Infrastructure teams are caught in a dangerous bind: developers are shipping AI-generated code faster than ever, while the governance and automation foundations needed to absorb that velocity simply aren't there. Data from over 400 platform and engineering leaders makes the scale of this AI readiness gap impossible to ignore - and the arrival of agentic AI means the margin for error is shrinking fast.
Main insights
- 86% of infrastructure teams feel confident governing AI-assisted infrastructure, yet only 30% have formal policies in place - confidence without enforcement is not governance
- Approximately 76% of teams deploy AI-generated infrastructure code with little or no review, and 93% of organizations have already experienced AI-caused infrastructure incidents
- 89% of organizations plan to adopt agentic AI for infrastructure within a year, but governance readiness remains stuck at 30%
- Pioneer organizations share one defining trait: they built governance, automation, and platform discipline before AI arrived - "boring is the flex"
Dimitri Vlachos, CMO of Spacelift, brings over 20 years of technology marketing leadership and hands-on developer experience to the platform engineering space. Faisal Afzal is a solutions architect, strategy advisor, and platform engineering ambassador with deep expertise across AWS, Kubernetes, and infrastructure as code, serving on CNCF program committees and hearing war stories from Fortune 500 organizations firsthand.
You can watch the full discussion here if you missed it: The AI readiness gap webinar.
The velocity mismatch: Developers accelerate while infrastructure absorbs the impact
According to the 2024 DORA report, 90% of developers have adopted AI tools, spending 25% of their day working with AI assistance, and 71% use it to write new code. Spacelift's 2025 Infrastructure Automation Report shows the other side of that equation: 50% of infrastructure teams take a week or more to deploy changes, 43% rerun deployments up to four times, and 50% still struggle to scale traditional infrastructure as code practices.
"One side of the house has a jetpack," Faisal explains. "The other side is absorbing everything the jetpack is producing. Notice who's standing in the middle? That's your DevOps team. It's not a design choice anymore - it's just a job description."
The research confirms this pressure is real: 86% of infrastructure teams report that AI-accelerated development puts significant pressure on their operations. Meanwhile, 62% acknowledge that development is ahead of them, and 81% say keeping pace is extremely important. Recognizing the urgency without having the mechanisms to respond is an untenable position - and it's where most teams currently sit.
The confidence paradox: Feeling ready versus being ready
The most striking finding in the research is what Dimitri and Faisal call "the paradox": 86% of infrastructure teams express confidence in their ability to govern AI-assisted infrastructure, yet only 30% have implemented formal governance policies.
"Confidence without a policy is not governance - it's a feeling," Faisal emphasizes. "And a feeling does not survive contact with an agent making changes at 3 a.m."
Human engineers provide an implicit safety layer. They carry organizational context, understand where the bodies are buried, and know unwritten rules like "don't touch that cluster on Friday." Agents lack this institutional memory entirely.
"A written policy nobody enforces is just a feeling with better formatting," Faisal notes. "But policy plus enforcement - now you're talking about controls that actually run in the pipeline. The question becomes not whether I feel good about our governance, but what did we block last week and what got through."
The data reinforces why this matters: approximately 76% of teams deploy AI-generated infrastructure code with little or no review, and a third ship it with no review at all. Infrastructure code doesn't just run in your environment - it is your production environment.
The shadow IaC problem
Shadow infrastructure as code refers to every infrastructure change happening outside governed pipelines: the Friday console edit, the Terraform run from a laptop, the AI agent making changes through a path nobody designed.
"Shadow IaC used to be self-limiting because infrastructure changes required skills," Faisal explains. "AI removed that skill floor. Now everyone with a prompt and credentials can modify infrastructure."
The consequences compound through drift. When your Terraform state file says one thing and reality says another, AI tools reason from the code - navigating with a map that doesn't match the territory. "If a human can route around your controls, then an agent with the same credentials can too, at a thousand times the rate and at times when you're not even around," Faisal warns.
This isn't theoretical: 93% of organizations have already experienced AI-caused infrastructure incidents. These aren't predictions - they're last quarter's incident reviews.
The agent cliff: When automation removes the human safety net
The shift to agentic AI represents a fundamental change in risk profile. 89% of organizations plan to adopt agentic AI for infrastructure, with 24% planning implementation within six months. Yet governance readiness remains stuck at 30%.
"Two things change when agents show up," Faisal explains. "First, the agent does not have a memory of your organization the way a human engineer does. A human walks in on Monday already knowing what happened on Friday. An agent starts from zero every time."
Second, agents cannot read the room. Tribal knowledge - avoiding changes during peak hours, understanding the context behind architectural decisions - doesn't exist for agents unless explicitly encoded in the pipeline.
The data shows five failure types clustering tightly across organizations: configuration drift, policy violations, resource conflicts, security exposures, and deployment failures. "When five failure types cluster that tightly, that's a tell," Faisal notes. "It's one missing control showing up in five places."
Critically, 33% of teams are already experiencing issues with agentic systems while humans are still in the loop. "If a third of teams are getting burnt while humans are still watching, that number only goes one way," Faisal warns.
The maturity framework: From exposed to pioneer
The research categorizes organizations across four maturity levels - exposed, fragmented, outpacing, and pioneer - assessed across AI integration depth, governance maturity, automation coverage, risk exposure, and platform readiness.
- Exposed teams lack basic IaC coverage and formal governance. You cannot govern what isn't code, and every console change is invisible to any guardrails you might build.
- Fragmented teams have pockets of good practice but no standardization. Different teams use different tools, and policy as code is missing. "One team might be doing it well," Faisal observes. "Take their pipeline and make it the golden path."
- Outpacing teams have adoption but are missing critical controls. "You're missing brakes," Faisal explains. "Move one policy from paper into the pipeline. Start with the highest blast radius scenario."
- Pioneer teams demonstrate consistent discipline across all dimensions.
The gap between pioneers and exposed teams is stark:
Five practical steps to close the gap
- Achieve comprehensive IaC coverage. You cannot govern what is not code. Pioneers maintain 91% or higher IaC coverage. "Coverage is not the glamorous item," Faisal acknowledges, "but it's the prerequisite for everything that follows. If your IaC coverage is 60%, your governance coverage will never exceed 60%, no matter what you buy."
- Build governance before you need it. Move from written policies to policy as code that runs in the pipeline. "Pick one policy and express it as code," Faisal recommends. "That legitimizes it and preempts shadow IaC."
- Eliminate shadow IaC. Implement drift detection and ensure all infrastructure changes flow through governed pipelines. Inventory your AI use and your real IaC coverage before you buy anything.
- Measure AI-generated code differently. Tag AI-generated changes at the source and track their incident rate against your human baseline. "The first organizations to do this will know with data, not vibes, where AI is safe to trust and where it's not," Faisal notes. "That's a competitive advantage because everyone else is just guessing."
- Implement agentic governance from day one. Treat agents like new hires with unlimited typing speed. "You would never give a new hire root access on day one," Faisal emphasizes. "Do not give something that works at machine speed and never sleeps the same access."
If you enjoyed this, find here more great insights and events from our Platform Engineering Community.
If you want to dive deeper, explore our instructor-led Platform Engineering Certified Professional course and connect with peers from large-scale enterprises who are driving platform engineering initiatives.
Key takeaways
- The velocity gap is real and measurable - and hiring alone won't close it. 62% of infrastructure teams acknowledge development is ahead of them. Closing the gap requires platform strategy and automation, not headcount.
- Confidence without enforcement is a dangerous blind spot. 86% of teams feel confident governing AI-assisted infrastructure, yet only 30% have formal policies and even fewer have automated enforcement in their pipelines. Governance only counts when it runs in the pipeline.
- IaC coverage is the foundation for everything else. You cannot govern, secure, or audit what is not expressed as code. Pioneers maintain 91%+ IaC coverage while exposed teams sit at 14% - and that gap sets the ceiling for all other governance efforts.
- "Boring is the flex" - pioneers built discipline before AI arrived. The organizations handling AI-accelerated infrastructure best are those who established automated pipelines, policy as code, and platform engineering practices before AI became mainstream. Unglamorous foundational work creates competitive advantage when change accelerates.
