Vibe coding for scale

I vibe coded a full ISMS. It works. It’s in production.

But that doesn’t mean I agree with all the people saying things like “ERMs are dead, just vibe code what you need.”

The risk with vibe coding isn’t just code quality. That matters, of course. But the bigger risk is how fast you can build something that looks done before anyone asks how it scales.

A risk register works great as a flat list. Until you have 3000 entries, nothing links to controls, and audit prep takes weeks instead of hours.

Access control works great with three hardcoded roles. Until you add contractors, a customer portal, and a new team. Now every permission change is a fragile code change.

An event pipeline handles 10,000 audit log records a day just fine. Then a new integration pushes it to a million overnight and the whole thing backs up. Because nothing was designed for backpressure.

These aren’t new problems. Systems have always failed this way at scale.

Vibe coding just lets you get there faster. You can build in a week what used to take months. Which means you hit scaling problems sooner, with less architecture in place to handle them.

The answer isn’t to stop vibe coding. It’s to pair the speed we get with the structural thinking that makes it hold up.

The tool changed. The discipline didn’t.