AWS brings vibe coding to the Enterprise with spec-driven Kiro IDE tool
Swaminathan describes the appeal of recent AI tools, saying, "Prompt, prompt, prompt, and you have a working application. It's fun and feels like magic. But getting it to production requires more." He outlines the typical stumbling blocks: "What assumptions did the model make when building it? What edge-cases did it cover? How did it handle errors? Requirements are fuzzy and you can't tell if the application meets them."
Kiro is designed to solve these problems by introducing what its creators call "spec-driven development." As the team puts it, "Kiro is great at 'vibe coding' but goes way beyond that - Kiro's strength is getting those prototypes into production systems with features such as specs and hooks."
Swaminathan explains how it works: "Start with a prompt: 'Add a review system for products.' Kiro translates this into a set of user stories with EARS-style acceptance criteria." He says Kiro then generates artefacts including "a data-flow diagram, TypeScript interfaces, a database schema, and API definitions."
The system's approach includes automatically specifying essential features for each user story. Swaminathan writes, "Kiro automatically includes requirements like mobile responsiveness, accessibility, loading states, and tests in the spec." Tasks are then "sequenced correctly and connected to requirements."
Importantly, the specs remain in sync as the code evolves. Swaminathan notes, "Developers can author code and ask Kiro to update specs or manually update specs to refresh tasks. This solves the common problem where developers stop updating original artifacts during implementation."
To automate repetitive work, Kiro introduces "agent hooks." These are "event-driven automations" that "trigger based on events like file saves or deletions." As Swaminathan puts it, "When you save a React component, hooks update the test file. When you modify API endpoints, hooks refresh README files. When you're ready to commit, security hooks scan for leaked credentials." He describes the benefit: "It's like having an experienced developer catching things you miss or completing boilerplate tasks."
These hooks are also collaborative by design. Swaminathan explains, "Once this hook is committed to Git, it enforces the coding standard across my entire team - whenever anyone adds a new component, the agent automatically validates it against the guidelines."
Kiro is built on top of Code OSS, meaning it is "compatible with existing VS Code settings and Open VSX plugins." It supports "Model Context Protocol (MCP)," agentic chat, and multiple context providers, including "files, URLs and document uploads."
Looking ahead, Swaminathan and AWS VP of Developer Experience & Agents Deepak Singh set out an ambitious vision for Kiro. They write, "We want to tackle the root causes of pain in software development - clarity of design, alignment with requirements, technical debt, code reviews, and knowledge sharing."
Kiro is available in a preview release for Mac, Windows and Linux, supporting most programming languages. Swaminathan invites developers to experience its approach: "We invite you to try Kiro and share feedback. We're just getting started, and your input will help shape the future of agentic development."
By combining the "magic" of AI-powered coding with structured specs and event-driven automation, Kiro is positioning itself as a tool for developers seeking to move quickly without sacrificing discipline or reliability.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
15 hours ago
- Techday NZ
ZEST Security adds AWS Service Control Policies to AI cloud platform
ZEST Security has announced the integration of AWS Service Control Policies (SCPs) into its Agentic AI-powered Cloud Risk Resolution platform to provide security teams with new, code-free mitigation methods for reducing cloud exposure. According to research conducted by ZEST Security, over half of cloud security risks are not immediately remediable due to several barriers such as unavailable patches, the inability to make code changes, or limitations brought about by legacy systems. This often results in organisations accepting these risks, which can increase the potential for security incidents if appropriate mitigating controls are not in place. Remediation challenges ZEST Security's "2025 Cloud Risk Exposure Impact" report underscores the difficulties of traditional cloud risk management. The report found that 56% of risks cannot be remediated primarily because a patch may not be available, a code change cannot be made immediately, or legacy systems do not support upgrades. In these cases, the report notes that, "organizations often accept the risk, increasing the potential for security incidents when appropriate mitigating controls aren't applied." Proactive SCT deployment By integrating AWS Service Control Policies as a core element of its mitigation toolkit, ZEST Security is targeting the issue of non-remediable risks. SCPs offer security teams the ability to enforce restrictions and compliance across AWS accounts, reducing the need to wait for work from other internal teams or available patches and upgrades before acting on a vulnerability or exposure. According to the company, "ZEST Security's mitigation pathways, now including AWS SCPs, offer a fast and reliable way to mitigate exposure, prevent exploitation and disrupt attacks at every stage, without waiting for patches, code changes or other teams to deliver full remediation." Blocking attacker activity By mobilising SCPs as a mitigation pathway, security teams can block both common and advanced attack techniques by controlling access to sensitive resources, encryption settings and public exposure, ZEST Security states. This reduces the risk of exploitation and helps prevent key attack stages such as reconnaissance, privilege escalation, and data encryption. Technology and AI support The ZEST Security platform leverages artificial intelligence agents to map vulnerabilities and misconfigurations identified by cloud security posture management and vulnerability management tools to corresponding mitigation pathways. The company's resolution engine assesses possible actions, including code or infrastructure-as-code fixes, patches, upgrades, cloud guardrails, and now SCPs, to identify the most effective means of reducing exposure at scale. "The ZEST platform leverages AI Agents to map vulnerabilities and misconfigurations identified by CSPM and vulnerability management solutions to remediation and mitigation pathways. ZEST's resolution engine analyzes all available options, including code/IaC fixes, patches, upgrades, policies and cloud guardrails to identify the most direct and impactful path to reduce cloud exposure at scale, even in scenarios when remediation isn't immediately possible," ZEST Security stated. Expanding mitigation options While SCPs represent the latest addition to ZEST Security's suite of mitigation capabilities, the platform also enables mobilisation of other controls such as Web Application Firewalls, VPC, and GuardDuty. These options allow organisations to harden cloud configurations, enforce policy compliance, and establish custom protection rules, particularly when code changes or upgrades are impractical. "While SCPs represent ZEST's latest mitigation pathway, ZEST provides a broader mitigation offering that mobilizes other controls and services such as Web Application Firewalls, VPC and GuardDuty to harden configurations, enforce stricter policies and create customized protection rules when code changes or upgrades aren't possible," the company stated. The announcement highlights ZEST Security's strategy of operationalising standard cloud policies and AI-driven mapping to address risks that cannot be resolved through traditional remediation approaches, offering practical alternatives to address persistent vulnerabilities in cloud environments.
NZ Herald
3 days ago
- NZ Herald
The NZ economy is still sick, doubts are growing about the Govt prescription
Are these the right antibiotics? Are the antibiotics making me feel sick? I do feel a little better I think. But it's taking longer than I expected. Maybe I should see the doctor again. Or am I just being impatient? Ugh, so much uncertainty. Hopefully, those who've tuned in for a fresh read on the state of the economy can see where this is going. Never let a metaphor go by, I say! Anyway, here's me and the New Zealand economy, both sick in the midst of a miserable wet winter and worrying about whether our recoveries have stalled. A run of negative data has knocked the wind out of the nation's sails. The bad vibes are being pushed along by a strong political current. Both the left and right are telling us that the Government has prescribed the wrong medicine. The left blames the Government for cutting spending into a downturn. The logic is pretty simple. Any good Keynesian will tell you, when demand in the private sector falls, that's the time for the Government to come to the party. Borrow a bit more, don't slash and burn civil service, hire more teachers and nurses, build more stuff ... it won't be inflationary because it won't be crowding out private sector competition, which is in recession. The trouble is, we're still in the aftermath of the last big spend-up, which went on too long. Labour's stimulus, once we got through the initial Covid shock, did clash with a private sector boom and exacerbated inflation. That muddied the political narrative. It made it inevitable that the incoming centre-right coalition would cut back despite the extra damage that would do to economic growth. In the context of using fiscal policy to drive economic prosperity, you can make a good case that successive governments have got things completely arse about face. You'd expect this argument from the left. But Christopher Luxon and Nicola Willis are being savaged even more aggressively from their right flank. The monetarists, the supply-side guys, the neo-liberals, (whatever you want to call them) are berating the Government for not dealing with the national debt and Crown deficit by administering a Rogernomics-style reboot of the whole economy. I doubt that would make the current downturn any more pleasant, but they argue it couldn't be much worse. And the payoff would be longer-term gains as the economy found a more productive and financially secure baseline. Both arguments can be compelling and, if nothing else, add to the concern that the current strategy of subtle market-oriented tweaks risks underdelivering on all sides. But through all of this gloom, one thing we need to remember is that most economists still believe the foundations of recovery are in place. Step back a bit from the mess of ugly recent economic data – the second quarter sucked, we get it! What are we actually experiencing? The labour market is tough. Unemployment is rising, and new job creation is almost non-existent. But this is not a surprise. In fact, while economists do get things wrong, they've been forecasting unemployment to be about where it is now for more than a year. We know it's one of the last pieces of data to turn in any recovery. Unfortunately, it is now overlapping with an unwanted and unexpected spike in inflation. Like a jump scare in the final scene of a horror movie, food prices (with rates and power, and insurance) have conspired to pause Reserve Bank rate cuts and rattled our faith in the recovery. Then there are tariffs and global unrest and all of that. It's not really surprising that it all feels bleak. So it's a bit ironic to be writing an optimistic take on the economy, especially given the rough week stuck at home that I've just had. My view wouldn't have been so upbeat if I hadn't been woken from my sick bed on Friday morning by a text from investment bank HSBC's Australian head of communications. He was asking how far away I was from my scheduled meeting with their global chief economist, Janet Henry and and Australia-New Zealand chief economist Paul Bloxham. Oops ... I was a long way away. But they kindly let me Zoom in later, and I'm very glad I did. As anyone with Australian cousins will know, sometimes it's healthy to be slapped in the face with a slightly condescending, external view of the New Zealand condition. Bloxham told me his forecasts currently make him one of the gloomiest economists on Australian growth. However, he's one of the most positive on New Zealand growth. Last year, New Zealand had the single largest contraction of any economy in the developed world, Bloxham points out. That inevitably comes with a hangover. But if you believe in the fundamentals of the New Zealand economy, which he does, there is no reason to assume the cycle won't turn. 'I suspect why I'm a little bit more upbeat than others is I sit in Sydney and watch it from the outside and go: hey, you've got two big forces at work that are set to continue to lift growth and give you a recovery.' No prizes for guessing those two forces – falling interest rates and booming agricultural commodity prices. The money flowing into the rural economy must eventually flow through to the cities and lift growth, Bloxham says. It won't happen overnight, but it will happen (my words, not his). We've had a big downswing, which means we're due a pretty big upswing to get back to trend, he says. And we've got monetary policy and the terms of trade in place to drive that cyclical upswing. 'All cycles look different. We always ask the same question going through: oh, it's not quite happening as quickly as we thought. 'The question you ask yourself is: is that because it's not working? Is it that interest rates aren't going to have the same effect? That a positive-terms-of-trade shock won't have the same effect? Or are things just a bit different this time around?' Great question. And look, the sun's finally out and I think my head's clearing. Time to go for a walk and ponder it all. Liam Dann is business editor-at-large for the New Zealand Herald. He is a senior writer and columnist, and also presents and produces videos and podcasts. He joined the Herald in 2003.
Techday NZ
5 days ago
- Techday NZ
The bouncer at the door: Protecting your network from within
Imagine for a few minutes that you are the owner of an exclusive club where business VIPs gather to share information and relax. And then assume that you hired the best security detail – a "Bouncer" – to stand at the door and ensure you know exactly who comes and goes and keeps everyone safe inside. Maybe picture some combination of Daniel Craig, Lucy Liu and Duane Johnson – that's your Bouncer. At first, you shower the Bouncer with praise and money for creating a secure environment that helps draw people. Now imagine that after a couple years, you take the Bouncer's presence and influence for granted, and you stop praising and paying. In time, the Bouncer is willing to trade entry for cash "tips" and eventually stops caring altogether who comes in and what happens when they get there. Neglect has turned your guardian into a hidden monster at your door. Network security is a lot like that. In a world obsessed with fending off cyber-monsters - phishing attacks, ransomware, and sophisticated malware - there's one lurking danger that's often overlooked: outdated network security hardware. If you've got a firewall or other IT equipment in your closet that's past its prime, it might be doing more harm than good. With neglect, what was once the critical gatekeeper (a/k/a Bouncer) guarding your business can become the hidden monster in your closet. Forget the Hollywood-style breaches; the real nightmare scenario comes from an unmonitored, unpatched IT stack running outdated firmware. Who's watching your IT closet? How well do you know the IT Bouncer in your closet? Do you know who's responsible for keeping it running at its prime? Are you using current technology that guards you against the latest attacks? For many businesses, the answer to these questions is a resounding "no." That neglected piece of hardware sitting in the back of the closet may once have been state-of-the-art. But if it's no longer supported by the manufacturer, it's a sitting duck for attackers who will be scanning the dark web, shopping for serial numbers of vulnerable devices. End-of-life (EOL) hardware doesn't receive updates, patches, or security fixes. Attackers know exactly when a vendor stops supporting a device, and they actively exploit this knowledge. These out-of-date devices are often left connected to the internet, unwittingly providing a direct entry point for malicious actors. The weakest link in the chain Every business depends on its network to function, but a network is as strong as its weakest link. Unmanaged, EOL hardware can become the Achilles' heel of an otherwise robust IT security stack. Not having someone proactively paying attention to the security of your network can create a false sense of security – "but I have a Bouncer." Take a firewall, for instance. Its primary job is to protect your network by filtering traffic, identifying threats, and enforcing security policies. But when it's no longer receiving firmware updates, it becomes increasingly ineffective. Over time, vulnerabilities pile up as cybercriminals develop zero-day exploits that target these known weaknesses. It's not just firewalls. Switches, routers, and other network devices can also pose a risk when they reach EOL. Dated or unmanaged hardware leaves gaps in your defenses, making it easier for attackers to infiltrate your network, steal data, or disrupt your operations. The quick fix? Evaluate a managed service provider. Why businesses hesitate Despite these risks, many organizations delay upgrading their hardware. Why? Cost concerns: Upgrading network security hardware can seem expensive. Decision-makers often see it as a non-urgent expense, especially if the current system is still functioning. Upgrading network security hardware can seem expensive. Decision-makers often see it as a non-urgent expense, especially if the current system is still functioning. Complexity: Replacing hardware can be daunting, requiring downtime, planning, and coordination between IT staff and vendors. Replacing hardware can be daunting, requiring downtime, planning, and coordination between IT staff and vendors. Out of sight, out of Mind: Many organizations don't conduct regular IT audits, leaving outdated devices unnoticed in the back of a closet. These reasons may feel valid in the short term, but the long-term consequences of inaction can be devastating. The primary objections/concerns that lead to neglect can be overcome by buying security as a service. The real cost of ignoring EOL hardware What happens when you ignore outdated hardware? The potential fallout includes: Data breaches: Attackers exploit vulnerabilities in EOL devices to steal sensitive customer or company data, leading to financial loss and reputational damage. Downtime: A successful attack can take your network offline, halting operations and costing you thousands - or even millions - in lost revenue. Non-compliance: Many industries have strict regulations regarding data security. Running unsupported hardware may violate compliance standards, leading to fines or legal trouble. How to tackle the problem Leverage managed services – If managing your IT stack in-house feels overwhelming, consider outsourcing to a managed service provider (MSP). MSPs can monitor your devices, ensure firmware is up-to-date, and proactively replace hardware before it becomes a liability. Spend your money on service-oriented outcomes, not just products. Implement layered security – Upgrading your firewall is a great first step, but no single device can protect your network entirely. A layered security approach - including intrusion detection systems, endpoint protection, and robust user authentication - provides a more comprehensive defense. Get a comprehensive audit – Start by knowing all the hardware in your IT environment. Find a service provider who has tools to identify IT assets that have reached or are approaching end-of-life status. Don't just look at firewalls - include routers, switches, and even endpoint security devices. Develop a replacement plan – Once you've identified outdated hardware, work with your IT team or a trusted vendor to create a phased replacement plan. Prioritize devices that pose the greatest risk and allocate budget accordingly. Educate your team – Make sure everyone in your organization understands the importance of keeping IT hardware up to date. Cybersecurity isn't just an IT responsibility - it's a company-wide priority. Proactive measures save money and headaches Upgrading network security hardware may seem like an expensive undertaking, but it's far less costly than recovering from a data breach or dealing with regulatory penalties. Many service providers offer opex-based solutions as a monthly service, sparing you the often large and discouraging capex investments. Proactively replacing outdated devices keeps your network secure, your operations running smoothly, and your customers' trust intact. Plus, newer hardware often comes with advanced features that improve performance and scalability, providing additional business value. For example, modern firewalls may include AI-powered threat detection or integrated VPN capabilities, offering greater protection and functionality than older models. The risk is real - Don't wait to act If you've been ignoring the IT stack in your closet, now is the time to act. The risks of running EOL hardware far outweigh the inconvenience of replacing it. Hackers are constantly evolving their tactics, and outdated devices make their job easier. Don't let your business become a statistic. Schedule a hardware audit today and make a plan to stay ahead of EOL risks. Because when it comes to cybersecurity, prevention is always better than cure. The monsters in your closet aren't imaginary - they're outdated network devices just waiting to be exploited. Protecting your organization starts with understanding the risks and taking proactive steps to address them. By replacing EOL hardware, you're not just upgrading your network - you're securing your future.
