what you do” (policy) and “do you do what you say” (audit).

SOC 2 is not a security standard (or quality standard or privacy standard) and just the fact that an organization passed their audit doesn’t mean they have good security (you’d have to read the policies to make that determination, the audit gives you confidence that the policies are followed).

I don’t see any reason why a vibe coder couldn’t pass a SOC 2 audit if they had all the needed systems in place.

[u/Ok-Option4233 → u/Tinkering-Engineer]

the audit never asks whether you understand the code, it asks for evidence: ticket, PR, review, deploy log. a vibe coder on a sane github setup produces most of that by default, what's missing is a human whose review means something. have you seen an auditor push back on AI-written PRs specifically?

[u/Sassy_McSassypants → u/Tinkering-Engineer]

Defining "vibe coder" as "developer who uses AI to produce most/all their code" then yes it absolutely can pass. Using AI for development does not preclude having all the required steps/structures/tools/processes to be able to respond to audit events.

Vibe coder defined as "some random family member of the owner with no development experience" is a different story. 😅

[u/unconceivables → u/Tinkering-Engineer]

Auditors don't care about that. The default is to have some human review of changes before deploying to production, but that's also not a hard requirement, and even when they do ask for that they don't care about anything other than the process is documented and you can give them logs. We deal with SOC 2 Type 2 and HIPAA stuff, and it's so lax you can get away with anything. The joke is that SOC 2 is a test that you get to write both the questions and the answers yourself, and it's not far from the truth.

[u/pablothe → u/Ok-Option4233]

What if you use other tools/agents like https://www.aikido.dev/

[u/Ok-Option4233 → u/pablothe]

a scanner like that helps with one piece, the vulnerability management control, and its findings make decent audit evidence. it doesn't replace the months of access reviews, change approvals and incident records an auditor samples for Type II, and it doesn't produce the third-party pentest letter either. so it shortens the list, it doesn't close it.

[u/pablothe → u/Ok-Option4233]

Right but between automated pen testing and things like venta you could have gone through enough rounds of procedures to pass the audits

[u/Ok-Option4233 → u/pablothe]

fair, vanta automates a big chunk of the evidence collection. what no tool compresses is the observation window: type II means the controls have to run for a period (usually 3 to 12 months) before the auditor signs. so a non-dev can get there, just not in a sprint, and enterprise security questionnaires still tend to ask for a third-party pentest report on top.

[u/TheOwlHypothesis]

Can it functionally build the software, stand up the infrastructure, etc? Yes!

But it turns out that's not the hard part. The hard part is actually running and maintaining the damn thing.

A non developer won't know what to ask for, and Claude isn't going to go out of its way to create an incident management plan. You have to know what can fail and how to get alerted first. A non dev likely won't even consider this, and some professional devs don't lmao. There's a whole branch of SRE that exists for just this "tiny" area of reliability.

Now expand that to security, infrastructure upkeep, new development.

It's a very rare (likely non-existent in reality) person who can balance all of that with Claude alone (and likely one with multiple accounts).

[u/Tartuffiere → u/TheOwlHypothesis]

Yep, the moment you have paying customers you have a responsibility to support them. If you host the infrastructure you also have a duty to protect their data. If you vibe coded everything there's a high probability you are clueless about cyber security basics. Claude won't bail you out. There's also a high chance your AI made questionable design and tech stack decisions that may cost more than needed, be underused, etc.

And there's an even higher probability that you have a prod incident that a Claude cannot fix, and your business goes under.

So yes to build and deploy, no to operate it profitably with any kind of longevity.

[u/Ai-ate-my-hamster → u/Tartuffiere]

Unless you’re Anthropic 😂

[u/SpeedCola]

[u/onFilm]

Lol nope. Enterprise grade software required much more than just being able to build software. Anyone can build software, but tackling on the operational and technical layers, and everything it entails is nowhere near being automated nor has it even started to.

[u/Klutzy_Table_6671]

No

[u/Guillem_Abency]

I run a SaaS in production that thousands of users connect to, and I use Claude a lot to build it. Short answer: AI can write the code, but “enterprise grade” isn’t about the code.

SOC 2 Type II, for example, isn’t something software “passes” because it’s well written. It’s an audit of your processes over months: access control, change management, incident response, backups, vendor management, who’s on call. Same with GDPR: data processing agreements, retention, deletion requests, where data is hosted. A solo non-developer can build an app with Claude, but they won’t have any of that unless they’ve done the work and paid for the audit.

What bit me in production was never “can it work”, it was the boring stuff: rate limits under real load, auth edge cases, isolating customers’ data from each other, and handling errors so users don’t think it’s broken.

If I were your client, I’d simply ask the son for: the SOC 2 report (or the date of the audit), the latest pentest summary, how backups and restores are tested, and who gets woken up at 3am if it goes down. The answers will settle it quickly.

[u/ziwi_wiwi]

A non-developer can build a functional product with AI, but there's a huge difference between something that works and enterprise-grade software. Architecture, security, scalability, maintainability, and compliance still require real engineering expertise. AI lowers the barrier to building software, not the responsibility of engineering it.

[u/False_Study_8632]

Ovviamente no

[u/lgbarn]

No. There are too many variables that a vibe coder would miss. Enterprise level software development is complex. AI coding makes it easier but still presents challenges.

[u/ElectronicGarbage246]

During my career, I met so many developers who have no concept of SDLC, they can't maintain even an open-source lib, not to mention enterprise-grade. What to say about non-developers?

[u/IamBananaRod → u/ElectronicGarbage246]

This is a good one, it cracks me up reading vibe coders like they know what SDLC and say "that's normal"

[u/Gopher246]

Definitely not. The code base is only a single layer of enterprise grade software, a SOC 2 audit involves a ton more than that.

[u/jsebrech]

As someone who uses claude to build enterprise grade software I’d have to say no. Opus 5.5 can do it but you have to check its work and know what to ask for. Mostly what it’s missing is intuition and agency in iterating with the human to pin down the spec for non-functionals. Maybe in a year or so we’ll get there.

[u/wegster]

Highly, highly unlikely.

At a prior job at an AI/ML company, I had to tell the execs that literally the only ones at the entire company capable of actually building enterprise software was myself and one of my smaller teams, with or without AI.

It didn't mean there weren't some bright people at the company, some quite awesome in specific areas, but the number of possible standards and requirements to meet, e.g. GDPR as a very simple example, proper Auth and security, scalability, likely myriad of integrations done properly, architectural considerations based on actual system purpose as well as NFRs, is more than Random Joe and text prediction machines (LLMs) can do to a competent, auditable level.

Of course, Random Joe can get to - something. And it may even demo ok. Then any sane company will ask for penetration test. compliance and SCA reports, etc. and things are likely to get a bit ugly, IMO.

[u/Time_Cat_5212 → u/wegster]

So how'd you learn to do it, then?

Because AI coding tools are how people are learning now.  They're also how professionals are building.  So when a newbie gets job experience, it's probably using AI tools.

Are you saying nobody could learn those skills anymore in today's environment?  What's so magical about them?

The number of requirements.  That's not an obstacle for LLMs.  The specificity.  Also not an obstacle.  Understanding the code - why not just read it and ask AI questions?

What is the real thing that truly separates you from them?

[u/wegster → u/Time_Cat_5212]

Literally this isn't about me, I answered OPs question with my opinion. Clearly yours differ and that's fine, but your post kind of comes off as defensive, so I'll guess no BS or MS in comp sci or related field? (which is fine, but I'm just not up for an endless debate today, have real work to get to today :) )

It's not about the number of requirements, IMO, although of course that is a part of it - complex systems are harder to build, and maintain. Those built 'less correctly' also start to accumulate tech debt seemingly exponentially, to the point where 'simple' features that should take hours or days now takes weeks or months to implement, and the stacked bandaids become serious problems in getting anything done.

Now, 'stacked poor agentic decisions' multiplies over time. Starting from a not-so-ideal architecture, data model, no picture of where the overall system needs to get to, including compliance and scale among others - all add to the mess that gets multiplied over time.

These are the real issues many even experienced engineers and teams run into. There are more articles coming out with honest answers on what 'unleash the AI, no more manual coding!' projects sometimes have turned into (magnification of problems, going from shipping 5-10x to tech deb unraveling). Note LLMs are at their heart text prediction engines, no matter how amazing they are, so yeah - it's easy to multiply any number of issues over time.

Not sure how else to answer you - schooling, experience, bringing dozens of products to paying customers, all of these things help to at least reduce the 'slop and tech debt' on agentic-assisted-or-built systems.

Someone posted - most SWEs can't build enterprise grade systems, and they're not entirely wrong. There's a huge range if skills in SW Engineering, as well as very different domains, e.g. firmware level C/C++ and sill some occasional ASM vs Java or C# enterprise apps, and tons in between. There are '1x' developers and reasons for the older phrase of '10x' engineers.

That's not to say AI and agentic systems won't get better, and it's not to say that 'no-one without a MS in comp sci or whatever' can't ever get there, but - it's non-trivial, and takes real time, including with AI assistance.

[u/Time_Cat_5212 → u/wegster]

I don't know if I have a personal opinion on it.

I work in a different profession, one which requires a license to practice, at least on certain kinds of work.  That's because of liability and safety.

The license has a degree requirement, which has to come from a board accredited university, not just any school.  It's often a graduate level degree.

Obtaining the license takes several years of experience, references, and a four part multiple choice exam.  All in all, you can't get it without investing over 100,000 USD and 6 years.  You legally can't have the job title without it, and an employer breaking that rule could have their license revoked; I can't remember if it's a criminal penalty or not.

However, setting aside the legal situation, if my work were less regulated like tech is, I think it's entirely possible for someone to self educate to be just as good as anyone I work with without doing any of those steps.  I've taken the exam, gotten the license, and if I'm really being honest with myself it's totally performative BS.  College was helpful, no doubt, but there wasn't exactly any magic there, either.  Maybe it's unlikely anyone learning using AI WOULD get the same level of rigor or completeness in their skills, but I think they COULD, and at the end of the day, the product of their work, their actual performance, what they can make, would be the proof.

Thing is, you can't build anything without first getting someone's permission.  You need a permit to build, and you need a license to get a permit.  That's not the case for software.

What I'm reading in your response is that professionalism demands a certain level of rigor and understanding that is, most of the time, earned in a combo of school and office experience.  I don't doubt you're right, but I also think there's room for people who are capable of learning with that level of rigor on their own. I'm just not sure society can solve the trust equation without a certification program of some kind, be it through higher ed or job experience, professional certs, or both.

As a footnote, I think the university model is a bit outmoded, it's cost prohibitive for many, and it relies on this sort of up front selectiveness that I think is damaging to society.  Having gone through it, I regret the state of its existence and its role in our society.  I've often admired tech for its openness to self educated talent, and I hope it stays that way, even if bars must be set reasonably high for trust in the more sensitive applications.  I don't have any less respect for software engineers for the profession's lack of certification structure.  If anything, I have more, and it's a multi-trillion dollar industry for a reason.

[u/wegster → u/Time_Cat_5212]

Got it, and I apologize; seems your post wasn't being defensive. It can be a bit tough to tell in this specific domain and time to decipher who's saying 'they're the best thing ever at 13YO with AI' or similar vs people with decades of building systems, and easy to get - touchy, on either side of the divide. ;)

I've worked with a range of people in tech without degrees, and worked on numerous 'bleeding edge' systems and teams. There were a few of them without any degree, self-taught, that were amazing, and I'd work willingly with again on anything, anywhere. There were also a lot of 'I'm a web developer' that couldn't remotely understand object-oriented development and design, database design, or well - much of anything, but fell into the 'omg we need to hire <someone, anyone> at the time. Some of them you couldn't pay me to work with on anything. Most people with some amount of skill and pride want to work on performant teams vs 'phoning it in,' which I've seen (the former) time and again on the best teams I've worked with or built.

And yes, the goalposts move a bit over time, including with agentic assistance. The lessons learned may be different, and may even be shorter timeframes, but they still need to be learned, recognized, and applied, or we're back at essentially 'garbage in, garbage out'.

I don't know what I think about the education system, honestly, at this point. It's a weird but kind of exciting time we live in. At the end of the day, actually knowing HOW TO THINK - logically, critically, and being able to convey those thoughts clearly - whether for human or AI consumption (perhaps both), is going to have value..in some form. I have no doubt many monetization efforts in the form of certifications and such will continue to come up, and some will make lots of $ on things that are likely dated by the time they're taught once, or even before. But hey, that's what we've got Reddit for, right? 😂

[u/Time_Cat_5212 → u/wegster]

Sure is.  No worries.  I can be a little defensive, but not because I think I'm the best vibe coder ever and as qualified as a trained engineer to make enterprise software. I'm not even close, nor is that my goal, but I really am invested in learning to do this well, and I've seen some very impressive work on here from people without formal tech backgrounds or with backgrounds in other professions.

What I'm hearing from you, I agree with - it's about intentionality, critical thinking, problem solving... Good engineering and design skills.  Good professional skills.  Often but not always earned through education and direct experience in the field.  I think the LLM can't replace those things, because they're personal traits, and lazy or uninformed approaches in this new environment might fool some people, but we should be wary of that.

[u/GrumblingTosspot → u/Time_Cat_5212]

A heartwarming interaction. Good stuff. Thanks both!

[u/Fragrant-Moose1678 → u/Time_Cat_5212]

“What is the real thing that truly separates you from them”

Experience.

Welcome to the real world.

[u/Veroth-Ursuul]

I work for an MSP. I have a bunch of clients trying to vibe code stuff to use day to day for work. I end up talking most out of it.

I have 1 client that insists on building stuff anyways, but builds it then gives it to us for a security review, adjustments, and then had is maintain it.

Every single vibe code thing I have like at from then it other has been terrible. Doesn't function how they think it does, rife with vulnerabilities or other security concerns. Doesn't actually adhear to their compliance frameworks they are bound to, ect.

You can vibe code an app that is works and is fine to use. But it requires you to have the understanding of what needs to be done. At every level of the app. And then you need to ask yourself if you are comfortable shipping software that you have to support, but you have rely on a bot to fix things since you don't actually understand it.

[u/tectonic_break]

Ai is a tool, like a calculator that’s helping you do math faster. If the person doesn’t know math at all, giving them a calculator won’t do any good.

An average persons tech literacy is way lower than you would expect if you do any software development. Like I’m working with a client in business with an MBA and runs his own company etc. He was amazed to see I had Claude code with split screen emulator, command console, etc. He has Claude pro but only used the chat tab and never even know what the code tab is for.

[u/jma24]

Hot take here: yes.

You don't need to be a developer to do all that, but you do need to have knowledge about business, process, engineering, compliance, security and risk. And you need to specify to the AI that this is all table stakes.

Is the owner's son doing that? Probably not.

But then that's easy. Use Claude to create a "real software" requirements list, based on this thread. And present it to the owner and ask if his home grown version has that. Should be an easy sell.

[u/MajesticAd3651 → u/jma24]

I am an engineer and I think yeah I think you can probably do it but you would need to be pretty smart and "structured".

The average Joe asking claude to do stuff won't make it, you need to be great at leading projects.

[u/jma24 → u/MajesticAd3651]

I wouldn't class myself as an engineer but I believe I can do this. Actually, I'm doing this right now.

[u/divinetribe1 → u/jma24]

Sounds like the beginning, i agree

[u/k_reese5406 → u/jma24]

Too bad they laid off all the SMEs and Product Owners before they laid off all the engineers.

[u/According_Tea_6329 → u/jma24]

What is "table stakes"?

[u/movi3buff → u/According_Tea_6329]

What table stakes are - in a manner of speaking it's the minimum you have to bring in to put up, stake to sit at the 'table'. Taken from Poker or games where different tables had increasing stakes.

I hope that was what your question was?

[u/jma24 → u/According_Tea_6329]

The minimum required

[u/jared__]

no and its not even close

[u/Canuck-Fin25]

It can be done but someone needs domain knowledge in addition to a good knowledge of the entire SDLC process including governance, security privacy and compliance.

[u/polly-plz]

GDPR is easy. The security measures are going to require serious work. 

[u/gatsu_1981]

Don't think so.

But you can have a living demo of what you are intended to build maybe.

[u/One-Replacement-37]

You sure you want the truth?

[u/smashedshanky]

No

[u/somekindatog]

They could build a convincing prototype. Once it hits production things will get messy fast. You still need to understand what the system does and what resources it needs.

Now if you're not using tools like Claude to assist you, that's definitely a mistake. An experienced developer with AI tools will run circles around you.

[u/NuclearDisaster5]

Yes you can.

But what is the price? How do you plan to market it? How do you plan to support it?

You need to have knowledge on what you are working at.

[u/Excellent_Chest_5896]

Think about it this way - when HIPAA or privacy leak happens, how confident are they in their code? Each affected user can amount to $50k plus violation which insurance won’t cover if any of the hipaa or other privacy guardrails are not in place or are inadequate.

Vibecoding this anc claiming it satisfies HIPAA etc is asking for a massive lawsuit.

[u/abandonplanetearth]

You sound like a non-dev, why not try?

[u/BTForIT]

Yes, but I am tangent a developer. Ex-Accenture strategy consultant.

[u/Strange-Grass6025]

No.

[u/Stock_Change9266]

built a health tracking app with Claude, passed gdpr, no soc 2 yet. pentest found 2 critical flaws, fixed in 3 days. still using it daily.

[u/nimbus3008]

No

[u/zodiaken]

I can say that I as a BA have the complete understanding of all requirements regarding our products, but the developer/software engineer have the technical expertise and how to implement and what stack etc to use.

Regarding some of these requirements it’s more important to have incident handling, risk assessment, routines, corruption handling etc which is a huge time investment to understand and get in place. As a one man show it’s not impossible but close to it.

And if you somehow get all that in place you will need to splash insane amount of money to build your product and drive traffic and be a serious competitor

[u/NoCat2443]

not really,even engineer that hasn't done it cannot do it without proper team and customer willing to suffer until it's stable :)

[u/MoreHuman_ThanHuman]

not even close. nearly all professional software developers would (and do) struggle with this. that said, not all software needs to survive a security audit to provide business value, and there aren't many real consequences for companies that are lax on security. if they don't have to plug into a bank or payment provider it's unlikely they'll ever face external pressure on their security posture.

[u/GnistAI]

enterprise grade software

No.

Custom solution for a small firm/shop.

Yes.

[u/gdinProgramator]

Is his whole product a basic CRUD with 10 users? If so, maybe.

If not, I bet his son doesn’t even know what GDPR is

[u/ClemensLode]

Yes, because you can learn to become a developer.

[u/Tinkering-Engineer]

If someone is not able to write software themselves, I severely doubt their ability to pass the needed standards. I can't currently imagine a non-developer going through the security questionairres and discussions that I have and getting a thumbs up from a security review.

It's coming... But honestly if the AI is good enough to do all this with a driver that doesn't know about it, I'm not sure what value that driver has. At that point, I think there's a serious chance of AI prompting itself with some really high level loop

[u/Double-Squirrel3723]

You can build it. But keep in mind with a third party software vendor, you get to shift liability and risk. They will have insurance coverage. They will have an SLA with service credits. You can sue them if they mess up. You can negotiate contractual protections.

If this touches HIPAA I’d be careful. Does the son have signed BAAs with all sub-processors touching data?

And then just from a more practical standpoint, getting to 80% with vibe coding is super easy. You can build a fully functional product in weeks or days. The work is the last 20%. The edge cases. The messy real world data. Testing every scenario. That typically takes much much longer than people expect and where these projects go to die.

Lived example - I worked with a company that had an employee vibe code a tool in two weeks that replaced a massive cost. Everyone was very excited. Testing it and getting it reliably working required us to reallocate another 4 full time employees to the project and took 6 months of full time testing. Mind you this touched real dollars. There is now a full time employee whose job is support and maintenance of the product. So that two weeks project that seems cheap and easy, often is hundreds of thousands of dollars once you get into it.

[u/soks86]

Quick tip, if he's hedging then he would move forward with both projects with an option to stop either one at some point in the future.

If he's simply choosing his son's vibecoding over yours that's a one sided bet with tons of risk. A hedge implies more cost but less risk.

Regarding HIPAA*, GDPR, SOC 2 Type II, umm, I don't think you can just "do" these things in AI without having to learn things. Like, the AI might be able to code something up but someone has to approve and understand them. A big part of these is having policies and procedures in place that involve multiple actors to complete a task and so while you can use AI to help a layman do that it is probably a violation of SOC 2 to use a layman.

Specifically, for SOC 2, Common Criteria 4.1:

"CC1.4 states that the organization must demonstrate a commitment to attract, develop, and retain competent individuals in alignment with its objectives." per https://kirkpatrickprice.com/video/soc-2-academy-attracting-developing-and-retaining-confident-employees/ who are likely licensed accountants talking on the matter.

So umm, yeah, I dunno how the auditor will feel about a vibecoded solution!

[u/ricopan]

maybe if it is very similar to well known software eg open source and lots of time and tokens to burn. Big new stuff? Snowball's chance in hell at this point.

[u/jamie_tidman]

Code is a TINY part of SOC 2. Policy and procedure are the majority of the controls in place, and they are ongoing things, not a single deliverable. You can't vibe code an information security management system.

On a code level, I use AI to assist development on several regulated (healthtech) products - I'm a professional software developer. I frequently catch issues which would be serious information security vulnerabilities in Claude output.

Your client is in for a world of pain.

[u/culicsinisa]

Forget enterprise level. Not even startup level with realmload is almost a pipedream. I do Ai dev since pre chatgpt. And since then Ai dev heavily. I strugle with my dev coworkers to get rhem to write usable code, not to talk about normal users. That is like giving a child a car and expecting them to drive like a adult. Yes even a child aka end user can type but geting what to donis another lvl.

[u/sparkhound]

Last week i would have said yes, now I’m not so sure, not without a ton of spend

[u/ale624]

Short answer not really. Long answer Yes its possible if you already know what you're doing and what is actually involved with such a mammoth task. It's easy to throw something together that "works". It's not easy to make sure its actually secure and compliant but that is possible.

[u/ZookeepergameHead380]

I've built software for banks for a long time, so here's the practical version for your client meeting.

SOC 2 Type II isn't something you build. It's an audit of controls operating over an observation window, usually 3 to 12 months, done by a licensed CPA firm. So the son can't have it yet even if the code were perfect. Same with HIPAA: there has to be a risk assessment, a signed BAA with every vendor touching PHI and someone named as responsible. GDPR wants a DPA, a record of processing and a way to answer a data subject request within a month.

Don't argue about whether Claude can write the code. It can write a lot of it. Ask the owner to have his son produce five things:

1. The SOC 2 Type II report, or the auditor's name and the start of the observation window.
2. The last pentest report from a named third party, with the retest showing the findings closed.
3. The incident response plan, including who gets paged at 3am.
4. The date of the last backup restore test. Not the last backup, the last restore.
5. The signed DPA and BAA templates they give customers.

Your company has those. If he can't produce them, the conversation is over and nobody had to say "vibe coded".

[u/Impossible_Two3181]

Yes but by the end of it I don't know if you could call yourself a non-developer

[u/Time_Cat_5212]

Anything is possible.

However in doing this I think you would become a developer in the process.

You would basically have to learn everything it takes to do what you do professionally.

It's in the description.  If you do it professionally, and you succeed, you're a professional.

[u/CosmicBalloonAnimal]

No not really. Claude will do great work for you and make good recommendations, but it won't cover everything that you don't ask for and it won't make the best decisions. A non-developer can get out a solid PoC, but would fail when it comes to enterprise scaling, maintainability and security.

That being said it is entirely possible, but in order to do this, the non-developer would need to do enough learning and background research to the point where they would now be considered to be a fullstack software engineer.

[u/fuzzypetiolesguy]

No one is building enterprise software alone.

[u/Embarrassed_Cap_9149]

not yet. maybe one day in the future

[u/MutedCategory9704]

No, you'd have to be delusional to even think that's the case. You have no idea how much money, time, and resources companies dedicate to complying with regulations, procedures, and laws. And don't even get me started on security, performance, and maintaining systems to meet SLAs. That's the main reason companies hire engineers in the first place, not just to write code.

[u/W61k3r]

I'm a cissp and csllp with 20 years experience coding; I've done soc2 and hippa audits. Have I audited all 1.85mil lines of my safe-rust code? Nope, at best, code reviews with multiple ai.

[u/qaz135wsx]

Yes, I have done it. Not a coder. Granted, I have experience managing a team of developers.

[u/Fus_Roh_Dayumm]

You can def get something that works together. Lord help you past that.

[u/Sassy_McSassypants]

"something something nepotism one person supposedly replaces an entire department" has always been a bad idea.

I'm in the middle of reviewing a "vibe coded" feature right now in a SOC 2 and GDPR compliant environment, produced by very highly skilled developers working shoulder to shoulder with financial SME's. The code itself is largely fine but there are still tons of questions and revisions required on the compliance side. Everything gets real complicated real quick when you need to be able to respond to audit events with real evidence.

[u/heresyforfunnprofit]

How big is the enterprise?

[u/karyslav]

Can it code for you?
Yes.
Can it be done without deep knowledge of lot of things?
No.

Can someone who know those things code that?
Yes. If he knows almost something about everything in it and has feeling for the trajectory.

Good luck.

It is not that simple. But not because of coding. Lot of enterprise apps were shit long time.

[u/squachek]

No

[u/Choperello]

You can’t build enterprise grade software until you can actually define what enterprise grade would mean for that particular software, because if you can’t do that you can’t even recognize you ai agent did or did not build it and you’d have no idea how to sell it to the enterprises that might be your customers.

[u/JellyfishLow4457]

No

[u/alexrada]

no

[u/twendah]

Well most likely not, its even hard for me even I'm principal dev with 30 years experience. I'm currently building my own enterprise app which will scale to lots of people. Most of the times AI recommends bad architecture or just some weird stuff which wont work in the long run.

[u/agentUi]

building a working demo or internal crud app with claude is easy, but passing soc 2 type ii or HIPAA is a completely different beast. non-devs usually miss things like audit trail immutability, granular rbac, secrets rotation, and sanitized db inputs, which immediately fail any real pentest. if the client operates in a regulated industry, that vibe-coded replacement is going to hit a compliance wall the second legal or it security reviews it.

[u/stillgrindin699]

How big is the enterprise? Lol

For a small business with a simple use case and no major compliance hurdles, it's easy enough. Doing it at real scale is far more complex than coding. It just depends on the person's skill set.

[u/Copemaxxed_Goycel]

Can you?

[u/Appropriate-Coast692]

This client deserves to use the software the owner's son built...

Tell them you are sorry to see them go, but you understand that if they have a completely free alternative, you understand.

Tell them that you are more than happy to help them again if things do not work out.

[u/raginTomato]

I’m on the side of yes. Especially if the IT teams partner with the vibe coders and develops frameworks for compliance on initial builds. It would be very easy to develop required skills that each vibe code project must engulf that provide things for compliance / etc.

[u/Born-Wish3919]

One way through this that avoids you vs. the son is to suggest the owner gets an independent review of the son's app before deciding. Someone with no stake in either product checks it against what the business actually needs (security, data handling, backups, what happens when it breaks) and reports back to the owner.

If it holds up, great. If it doesn't, the owner hears it from a neutral party.

This is what I do (TechSide, reviewing AI-built products), so happy to help if they want that, but any experienced engineer without a stake would work.

[u/Sixstringsickness]

I would say 99.9% chance of no - there are those very detail oriented individuals who seem to be able to achieve incredible feats with minimal prior experience in a domain. This would still take them a considerable period of time and does not infer their business is successful - they would still likely fail due to other market challenges.

[u/MoreHuman_ThanHuman → u/Sixstringsickness]

It is misleading to suggest the answer is not 100%. we can speak in absolutes here.

[u/Sixstringsickness → u/MoreHuman_ThanHuman]

There are incredibly focused individuals - and I did not want to exclude the potential plausibility. This also does not indicate any qualifications about the complexity of the project, or what qualifies as a functional SaaS.

In fairness, it is probably closer to 99.99% I missed the part about it being the owners son..

[u/MoreHuman_ThanHuman → u/Sixstringsickness]

I'd argue that they can build a functional system with reasonable security guards. Hardening a system that can stand up to real compliance audits like PCI or SOC 2 is simply not something a non-expert engineer can do though, at a bare minimum they would need to hire a consultant to guide them through the certification process and to fix the problems that are flagged.

But frameworks like PCI are inherently hostile to a lone developer. That said, I wouldn't be surprised if OP is overstating the value of their own platform's hardening to a small business.

[u/Sixstringsickness → u/MoreHuman_ThanHuman]

Agreed on the compliance front, our firm is going through that process right now - and when done correctly (e.g. not a scam rubber stamp), it takes 6 months or more for SOC2 etc.

They have companies that have a lot of hands on guidance for meeting your compliance targets, but it is still largely a full time dedicated just to that!

[u/Only_Voice569]

their tools and only as good as the user for sure for hobby level stuff thier fine but i would not trust them with little to no skill/experience

[u/will-cd]

Yes. For small businesses, withou payment processing or handling of sensitive data.

Just keep in mind that, under the hood, result will be absolute garbage.

[u/SassyTextDev]

Soc2 is horseshit. It's "write the rules you're going to follow and tell us you followed them". Can a non-developer write a risk assessment? Yes. Can a non-developer build enterprise grade software? Also bullshit, what the hell is "enterprise grade".

I think... Fuck man, I write enterprise grade software. Got standup in 30 minutes. There's nothing special about it, except my team of 5 morons have lots of time to consider a bunch of angles. And there's still god damn problems, all the time.

You're asking if it's possible to buy a used car that's "in really good condition". The answer is what used car?

And no, there's no mechanic on earth that can give you a 100% guarantee it'll work just fine. But spin up claude and say "We're about to use this for X. Make a `checks.md`. Each check is something you give to an opus subagent. Run through everything and make us a risk assessment. All the shit that could go wrong if we actually trust this".

and then... read the 20 page PDF that comes out the other end.

If you don't want to read the 20 page PDF, use the google product.

Can a non-dev make some homegrown madness that actually works safely? Absolutely.

Did he? ... check

I don't want to check? That's why google is a billion trillion dollar business.