The answer is another question. If you wanted to build a house, would you first ask yourself how to build a saw or a hammer?
All the tools to build a house already exist, because everybody needs a house. The real question is how to build the best and safest house, with the smartest tools, at the best cost.
Unless you are in the tooling business or a manufacturer, you do not need to know how to make tools. And unless you sell code, or need code particular to your niche or your website, you do not need to write it.
Superfluous code was always a waste of time and money. What makes it worse than a waste is that it is also a liability: another thing that can break down or break things, another time bomb.
And it has never been cheaper to acquire. Ask an assistant for a feature and it returns working code in seconds, but working is not the same as safe. The security firm Veracode has watched this play out across more than 150 large language models: the share of AI-written code that compiles and runs has climbed to about 95 percent, while the share free of a known security flaw has sat near 55 percent for two years. Asked plainly, without being told to be careful, close to half of what these tools produce carries a known security vulnerability, and the larger, newer models have not moved the number.1
The flaw is only the first cost. Code also carries things it should never reveal: the keys and passwords that let it reach a database, a payment gateway, a list of customers. In 2025 alone, the secrets-scanning firm GitGuardian counted more than 28 million such secrets pushed into public code repositories, and commits written with one AI coding assistant leaked secrets at about twice the baseline rate. And these secrets do not expire the moment they are noticed. Years after exposure, roughly two-thirds of leaked credentials were still valid: an unlocked door left standing long after everyone forgot it had been cut.2
Beware of custom code as you would of custom hammers. They are of no use to builders and homeowners, and the good ones are already made.
There is a quiet advantage to not building your own tools: they are already made, and they are maintained by the company whose business is keeping them sharp. We do not measure our Stewards by how much code they can write, but by how much code they can spare a client from owning. We assemble most of what a firm runs on from existing tools that are continuously updated by their creators. When a business truly needs custom code for a niche that no off-the-shelf product can fill, we build it differently: we ensure vulnerabilities are caught before shipping, ownership is maintained long after the original author is gone, and sensitive data remains strictly controlled.
Concierge CIO Partners is a unified Guild of senior technologists providing dedicated, long-term fiduciary IT leadership to midmarket service firms. It offers a strategic alternative to fragile internal IT silos and to Managed Service Providers who advise you on what to buy and are paid on what you buy. With transparent unit pricing and an automated service catalog, the Guild eliminates administrative bloat and ensures every IT dollar spent and decision made directly drives your financial performance. The best code a business can run is usually the code it never had to write, and the little it truly needs is built to outlast the hand that wrote it.
1 Veracode tested more than 150 large language models on 80 coding tasks across four languages: the share of AI-generated code that compiles and runs has risen to about 95 percent, while the share free of a known security flaw has held near 55 percent for two years, and larger, newer models did not improve on it. Close to half of the code carried a known vulnerability when the model was given no security instruction: Veracode, Spring 2026. 2 GitGuardian found 28.65 million new hardcoded secrets added to public GitHub in 2025, up 34 percent year over year; commits made with Claude Code, one widely used AI coding assistant, showed a 3.2 percent secret-leak rate against a 1.5 percent baseline; and roughly two-thirds of exposed credentials remained valid years after they leaked: GitGuardian, The State of Secrets Sprawl 2026.