Bruno Bueno

Technology Strategy Consultant | Board Advisor. Helping leaders make better calls on complex platforms: what to modernize, simplify, secure or retire.

[Bruno Bueno @BrunoBuenoIO]

For nearly two decades I've led engineering teams and modernized business-critical platforms across SaaS, security and digital products. Now I help leadership teams with the hard calls: what to modernize, simplify or retire, and where AI pays off. https://t.co/OFVGWTPSTt

[Bruno Bueno @BrunoBuenoIO]

@lennysan Useful data, thanks for pulling it together. The FDE rise reads to me like buyers paying for someone who can make the product work inside their own messy systems, not for another feature.

[Bruno Bueno @BrunoBuenoIO]

@chrissanders88 Congrats on the launch. For a lot of teams the browser is where the work happens, so it's where the questions start after an incident. Building it around those questions, with Ryan Benson teaching, is a strong call.

[Bruno Bueno @BrunoBuenoIO]

@andrestaltz Point 13 is the one I'd put in front of leadership. I'm for automating all the way to deploy, but a bot reviewer checks what you taught it to look for. Someone still has to verify the product actually works for the people using it.

[Bruno Bueno @BrunoBuenoIO]

@thorstenball One reason shared libraries keep their value: someone else maintains and patches them. Remix one into your own code and its next security fix is yours to notice and port. Agents made writing code cheap. Owning it didn't get cheaper.

[Bruno Bueno @BrunoBuenoIO]

@martinfowler The line I'd hand to leaders: durable is not the same as correct. Retries are at-least-once, so without an idempotency key a lost reply becomes a second purchase order. An agent that runs for weeks is a distributed system, with a budget attached.

[Bruno Bueno @BrunoBuenoIO]

@SwiftOnSecurity A guessed version fails loudly. A guessed package name is the quiet risk, because anyone can publish under it. A 2025 USENIX Security study found 19.7% of packages suggested across 16 code models didn't exist. Agents should install from a pinned, approved list.

[Bruno Bueno @BrunoBuenoIO]

With coding agents, the scarce skill isn't prompting. It's saying what done means before the work starts: what must be true, how we'll check it, what's out of scope. An agent will finish the wrong task quickly and confidently. Clear acceptance criteria became a leadership job.

[Martin Fowler @martinfowler]

Long-horizon agents can automate tasks that take days or weeks, but much can go wrong. Kiran Prakash explains how durable execution allows agents to recover.

https://t.co/LUAR5OCl4M

[Bruno Bueno @BrunoBuenoIO]

@MichaelRosmer Agree the human time is the real cost. It's why I track cost per finished, verified task instead of price per token. On hard, ambiguous work the top model can win on that number. On routine, well-defined work a lighter one gets there without extra babysitting. The task decides.

[Bruno Bueno @BrunoBuenoIO]

@cote Good pick. The most practical part for me: "Invalid date" is a dead end for an agent, while an error naming the expected format is a fix it can apply. Agent readiness starts with the APIs, docs and errors you already own.

[Bruno Bueno @BrunoBuenoIO]

@ResilientCyber Strong write-up. "Best practices rich and implementation poor" is the most honest line I've read on this lately. Shrinking exposure and killing whole bug classes at the source are things a board can actually fund and track.

[Bruno Bueno @BrunoBuenoIO]

@mitchellh Agents make this matter more, not less. When an agent says the build works, someone still has to know which layer to doubt: the code, the container, or the Linux VM Docker Desktop quietly runs underneath on a Mac.

[Bruno Bueno @BrunoBuenoIO]

@unclebobmartin Same place I've landed. I'm fine automating all the way to deployment, but the passes you list, architecture, concurrency, security, are where a human still signs off. Agents made writing code cheap. Accountability didn't move.

[Bruno Bueno @BrunoBuenoIO]

@joshcorman That's the gap. "Patch faster" assumes staff, budget and maintenance windows a small utility doesn't have. The first action on CISA, EPA and FBI's list for water systems is cutting public internet exposure. Fewer exposed parts buys time. It doesn't remove the need to patch.

[Bruno Bueno @BrunoBuenoIO]

Coverage says a line ran during a test. It doesn't say a test would notice if that line broke. Mutation testing checks that: break the code on purpose, see if a test fails. Google runs it inside code review. As agents write more of our tests, ask: would they notice?

[Bruno Bueno @BrunoBuenoIO]

@QuinnyPig Useful catch. When an AI tool quietly drops a "no sale or targeted advertising" line, leaders need that signal before the next renewal conversation.

[Bruno Bueno @BrunoBuenoIO]

@dhh Nice work on this. Making secure boot the install path, not a BIOS chore, is the kind of simplification that raises the security floor for everyone.

[Bruno Bueno @BrunoBuenoIO]

@rauchg @aisdk Clean ship. Streaming typed generative UI from the agent into Slack and Teams is a real step for how teams will work with agents day to day.

[Bruno Bueno @BrunoBuenoIO]

@simonw This is a good one. Human-curated opener on top, full agent detail collapsed under details/summary. Review capacity is scarce; this pattern protects it.