Automated vs Manual Code Review for Developers

We worked with a leading enterprise software company, over 400 engineers, to analyze how AI-driven code reviews compare to traditional, human-only reviews. Here’s what happened: 1000+ PRs were evaluated. 10 repos. 4 months of data. We split the PRs into two groups: 1. PRs where Bito’s AI Code Review Agent gave feedback first. 2. PRs where humans took the lead on code review. The results were hard to ignore: → Regressions reduced by 34% → Average PR closed 45% faster with AI feedback. → Median time to close improved by 89%, from 17 hours to just under 2 hours. Why? It all came down to speed and efficiency. → AI gave its first feedback within 5 minutes. → Humans, on average, took 6 hours just to get started giving feedback. But it’s not just about getting there first. Bito’s AI Code Review Agent also reduced the need for human feedback: AI suggestions made up 77% of the total comments on PRs. One recent customer summed it up perfectly: "It reminded me of when I first sat in a Tesla with autopilot!" Anyway, what does this mean for developers? → Less downtime for your apps and less rework → Faster feedback cycles. No more waiting around for hours to unblock a merge. → More bandwidth for reviewers to focus on what matters…. deep, high-impact feedback that humans are uniquely good at. → PRs that move through the pipeline faster, so teams ship code sooner. The bottom line: AI isn’t replacing human reviewers. It’s freeing them up. In this case, the team spent less time firefighting PRs and more time solving real engineering challenges. For me, this kind of data is exciting. It’s what’s actually happening on real dev teams right now. Would you pick the 6-hour wait… or the 5-minute boost? #code #codereview #developers #software

"Always review AI-generated code before it goes to production." Sounds wise and I would fundamentally agree. Hard to argue with. And yet, my fear (hope?) is that this advice is about to age very badly. AI agents are already producing work at a pace that makes traditional code review impractical. Not slightly inconvenient. Impractical. When an agent can generate in minutes what used to take days, inserting a manual review step becomes the bottleneck that negates the entire advantage. And before someone says "but safety!", let me be clear: I'm not arguing against governance. I'm arguing that the governance model most people have in mind doesn't scale. Here's the thing. Manual code review was never as rigorous as we told ourselves. Reviewers skim. They pattern-match. They approve things they don't fully understand, especially under pressure. We've been trusting a process that was already fragile. AI has just accelerated the volume enough to make the cracks impossible to ignore. So what do we do? I think we should trust shift trust from human inspection to systemic verification. Automated tests that genuinely cover behaviour. Continuous integration on every change, no exceptions. Deployment pipelines with progressive rollouts and automated rollback. Observability that tells you what your system is actually doing. Contract testing between services. None of this requires reading every line an agent produces. All of it gives us a faster, more reliable feedback loop than a human reviewer ever could. The irony is that the people shouting "review everything!" are often the same people who never invested in these practices. They relied on manual review as a substitute for proper engineering discipline. Now that the volume has outgrown the approach, they're doubling down instead of rethinking. If your only mechanism for trusting code is a person reading it, you were already in trouble. AI just made it obvious (remember: it's an amplifier!) The question isn't whether to trust AI-generated code. It's whether we've built a system that deserves to be trusted, regardless of who or what wrote the code. #AI #ArtificialIntelligence #SoftwareDevelopment #SoftwareEngineering

Line-by-line code review is finally dead. It's been a zombie for years - everyone's always hated doing it - but AI coding tools have exploded the number of PRs and made it finally impossible. Every org we work with bumps into this really quickly (see the attached chart). They start doing more AI coding and it breaks their processes because suddenly each dev is creating a few PRs each day but no-one wants to review them. (Also the PRs are often bigger but that's a topic for another day.) No-one signs up to be a coder because they love reading someone else's code, so no-one's motivated to spend half their day reviewing. So the review backlog grows and grows. This is a problem, but the solution isn't to shout at devs to review more. Rethink code review. The point of review is: 1) find bugs 2) make sure the code is consistent with the rest of the repo 3) check decisions with future implications 4) communicate the changes to other devs 5) have two sets of eyes so ISO27001/SOC2 auditors are happy (1) and (2) are now best done NOT by humans, but by automated tools including LLMs, probably multiple of them. (3) and (4) are important and should 100% be still done. (5) is still valid. Here's the coding/review process we see working best right now: * developer plans with the agent * developer reviews plan * agent implements * developer reviews all the code, especially the tests/acceptance criteria (sometimes get the AI to write the tests first to make this easier/parallelisable) * that review can either be locally or in a draft PR - best is usually in a PR because then CI can be running in parallel * the agent watches CI for failures and watches automated review feedback, triaging and fixing eagerly * then finally “Ready for Review” * only at this point does another developer act as reviewer, but they don’t review line-by-line, because that's been done by multiple agents * the developer needs to understand the goal and then review schema or infra changes, also review the new tests at least at principle level * the most important thing they need to review: decisions made in this PR which might have ramifications * what you’re looking for here is things that might have security implications, scalability implications, non-functional requirements implications, etc Your tools should be surfacing these decisions so that a developer can assess their implications. Yes, that's what we're building with Cadence - checking the code and the session log in parallel to understand and surface decisions - but use something else if that's better for you. But fundamentally it's time to rethink code review. Your devs will thank you for it!

Using AI as an extra check before you commit code can be genuinely helpful. It catches obvious issues. But treating it as a replacement for human review is dangerous. After every major feature, I ask it to review its own output for unnecessary complexity and bloat. It catches things I would have missed on a quick scan. That part is genuinely useful and I would recommend every engineer add this step to their workflow. But there is a gap that is easy to overlook: AI cannot tell you if code is safe in your specific system. It might not know that this function gets called 50,000 times per second in production or if a subtle change here will cascade into a failure three services downstream. The nastiest bugs I ever dealt with looked perfectly clean in code review. They only showed up under real traffic patterns that you could only understand by living inside that system for months. AI reviews what the code does. Engineers review what the code does to your system. Both are valuable. They just solve different problems.

Does manual code review still matter the same way it used to or has AI changed the game? Traditionally, we’ve asked two things of code: 1. Deliver the required capability correctly. 2. Stay within cost constraints of time and money. Today, we can go further : One LLM can generate code from requirements, another can generate tests from the same inputs, and a third can perform the review. Running them adversarially and iteratively increases alignment with what was actually intended. But this shifts how we define quality : Beyond correctness, we now need documentation, security, reliability, performance, maintainability, compliance, and provenance. Add to that: Traceability: Why did the system choose this design? Observability: Can we detect regressions early and automatically? Which raises a deeper question: Do we still need human code reviews at all? Or should we shift left : putting the human in the loop at the beginning, to define requirements, constraints, risks, and context, and then let AI generate freely within those guardrails? Are we moving toward a world where AI-generated code becomes untouchable by humans? I’d love to hear how your teams are approaching this. Where do you keep the human in the loop? #AIinPDLC #CodeQuality #AIDrivenDevelopment #SoftwareDevelopment

Unpopular opinion: Your senior engineers shouldn't review most PRs. AI tools generate code faster than ever. But code reviews still take 5 days on average. We've created a new bottleneck. And it's burning out your best people. Google's Addy Osmani called it out recently: "Code review is becoming the new bottleneck... we tend to have finite senior engineers." Human code review was never that effective anyway. The research is humbling: Formal inspections catch 55-65% of bugs (Capers Jones, 12,000 projects) Informal reviews catch less than 50% 75% of review comments aren't even about bugs. They're about maintainability. Meanwhile, AI code review tools hit 42-48% bug detection in 2025 benchmarks. That's approaching human-level on pattern-based issues. So what's the play? Let AI triage your PRs: Doc updates → auto-approve Simple refactors → AI review + merge New features → AI first pass + human sign-off Auth/security/architecture → always human One team cut first feedback time from 42 minutes to 11 minutes using this approach. The goal isn't replacing human judgment. It's stopping your senior engineers from being expensive spell-checkers. I'm experimenting with AI reviewing AI-generated code right now. Early results are promising. What's your code review bottleneck look like?

🤖 When will we no longer need humans in the loop? Multi-agent #AppSec reviews, like those demonstrated by #Aardvark (OpenAI) and #CodeMender (Google DeepMind), are a fascinating evolution. They show how far we’ve come in reasoning over code, validating findings, and even suggesting fixes across large systems. In my post yesterday (link below), I wrote about the hidden complexities behind these elegant demonstrations. Today, I’m asking a broader question: 👉 At what point do we no longer need a human in the loop? Let’s anchor this in real numbers: 💰 A senior US-based developer averages around $70/hour. A typical pull request review can take an hour or more, meaning the true cost of review often exceeds $70–$100 per review, before even factoring in context switching or iteration. ⏰ Meanwhile, research shows that the average pull request lifecycle (including waiting for review, comments, and merge) often stretches across 6–8 hours or even days, delaying deployment and feedback cycles. Now imagine multiple AI agents running autonomously on a codebase, detecting potential issues, as performance bottlenecks, #security vulnerabilities, logic bugs, or design flaws. That raises two fundamental questions: 1️⃣ How much are we willing to pay for detection and validation only? 2️⃣ At what cost does it become viable to trust the system without a human in the loop? IMO, for it to make business sense: ⚖️ The AI detection must be an order of magnitude cheaper than human time (roughly $7 per review). 🚀 It must act faster than humans, creating measurable ROI through shorter review cycles. 🧠 It must adapt to each team’s unique code review culture, such as focusing on test coverage, logic validation, or architecture patterns. A one-size-fits-all agent won’t cut it. 🗣️ It must be highly accurate (high true-positive rate), even if that means tolerating more false positives. The key is to communicate expectations clearly with #developers and leadership. Design for human-in-the-loop today, but engineer for human-out-of-the-loop tomorrow - when confidence, context, and economics align. The real breakthrough won’t be when AI replaces the reviewer. It will be when trust, speed, and cost converge so seamlessly that no one notices the transition. Related post from yesterday: https://lnkd.in/dWX4__XN