How Static Analysis Can Help in the Age of AI | Kai Schmithusen | GameDev Day 2026

We invite Kai, a member of the We invite Kai, a member of the JetBrains Kadan team, to give JetBrains Kadan team, to give JetBrains Kadan team, to give a talk titled a talk titled a talk titled "Code Quality Never "Code Quality Never "Code Quality Never Changes." How Changes." How Changes." How static analysis static analysis static analysis can help in the can help in the can help in the AI ​​era. Hello, Kai. AI ​​era. Hello, Kai. AI ​​era. Hello, Kai. Hey, hello. Nice to Hey, hello. Nice to Hey, hello. Nice to see you both. see you both. see you both. Yes, it's nice to have you Yes, it's nice to have you Yes, it's nice to have you here. Eh, it's always here. Eh, it's always here. Eh, it's always nice to hear about the nice to hear about the nice to hear about the quality of the code. This is a topic quality of the code. This is a topic quality of the code. This is a topic that that that never changes, as you say, never changes, as you say, and is always relevant. and is always relevant. Yes, definitely. Yes, definitely. So, yeah, it's probably So, yeah, it's probably So, yeah, it's probably not as trendy as AI and not as trendy as AI and not as trendy as AI and everything else, but it's everything else, but it's everything else, but it's still very, very still very, very still very, very relevant. And I will explain relevant. And I will explain relevant. And I will explain why in my why in my why in my presentation. presentation. presentation. We all value We all value We all value quality very much. Kai, we see quality very much. Kai, we see quality very much. Kai, we see your slides. Uh, your slides. Uh, your slides. Uh, please start. please start. please start. Okay, thank you. Class. Okay, thank you. Class. Okay, thank you. Class. Yes, thank you all for Yes, thank you all for Yes, thank you all for listening to my listening to my listening to my story about story about story about code quality. Well, I'll be code quality. Well, I'll be code quality. Well, I'll be honest right away. I am not an honest right away. I am not an honest right away. I am not an engineer. I am from the business engineer. I am from the business sector. Uh, but I promise I sector. Uh, but I promise I sector. Uh, but I promise I won't show any won't show any won't show any marketing marketing marketing slides. And I have been working in slides. And I have been working in slides. And I have been working in this field for almost 20 this field for almost 20 this field for almost 20 years. So even I years. So even I years. So even I unwittingly unwittingly unwittingly learned something. Good.

learned something. Good. learned something. Good. Let's move on. Let's move on. Let's move on. Code quality. Uh, what am I Code quality. Uh, what am I Code quality. Uh, what am I going to going to going to talk about today? First, we'll talk about today? First, we'll talk about today? First, we'll define what we define what we define what we actually mean actually mean actually mean by code quality by code quality . Then we'll . Then we'll . Then we'll take a quick look at how this take a quick look at how this take a quick look at how this impacts impacts impacts business outcomes, business outcomes, business outcomes, where AI is coming in, the where AI is coming in, the where AI is coming in, the potential impact of AI potential impact of AI potential impact of AI on quality, and how to on quality, and how to on quality, and how to protect that quality. protect that quality. This report is quite This report is quite general. This means general. This means general. This means that it is not aimed that it is not aimed that it is not aimed at one specific at one specific at one specific solution in this area. solution in this area. So you can take So you can take the techniques described here the techniques described here the techniques described here and apply them to a and apply them to a and apply them to a variety of solutions variety of solutions . However, at the very . However, at the very . However, at the very end, if there is time, end, if there is time, end, if there is time, I will also show you an I will also show you an I will also show you an example of what it example of what it example of what it looks like with Kadan. looks like with Kadan. looks like with Kadan. Code quality, uh, again Code quality, uh, again , is a topic that is sometimes , is a topic that is sometimes , is a topic that is sometimes neglected, especially in neglected, especially in neglected, especially in game development where game development where game development where you may have other you may have other you may have other important tasks to attend to.

important tasks to attend to. However, in talking to However, in talking to many of you, many of you, many of you, for example at the for example at the Game Developers Conference Game Developers Conference this year and last this year and last this year and last year, I see an year, I see an year, I see an understanding that this is an understanding that this is an understanding that this is an important topic. However, I have important topic. However, I have important topic. However, I have also noticed that there does also noticed that there does also noticed that there does not seem to be a not seem to be a not seem to be a single set of single set of single set of industry best industry best industry best practices in this area, and practices in this area, and practices in this area, and in the gaming industry in particular in the gaming industry in particular in the gaming industry in particular . And maybe the . And maybe the . And maybe the gaming industry gaming industry gaming industry can learn a little can learn a little can learn a little from how it works in from how it works in from how it works in other industries. And I'll other industries. And I'll other industries. And I'll share some of share some of share some of those best those best those best practices here in my practices here in my practices here in my presentation. presentation. presentation. Code quality. So what do we Code quality. So what do we Code quality. So what do we really mean really mean really mean by this? Um, that's by this? Um, that's by this? Um, that's interesting, um, if you interesting, um, if you interesting, um, if you find that kind of thing find that kind of thing find that kind of thing interesting, but for interesting, but for interesting, but for such an important topic, such an important topic, such an important topic, it's actually very it's actually very it's actually very vaguely defined. vaguely defined. vaguely defined. So, if you So, if you So, if you ask 10 of your ask 10 of your ask 10 of your colleagues, um, what you colleagues, um, what you colleagues, um, what you mean by mean by mean by code quality, it's quite possible code quality, it's quite possible code quality, it's quite possible that you'll get that you'll get that you'll get a lot of different a lot of different a lot of different answers. However, answers. However, answers. However, for the sake of, um, what for the sake of, um, what for the sake of, um, what we're talking about today, we're talking about today, we're talking about today, I want you to I want you to I want you to focus on, um, focus on, um, focus on, um, a few different a few different a few different points. The first will be points. The first will be points. The first will be correctness. Pretty correctness. Pretty correctness. Pretty straightforward. So, does straightforward. So, does straightforward. So, does my code do what my code do what my code do what I I I designed it to do? Then designed it to do? Then designed it to do? Then performance, performance, performance, extremely important, extremely important, extremely important, obviously, for obviously, for obviously, for gaming. Hmm, is gaming. Hmm, is gaming. Hmm, is it fast enough?

it fast enough? it fast enough? Stability. Well, Stability. Well, Stability. Well, always an important topic. Is always an important topic. Is always an important topic. Is he not flying? he not flying? he not flying? Does it not crash? Does it not crash? Does it not crash? Um, and how Um, and how Um, and how stable it is for my stable it is for my stable it is for my players. Safety is players. Safety is players. Safety is obviously always, obviously always, obviously always, um, very important too. So um, very important too. So um, very important too. So you don't want to you don't want to you don't want to end up, uh, in, in, in an end up, uh, in, in, in an end up, uh, in, in, in an industrial, um, industrial, um, industrial, um, newspaper because newspaper because newspaper because you just got hacked. And you just got hacked. And you just got hacked. And accompaniment. So, does accompaniment. So, does accompaniment. So, does my code work my code work my code work today, or will it today, or will it today, or will it work work work in a few years? in a few years? Um, especially with Um, especially with some games, uh, that are some games, uh, that are some games, uh, that are now 10-12 now 10-12 now 10-12 years old. This is, um, um, something that is years old. This is, um, um, something that is years old. This is, um, um, something that is definitely worth definitely worth definitely worth paying attention to. And paying attention to. And paying attention to. And last but not least last but not least last but not least , , , reuse. And this is a reuse. And this is a reuse. And this is a topic that we can, topic that we can, topic that we can, that we, that I that we, that I that we, that I see more and more now see more and more now see more and more now when I talk, when I talk, when I talk, especially with larger especially with larger especially with larger studios, can I studios, can I studios, can I reuse reuse reuse code that I've already code that I've already code that I've already developed for developed for developed for other projects as well. And all of other projects as well. And all of other projects as well. And all of this gives you an understanding, an this gives you an understanding, an this gives you an understanding, an overview of what when I overview of what when I overview of what when I talk about talk about talk about code quality, and what many of code quality, and what many of code quality, and what many of my colleagues are talking about my colleagues are talking about my colleagues are talking about when they discuss when they discuss when they discuss code quality. What code quality. What code quality. What points do we actually points do we actually points do we actually want to cover with this?

want to cover with this? Now, if you Now, if you go into the Wild go into the Wild go into the Wild West that is, um, X or West that is, um, X or West that is, um, X or LinkedIn, for example, you LinkedIn, for example, you LinkedIn, for example, you can see that can see that can see that the importance of the importance of the importance of code quality is a pretty lively code quality is a pretty lively code quality is a pretty lively topic of debate. topic of debate. Some, from one Some, from one person, say, "I don't person, say, "I don't person, say, "I don't care what care what care what my code looks like, as long as my code looks like, as long as my code looks like, as long as it works." to the it works." to the it works." to the other extreme, where other extreme, where other extreme, where someone says, "No, my someone says, "No, my someone says, "No, my code has to be beautiful code has to be beautiful , um, and flawless , um, and flawless , um, and flawless before I before I before I release it." and then everything in release it." and then everything in release it." and then everything in between those between those between those extremes. There are extremes. There are extremes. There are many different opinions on many different opinions on many different opinions on this matter. Um, this matter. Um, this matter. Um, obviously we're obviously we're obviously we're biased, but we on biased, but we on biased, but we on our team our team our team believe that believe that believe that code quality, um, can have a code quality, um, can have a code quality, um, can have a real impact on real impact on real impact on business and how business and how business and how your game is perceived your game is perceived your game is perceived . To give you . To give you . To give you some numbers, and I'm some numbers, and I'm some numbers, and I'm sure you all sure you all sure you all know them already, there was know them already, there was know them already, there was one AAA studio that one AAA studio that one AAA studio that lost 33% of its lost 33% of its lost 33% of its value a value a value a week after a week after a week after a failed release. I'm failed release. I'm failed release. I'm pretty sure pretty sure pretty sure we all know which one we're we all know which one we're we all know which one we're talking about.

talking about. talking about. Additionally, Additionally, Additionally, GTA Online's loading times GTA Online's loading times GTA Online's loading times were reduced by 70% were reduced by 70% by fixing by fixing by fixing just two small just two small just two small bugs in the code. So, the bugs in the code. So, the bugs in the code. So, the loading time loading time loading time decreased from 6 minutes decreased from 6 minutes decreased from 6 minutes to 2 minutes. And, by the way, to 2 minutes. And, by the way, to 2 minutes. And, by the way, these code errors these code errors these code errors were not fixed by the were not fixed by the were not fixed by the studio itself, but by the player. And studio itself, but by the player. And studio itself, but by the player. And Dark Souls was offline Dark Souls was offline Dark Souls was offline for 2 months for 2 months for 2 months due to a due to a due to a remote remote remote code execution vulnerability, a code execution vulnerability, a code execution vulnerability, a security issue. security issue. And you can And you can imagine: firstly, if imagine: firstly, if imagine: firstly, if you lose players you lose players you lose players in those 2 months, they will most likely in those 2 months, they will most likely in those 2 months, they will most likely not not not come back. And, come back. And, come back. And, of course, the real of course, the real of course, the real impact on income. So impact on income. So impact on income. So all of this goes to show all of this goes to show all of this goes to show that in gaming, bad that in gaming, bad that in gaming, bad code doesn't code doesn't code doesn't just stay on your side, just stay on your side, just stay on your side, it's not just something that's it's not just something that's it's not just something that's annoying but doesn't annoying but doesn't annoying but doesn't hurt the business, it hurt the business, it hurt the business, it gets to the players, gets to the players, gets to the players, resulting in resulting in resulting in refunds, refunds, refunds, negative reviews, negative reviews, negative reviews, which is always a theme which is always a theme which is always a theme when I look at IGN, PC when I look at IGN, PC when I look at IGN, PC Gamer or any of Gamer or any of Gamer or any of those resources.

those resources. Quality, bugs, and Quality, bugs, and stability always stability always stability always affect the affect the affect the game's rating. And the assessment, in game's rating. And the assessment, in game's rating. And the assessment, in turn, turn, turn, will also influence this. You will also influence this. You will also influence this. You know this better than know this better than know this better than I do. How many I do. How many I do. How many players you can players you can players you can attract to your game attract to your game . This means that games with . This means that games with . This means that games with bugs ultimately bugs ultimately bugs ultimately lead to lead to lead to player dissatisfaction player dissatisfaction . I mean, there are . I mean, there are . I mean, there are examples of big examples of big examples of big studios that studios that studios that seem to get away with it seem to get away with it seem to get away with it . If we . If we . If we look look look at Bethesda, for example, but this is something at Bethesda, for example, but this is something at Bethesda, for example, but this is something you definitely shouldn't you definitely shouldn't you definitely shouldn't risk. risk. Moving on, why does bad code sometimes come out? Again bad code sometimes come out? Again , in many , in many , in many conversations I notice conversations I notice conversations I notice that the pressure involved in that the pressure involved in that the pressure involved in releasing a game to the market releasing a game to the market releasing a game to the market and implementing and implementing and implementing updates is updates is updates is enormous. So enormous. So enormous. So scheduling scheduling is a real problem is a real problem is a real problem for many studios.

for many studios. And this is reflected, for example, And this is reflected, for example, in in in the percentage of the percentage of the percentage of game developers who game developers who game developers who report report report having to work having to work having to work crunch time or crunch time or crunch time or overtime, which is overtime, which is overtime, which is more than half of you more than half of you . This means that . This means that . This means that many studios many studios many studios are trying are trying are trying to figure out how they to figure out how they to figure out how they can use can use can use artificial intelligence to artificial intelligence to artificial intelligence to solve this solve this solve this problem. And again problem. And again problem. And again , as already , as already , as already mentioned, artificial mentioned, artificial mentioned, artificial intelligence, especially in intelligence, especially in intelligence, especially in game development, is a very game development, is a very game development, is a very hot topic for hot topic for hot topic for discussion. Hmm, discussion. Hmm, discussion. Hmm, but, for example, 95% of but, for example, 95% of Unity developers already Unity developers already Unity developers already use AI in use AI in use AI in their work, and most their work, and most their work, and most of them of them of them use it use it use it to assist in the to assist in the to assist in the coding process coding process coding process . This shows that . This shows that . This shows that AI, if AI, if AI, if used used used correctly, can be a correctly, can be a correctly, can be a useful useful useful tool, tool, tool, as it as it as it allows, for example, allows, for example, allows, for example, to create prototypes to create prototypes to create prototypes much faster. So much faster. So , you can , you can , you can try out new try out new try out new game mechanics game mechanics game mechanics that would have previously taken that would have previously taken that would have previously taken months, but months, but months, but now you can now you can now you can try them in a matter of try them in a matter of try them in a matter of days. And if it doesn't days. And if it doesn't days. And if it doesn't work, you just work, you just work, you just throw it away and throw it away and throw it away and try something else.

try something else. try something else. You don't need to You don't need to You don't need to spend so much spend so much spend so much time on boilerplate code time on boilerplate code . You can let . You can let . You can let AI figure it out AI figure it out AI figure it out and solve it for you. and solve it for you. And this leads to And this leads to increased increased increased efficiency. So here, efficiency. So here, efficiency. So here, AI, if AI, if AI, if used used used correctly, from my correctly, from my correctly, from my perspective, does perspective, does perspective, does not necessarily aim to not necessarily aim to not necessarily aim to reduce reduce reduce developers in developers in developers in teams. This is something that you teams. This is something that you teams. This is something that you obviously shouldn't obviously shouldn't obviously shouldn't do, because you do, because you do, because you should just give should just give should just give developers or developers or developers or your team your team your team the ability to the ability to the ability to use AI to use AI to use AI to do something more do something more do something more interesting than interesting than interesting than routine work. routine work. However, speed and However, speed and the use of AI the use of AI the use of AI have a potential have a potential have a potential downside when it comes downside when it comes downside when it comes to code quality. So, to code quality. So, to code quality. So, AI can generate AI can generate AI can generate a lot of code very a lot of code very a lot of code very quickly. However, quickly. However, quickly. However, AI-generated code is not AI-generated code is not AI-generated code is not necessarily better or necessarily better or necessarily better or worse than worse than worse than human-written code, human-written code, human-written code, it simply increases it simply increases it simply increases the number of problems the number of problems the number of problems that get into your that get into your that get into your code. You can imagine: code. You can imagine: code. You can imagine: if you used to write if you used to write if you used to write a few hundred lines, a few hundred lines, a few hundred lines, now in the same now in the same now in the same time AI can write time AI can write time AI can write 10,000 lines. And if 10,000 lines. And if 10,000 lines. And if your average your average your average number of errors in your number of errors in your number of errors in your code remains the code remains the code remains the same, then it's quite same, then it's quite same, then it's quite clear where these clear where these clear where these problems come from. And problems come from. And problems come from. And this again leads this again leads this again leads to real problems, to real problems, to real problems, for example, in the form of

for example, in the form of for example, in the form of slow code. So is slow code. So is slow code. So is my game performing at the my game performing at the my game performing at the proper level of proper level of proper level of performance? Is performance? Is performance? Is it crashing or is it it crashing or is it it crashing or is it stable? And can stable? And can stable? And can it be hacked, or does it it be hacked, or does it it be hacked, or does it contain potential contain potential contain potential security issues? security issues? The good and The good and bad news bad news bad news is that is that is that AI code is not necessarily AI code is not necessarily AI code is not necessarily worse than human code; worse than human code; worse than human code; if you look at the if you look at the if you look at the research, it's research, it's research, it's more or less on more or less on more or less on par in terms of the total par in terms of the total par in terms of the total number of problems number of problems number of problems it creates. But it creates. But it creates. But it makes mistakes in a it makes mistakes in a it makes mistakes in a different way than different way than human-written code. For example, when example, when it comes to logical it comes to logical it comes to logical and correct errors, and correct errors, and correct errors, it creates 1.7 times it creates 1.7 times it creates 1.7 times more problems than more problems than more problems than code written by a code written by a code written by a human. Regarding human. Regarding human. Regarding the general issues of the general issues of code quality and maintainability, code quality and maintainability, returning to the topics returning to the topics returning to the topics we we we focused on, focused on, focused on, the situation is worse and the situation is worse and the situation is worse and most worrying: most worrying: most worrying: it can also it can also potentially create more potentially create more security problems security problems security problems than a human developer.

than a human developer. This is taken from This is taken from research by research by research by Code Rabbit. So, Code Rabbit, I'm Code Rabbit. So, Code Rabbit, I'm Code Rabbit. So, Code Rabbit, I'm sure many sure many sure many of you have already heard of them. of you have already heard of them. of you have already heard of them. Um, it's an AI-based Um, it's an AI-based Um, it's an AI-based code review tool code review tool . This means that we are not trying to that we are not trying to that we are not trying to paint AI in a paint AI in a paint AI in a bad light, this is bad light, this is bad light, this is data from the AI data from the AI data from the AI solution provider itself solution provider itself . However, the . However, the general question general question general question is not is not is not necessarily necessarily necessarily what problems what problems what problems are created and by whom? That is, are created and by whom? That is, are created and by whom? That is, by humans or artificial by humans or artificial by humans or artificial intelligence, and the main intelligence, and the main intelligence, and the main question we question we question we ask is: does ask is: does ask is: does my code my code my code generally meet the appropriate generally meet the appropriate generally meet the appropriate level and my level and my level and my quality standards? And this is where quality standards? And this is where static analysis can come to the rescue.

Taking the Taking the code quality points code quality points code quality points I presented at the I presented at the I presented at the very beginning, the good very beginning, the good very beginning, the good news is again news is again news is again that you can that you can that you can use use use static analysis to static analysis to static analysis to cover all six of these cover all six of these cover all six of these areas. As for areas. As for areas. As for correctness, here correctness, here correctness, here you have inspections, the you have inspections, the you have inspections, the usual standard usual standard usual standard checks. You checks. You checks. You can also check the can also check the code coverage thresholds with code coverage thresholds with tests. So tests. So tests. So code coverage is once again becoming code coverage is once again becoming code coverage is once again becoming increasingly important, not increasingly important, not increasingly important, not just in terms of just in terms of just in terms of coverage, but also in coverage, but also in coverage, but also in how it is how it is how it is used. used. Next, performance is an area that is an area that is an area that static static static analysis can cover. Stability is analysis can cover. Stability is analysis can cover. Stability is obvious, a couple of obvious, a couple of obvious, a couple of examples would examples would examples would be null- be null- safety checks, safety checks, safety checks, resource leaks, and resource leaks, and resource leaks, and exception handling. Security, exception handling. Security, exception handling. Security, meaning meaning meaning security inspections and SCA, security inspections and SCA, software component analysis, software component analysis, meaning checking for meaning checking for meaning checking for outdated outdated outdated dependencies, and dependencies, and taint analysis as part of taint analysis as part of static analysis static analysis static analysis to detect to detect to detect more complex more complex more complex vulnerabilities such vulnerabilities such vulnerabilities such as cross-site as cross-site as cross-site scripting, SQL injections, scripting, SQL injections, scripting, SQL injections, etc.

etc. etc. Maintainability: A Maintainability: A Maintainability: A very important topic here is very important topic here is very important topic here is complexity and complexity and code smells, and I would also code smells, and I would also code smells, and I would also add add add code duplication here. This is something that code duplication here. This is something that artificial intelligence is well known for: it artificial intelligence is well known for: it really “loves” really “loves” really “loves” to duplicate code, and what to duplicate code, and what to duplicate code, and what it definitely doesn’t like to it definitely doesn’t like to it definitely doesn’t like to do unless do unless do unless specifically specifically specifically asked to do is asked to do is asked to do is refactor. And if refactor. And if refactor. And if you don't have a way to you don't have a way to you don't have a way to control this, it will control this, it will control this, it will seriously hurt seriously hurt maintainability in maintainability in the future, the future, the future, because at some because at some because at some point no one will point no one will point no one will be able to understand your be able to understand your be able to understand your code anymore. The same goes for code anymore. The same goes for reusability: do reusability: do I have duplicate code I have duplicate code I have duplicate code that makes the system that makes the system that makes the system more complex? And also more complex? And also more complex? And also static analysis static analysis static analysis can check whether can check whether can check whether your code meets your code meets your code meets your own your own your own internal internal programming standards. Programming standards Programming standards are needed to have the are needed to have the are needed to have the same approaches same approaches same approaches regardless of the regardless of the regardless of the project you project you project you are working on, which makes it are working on, which makes it are working on, which makes it much easier to much easier to much easier to share code.

share code. By the way, By the way, let me briefly let me briefly let me briefly add why artificial add why artificial add why artificial intelligence creates intelligence creates intelligence creates such code and such such code and such such code and such problems. problems. The most common The most common reason is that he reason is that he reason is that he studied from studied from studied from outdated sources. outdated sources. As we all know, all As we all know, all sources have effectively been sources have effectively been sources have effectively been exhausted. Therefore, exhausted. Therefore, exhausted. Therefore, not not not much new is emerging. And that's much new is emerging. And that's much new is emerging. And that's one of the reasons why, one of the reasons why, one of the reasons why, for example, artificial for example, artificial for example, artificial intelligence really likes to intelligence really likes to intelligence really likes to insert outdated insert outdated insert outdated dependencies and dependencies and dependencies and things like that. things like that. Let's move on. Static analysis. Before I move on to Before I move on to why you should why you should why you should use use use static analysis static analysis static analysis with artificial with artificial with artificial intelligence, I want to intelligence, I want to intelligence, I want to quickly explain its quickly explain its quickly explain its benefits. Again benefits. Again benefits. Again , the downside is that , the downside is that , the downside is that it's not very it's not very it's not very attractive, because attractive, because attractive, because this kind of analysis has been this kind of analysis has been this kind of analysis has been around for ages, but it's been around for around for ages, but it's been around for around for ages, but it's been around for so long for so long for so long for very good reasons.

very good reasons. First, the results First, the results are deterministic. are deterministic. are deterministic. So, if you give a So, if you give a static analysis tool the same piece of code 10 times , it will give you the , it will give you the , it will give you the same set of same set of same set of results 10 times. results 10 times. results 10 times. By the way, if you By the way, if you By the way, if you run it 10 run it 10 run it 10 times, it won't times, it won't times, it won't cost you anything cost you anything cost you anything more or less, more or less, more or less, as static as static as static analysis doesn't consume analysis doesn't consume analysis doesn't consume any tokens. any tokens. any tokens. Whereas, and I'm sure Whereas, and I'm sure Whereas, and I'm sure at least I've had this at least I've had this at least I've had this experience, if you give an experience, if you give an experience, if you give an artificial intelligence the artificial intelligence the artificial intelligence the same code 10 same code 10 same code 10 times, you'll get 20 times, you'll get 20 times, you'll get 20 different answers. It's different answers. It's different answers. It's fast and cheap. fast and cheap. fast and cheap. Again, it doesn't Again, it doesn't Again, it doesn't consume tokens and consume tokens and consume tokens and usually works very usually works very usually works very fast. This means that fast. This means that fast. This means that when comparing an when comparing an AI-based inspection or scanning tool to static AI-based inspection or scanning tool to static analysis, the latter is analysis, the latter is analysis, the latter is usually much usually much usually much faster. Last but faster. Last but faster. Last but not least: it is not least: it is not least: it is auditable. auditable. Returning to Returning to determinism, you determinism, you determinism, you can associate can associate can associate each result that each result that each result that static static static analysis produces with a specific analysis produces with a specific analysis produces with a specific test. You can test. You can test. You can see why this see why this see why this result was result was result was obtained and why it is a obtained and why it is a obtained and why it is a problem. Also, problem. Also, problem. Also, incidentally, this incidentally, this incidentally, this will become increasingly will become increasingly will become increasingly important as important as important as we face more and we face more and we face more and more compliance issues more compliance issues . One of the . One of the main issues, main issues, main issues, especially for especially for especially for European European European suppliers or suppliers or suppliers or even global even global even global vendors, who make vendors, who make vendors, who make their code and games their code and games their code and games available in the EU.

available in the EU. There is a new EU There is a new EU Cyber ​​Resilience Act, Cyber ​​Resilience Act, Cyber ​​Resilience Act, which is already in force in some which is already in force in some which is already in force in some areas, but will fully areas, but will fully areas, but will fully enter into enter into enter into force in November, force in November, force in November, if I am not mistaken. if I am not mistaken. Part of this Part of this Cyber ​​Resilience Act is Cyber ​​Resilience Act is Cyber ​​Resilience Act is the requirement to prove that you the requirement to prove that you the requirement to prove that you can, for example, can, for example, can, for example, create an SBOM, which is a create an SBOM, which is a software software component specification. If you component specification. If you component specification. If you use AI, this use AI, this use AI, this will be difficult will be difficult will be difficult because it is not because it is not because it is not auditable. But auditable. But auditable. But if you if you if you use use use static analysis, you static analysis, you static analysis, you can show the can show the can show the one-to- one-to- one-to- one relationship between one relationship between one relationship between the result and the the result and the the result and the source code. However source code. However , when comparing , when comparing , when comparing static analysis and AI static analysis and AI analysis, both have analysis, both have analysis, both have their pros and cons. their pros and cons. So, static So, static analysis is very good analysis is very good analysis is very good when it comes when it comes when it comes to, say, typical to, say, typical to, say, typical problems. That is, there are problems. That is, there are problems. That is, there are problems that problems that problems that static analysis static analysis static analysis can reveal; it can reveal; it can reveal; it mostly just mostly just mostly just checks if A plus B checks if A plus B checks if A plus B equals B, and if it's equals B, and if it's equals B, and if it's not B, then something is wrong.

not B, then something is wrong. It is fast, as It is fast, as mentioned, and it is mentioned, and it is mentioned, and it is auditable. auditable. auditable. So, essentially, you So, essentially, you So, essentially, you can can can use use use static analysis for static analysis for static analysis for basic validation basic validation basic validation early in the early in the early in the development cycle. What it can't development cycle. What it can't development cycle. What it can't do is do is do is understand the intent of understand the intent of understand the intent of your code, as your code, as your code, as it's pretty it's pretty it's pretty primitive and, as I primitive and, as I primitive and, as I said, just looks for said, just looks for said, just looks for patterns. And this is where AI patterns. And this is where AI patterns. And this is where AI comes to the rescue comes to the rescue comes to the rescue . So if you . So if you . So if you want to, for example, want to, for example, want to, for example, check if check if check if the code does what you the code does what you the code does what you expect it to do, if expect it to do, if expect it to do, if you need something that you need something that you need something that can analyze can analyze can analyze files and your entire files and your entire files and your entire project, or if you project, or if you project, or if you need to check for need to check for need to check for logical errors, then you logical errors, then you logical errors, then you need AI. This need AI. This need AI. This means that ideally you means that ideally you means that ideally you should should should use a use a use a combination of both combination of both combination of both approaches: static approaches: static approaches: static analysis for the base and AI analysis for the base and AI analysis for the base and AI on top of it. So, on top of it. So, on top of it. So, the cycle might look like this the cycle might look like this the cycle might look like this . Again, . Again, . Again, very simplified.

very simplified. First, as always, First, as always, a person writes the code, and a person writes the code, and a person writes the code, and now, in addition to now, in addition to now, in addition to that, AI helps you that, AI helps you that, AI helps you , or it writes , or it writes , or it writes part of the code for you. part of the code for you. Then, the second step, once Then, the second step, once you run the you run the you run the pipeline, static pipeline, static pipeline, static analysis checks all the things analysis checks all the things analysis checks all the things we've already we've already we've already talked about. By the way, Codana talked about. By the way, Codana —and this is the first time I'm —and this is the first time I'm —and this is the first time I'm mentioning my product— mentioning my product— Codana will not only Codana will not only Codana will not only check for check for check for any any any issues, but will also issues, but will also issues, but will also automatically automatically automatically create quick create quick create quick fixes. Some of fixes. Some of fixes. Some of you who use you who use you who use our IDEs may our IDEs may our IDEs may already be used to such already be used to such already be used to such quick fixes. And quick fixes. And quick fixes. And with Codana, you can with Codana, you can with Codana, you can make this an make this an make this an automated automated automated part of your part of your part of your pipeline. It's important pipeline. It's important pipeline. It's important to note that these to note that these to note that these quick fixes are quick fixes are quick fixes are not AI-generated. This not AI-generated. This not AI-generated. This provides the advantages provides the advantages provides the advantages inherent in inherent in inherent in static analysis static analysis static analysis in general: it is fast, in general: it is fast, in general: it is fast, inexpensive, and inexpensive, and inexpensive, and reliable. So, reliable. So, reliable. So, first the static first the static first the static analysis, then the second analysis, then the second analysis, then the second part, the third—once the part, the third—once the part, the third—once the static analysis is static analysis is static analysis is done, you done, you done, you go to your go to your go to your chosen chosen chosen AI tool, which will check AI tool, which will check AI tool, which will check the rest and create the rest and create the rest and create fixes for more fixes for more fixes for more complex problems.

complex problems. For example, if you For example, if you have a logical error or have a logical error or have a logical error or need to need to need to refactor, this is where refactor, this is where refactor, this is where AI comes in handy and AI comes in handy and AI comes in handy and helps supplement helps supplement helps supplement your pipeline. Ideally, your pipeline. Ideally, your pipeline. Ideally, you get a cycle. you get a cycle. So, you write the code, So, you write the code, static analysis static analysis static analysis does its job, does its job, does its job, then the AI ​​does its job then the AI ​​does its job , and once it's done, , and once it's done, , and once it's done, the AI ​​sends the code back the AI ​​sends the code back the AI ​​sends the code back to static analysis to static analysis to static analysis to make sure the to make sure the to make sure the AI ​​you create AI ​​you create AI ​​you create meets meets your code's quality and security standards. And when static And when static analysis says, "Everything is analysis says, "Everything is analysis says, "Everything is fine, it looks fine, it looks fine, it looks great," you can great," you can great," you can merge the code into the merge the code into the merge the code into the main branch. This main branch. This main branch. This sounds complicated and, sounds complicated and, sounds complicated and, especially, very long. especially, very long. However, if you However, if you start start start using it and using it and using it and set it up correctly set it up correctly , it will only take , it will only take , it will only take a few minutes each time.

a few minutes each time. While it's a few minutes , on the other hand, it's time , on the other hand, it's time spent avoiding spent avoiding spent avoiding spending spending spending hours later hours later hours later trying trying trying to figure out what happened to figure out what happened to figure out what happened and how to fix and how to fix and how to fix problems that might have problems that might have problems that might have occurred if the code had made it occurred if the code had made it occurred if the code had made it to the master to the master to the master branch. There are already branch. There are already branch. There are already studies that studies that studies that demonstrate demonstrate demonstrate the benefits of this the benefits of this the benefits of this approach. One of them approach. One of them approach. One of them was for a very was for a very was for a very specific case specific case , so don't take , so don't take , so don't take these numbers as something these numbers as something these numbers as something infallible, but the gist is infallible, but the gist is infallible, but the gist is correct: combining correct: combining correct: combining static analysis with static analysis with static analysis with LLM reduces LLM reduces LLM reduces token usage token usage token usage or the number of or the number of or the number of requests to the AI ​​by 72-97%, requests to the AI ​​by 72-97%, requests to the AI ​​by 72-97%, while even while even while even improving the quality of improving the quality of improving the quality of the code used in the code used in the code used in the study. A second the study. A second the study. A second study showed study showed that using that using that using this combination this combination this combination reduces the number of reduces the number of reduces the number of vulnerabilities in vulnerabilities in vulnerabilities in AI-written code that AI-written code that AI-written code that makes it to the makes it to the makes it to the main branch by 33%.

main branch by 33%. Now I'll show you a Now I'll show you a quick example of what quick example of what quick example of what this might look like this might look like this might look like in Katana. Again, in Katana. Again, in Katana. Again, most of this most of this most of this can be done can be done can be done with any with any static analysis tool static analysis tool of your choice. Of course, of your choice. Of course, of your choice. Of course, we are a little biased. we are a little biased. we are a little biased. We believe you We believe you We believe you should choose Katana for should choose Katana for should choose Katana for several reasons, and several reasons, and several reasons, and especially because we especially because we especially because we support support support the most popular the most popular the most popular game engines out of game engines out of game engines out of the box. So, the box. So, the box. So, let me show you let me show you what it looks like what it looks like directly in Katana. directly in Katana. This is the Katana dashboard. This is the Katana dashboard. Typically, as a Typically, as a Typically, as a developer, you won't developer, you won't developer, you won't spend spend spend much time here. This is very much time here. This is very much time here. This is very convenient. However, convenient. However, convenient. However, let's say you're a team leader let's say you're a team leader , team manager, or , team manager, or , team manager, or someone similar, and you someone similar, and you someone similar, and you just need just need just need more space to more space to more space to review the project. This review the project. This review the project. This example project was example project was example project was created by one of created by one of created by one of my colleagues, just as a my colleagues, just as a my colleagues, just as a demonstration. It was a demonstration. It was a demonstration. It was a banking frontend banking frontend written in Java. The written in Java. The code generation process only took code generation process only took a few minutes to get a few minutes to get a few minutes to get everything working. We everything working. We everything working. We performed the first performed the first performed the first scan scan scan using Qodana, and using Qodana, and using Qodana, and we see that Qodana we see that Qodana we see that Qodana found 126 issues.

found 126 issues. Qodana also provides a Qodana also provides a convenient way to convenient way to convenient way to quickly quickly quickly filter out what's filter out what's filter out what's really important. Then really important. Then really important. Then we applied we applied we applied quick fixes; There are quick fixes; There are quick fixes; There are different ways different ways different ways to configure it, but we to configure it, but we to configure it, but we did it through GitHub did it through GitHub did it through GitHub Actions and added the rest of Actions and added the rest of Actions and added the rest of the issues to the database the issues to the database the issues to the database (baseline). And once (baseline). And once (baseline). And once they get to they get to they get to the base, they no longer the base, they no longer the base, they no longer slow down your slow down your slow down your work. Let's say the work. Let's say the work. Let's say the next time next time next time Qodana scans, Qodana scans, Qodana scans, it finds five new it finds five new it finds five new problems. Ideally, problems. Ideally, problems. Ideally, it will fix three of them it will fix three of them it will fix three of them automatically, and you automatically, and you automatically, and you will only see two will only see two will only see two new issues in the new issues in the new issues in the current current current tasks tab. So it's very tasks tab. So it's very tasks tab. So it's very easy to find and easy to find and easy to find and understand what's understand what's understand what's worth spending time on. worth spending time on. But let's get back to the But let's get back to the five five five remaining problems. You see remaining problems. You see that many of them that many of them that many of them are about are about are about duplicate code. You duplicate code. You duplicate code. You can view can view can view them at Qodana. However, them at Qodana. However, them at Qodana. However, of course, you won't be able to of course, you won't be able to of course, you won't be able to fix them fix them fix them directly from here directly from here . So if I open . So if I open . So if I open this in IntelliJ, you'll see this in IntelliJ, you'll see that it takes that it takes that it takes me to the exact position me to the exact position me to the exact position in IntelliJ; this works for in IntelliJ; this works for in IntelliJ; this works for all relevant IDEs.

all relevant IDEs. So, IntelliJ, Rider, PyCharm, So, IntelliJ, Rider, PyCharm, etc. Additionally, this etc. Additionally, this etc. Additionally, this will work with Visual Studio will work with Visual Studio , Visual Studio Code, and Cursive. , Visual Studio Code, and Cursive. Even if your IDE doesn't Even if your IDE doesn't have a ready-made plugin, have a ready-made plugin, have a ready-made plugin, you can you can you can use our use our use our CLI tool. But CLI tool. But CLI tool. But here you can again here you can again here you can again view all the view all the view all the problems found. problems found. problems found. For example, it could For example, it could For example, it could be duplicate code. be duplicate code. be duplicate code. You hover over it You hover over it You hover over it . And again . And again , depending on , depending on , depending on what solution you're what solution you're what solution you're using, using, using, you can just go you can just go you can just go to additional actions, AI to additional actions, AI actions, and let the actions, and let the actions, and let the artificial intelligence artificial intelligence artificial intelligence fix these fix these fix these problems for you. So, problems for you. So, problems for you. So, here you can do here you can do here you can do it manually, just it manually, just using the chat using the chat or agent. However, this or agent. However, this or agent. However, this can also be done can also be done can also be done semi-automatically, semi-automatically, semi-automatically, so that it runs in the so that it runs in the so that it runs in the background, and background, and background, and you only have to you only have to you only have to wait for clean wait for clean wait for clean code to come out. And that's code to come out. And that's code to come out. And that's actually what I wanted to actually what I wanted to show you today. And if you are show you today. And if you are interested, I would be interested, I would be interested, I would be happy to talk happy to talk happy to talk to you personally. And we to you personally. And we to you personally. And we can discuss the can discuss the can discuss the details. Or, if you details. Or, if you details. Or, if you want to give it a try, want to give it a try, want to give it a try, free trials are available free trials are available free trials are available . I look forward to . I look forward to our conversation. In any case, I'll

any case, I'll any case, I'll shut up. As I shut up. As I shut up. As I said, with my said, with my said, with my commercial experience, it's commercial experience, it's commercial experience, it's very difficult for me very difficult for me very difficult for me to stop, but here it is to stop, but here it is to stop, but here it is . . . I like it. I like it. I like it. I think every speaker I think every speaker I think every speaker should end their should end their should end their speech with the phrase: "Well, speech with the phrase: "Well, speech with the phrase: "Well, I'll stop here." I'll stop here." I'll stop here." That's all. This is how I That's all. This is how I That's all. This is how I will end will end will end every speech from now every speech from now every speech from now on. This is great. on. This is great. on. This is great. So, thank you very much, Kai. So, thank you very much, Kai. So, thank you very much, Kai. It was very interesting. It was very interesting. I like your I like your approach of using approach of using approach of using deterministic deterministic deterministic static analysis static analysis static analysis as a base and then as a base and then as a base and then using AI using AI analysis to analysis to analysis to get a deeper get a deeper get a deeper and more comprehensive and more comprehensive and more comprehensive view that you view that you view that you apply. apply. Yes. And that's exactly what Yes. And that's exactly what we see. When I we see. When I we see. When I talk to even talk to even talk to even very large very large very large companies that companies that companies that are using a are using a are using a fully authentic fully authentic fully authentic cloud platform to cloud platform to cloud platform to write code, they write code, they write code, they create a prompt, the create a prompt, the create a prompt, the agents do agents do agents do their job, but their job, but their job, but at the end of the day they still at the end of the day they still at the end of the day they still need to... need to need to... need to need to... need to find a better find a better find a better word. Agents word. Agents word. Agents engage in static engage in static engage in static analysis to analysis to analysis to verify whether verify whether verify whether this code complies with this code complies with this code complies with standards or not. standards or not. standards or not. So, So, So, yeah. That's good. I yeah. That's good. I yeah. That's good. I like this like this like this combination, personally combination, personally combination, personally using it, I using it, I using it, I appreciate the mix of appreciate the mix of appreciate the mix of static static static deterministic deterministic deterministic analysis and analysis and analysis and dynamic dynamic dynamic capabilities that capabilities that capabilities that agents provide.

agents provide. agents provide. You know, it's a great You know, it's a great You know, it's a great way to work. Um, way to work. Um, way to work. Um, we have a quick we have a quick we have a quick question in the chat. Hmm, question in the chat. Hmm, question in the chat. Hmm, it's actually it's actually it's actually interesting. When you interesting. When you interesting. When you ask AI to add ask AI to add ask AI to add tests, over time the tests, over time the tests, over time the test suites in all test suites in all test suites in all repositories repositories repositories start to start to start to overflow, and overflow, and overflow, and even simple even simple even simple processes like linting processes like linting processes like linting can slow down. can slow down. can slow down. So, do you have So, do you have So, do you have any experience with this? any experience with this? Yes, there is. This is from...I've Yes, there is. This is from...I've talked not talked not talked not so much to the gaming so much to the gaming so much to the gaming industry, I industry, I industry, I don't have an example there, don't have an example there, don't have an example there, but to other areas where but to other areas where but to other areas where they just started with they just started with they just started with one tool and one tool and one tool and then added another then added another then added another , and another, and , and another, and , and another, and another. So at a another. So at a another. So at a certain point you certain point you certain point you just have to just have to just have to overcome 10 different overcome 10 different overcome 10 different obstacles before you obstacles before you obstacles before you can release can release can release your code. Um, your code. Um, your code. Um, mostly, though, mostly, though, mostly, though, it's just because it's just because it's just because someone started by someone started by someone started by adding one adding one adding one tool and then no tool and then no tool and then no one ever one ever one ever reviewed what reviewed what reviewed what was actually in the was actually in the was actually in the pipeline and what made pipeline and what made pipeline and what made sense and what didn't. But sense and what didn't. But sense and what didn't. But static analysis shouldn't static analysis shouldn't slow you down. So, for slow you down. So, for example, Qodana has a so example, Qodana has a so example, Qodana has a so -called -called -called pull request mode, pull request mode, pull request mode, which checks only which checks only which checks only changed files, and this changed files, and this changed files, and this should, depending on should, depending on should, depending on the project, take the project, take the project, take literally a minute literally a minute literally a minute or two. Mhm. If or two. Mhm. If or two. Mhm. If at all it takes that much time at all it takes that much time at all it takes that much time to to to check the code. And check the code. And check the code. And there's also a difference between there's also a difference between there's also a difference between running linting in running linting in running linting in continuous continuous continuous integration with something integration with something integration with something like Qodana and like Qodana and like Qodana and running it while running it while running it while typing in an editor, where typing in an editor, where typing in an editor, where you're actually you're actually you're actually only checking the only checking the only checking the current file. So, current file. So, current file. So, that's good. Um, we that's good. Um, we that's good. Um, we just had

just had just had another question, and it's another question, and it's another question, and it's about about about how well the JetBrains built-in how well the JetBrains built-in how well the JetBrains built-in agent or the agent or the agent or the agents that we have in the agents that we have in the agents that we have in the IDE can read the IDE can read the IDE's static analysis tools ? And I'll ? And I'll ? And I'll answer this answer this answer this question right away: Rider has question right away: Rider has question right away: Rider has a feature called a feature called a feature called hooks, and it's very hooks, and it's very hooks, and it's very convenient. So every time convenient. So every time convenient. So every time the agent generates the agent generates the agent generates code, it will call code, it will call code, it will call hooks in Rider. One of them hooks in Rider. One of them hooks in Rider. One of them can format the code, can format the code, can format the code, and the other can check for and the other can check for and the other can check for current issues in the current issues in the current issues in the file, file, file, lint, check for lint, check for lint, check for these issues, and these issues, and these issues, and report them to the report them to the report them to the agent. And the agent can agent. And the agent can agent. And the agent can then regenerate then regenerate then regenerate the code so that it the code so that it the code so that it uses your uses your uses your specific specific specific coding standards or coding standards or coding standards or fixes those fixes those fixes those inspections that you would have had to inspections that you would have had to ask to fix anyway ask to fix anyway after generating the code. after generating the code. after generating the code. I'm going to Then I'm going to Then I'm going to Then I also want to I also want to I also want to add that it's add that it's add that it's deterministic. That is, the deterministic. That is, the deterministic. That is, the agent is forced agent is forced agent is forced to use these to use these to use these hooks, and not just hooks, and not just hooks, and not just receive receive receive a recommendation to do a recommendation to do a recommendation to do so. So, you can so. So, you can so. So, you can be sure that the hook be sure that the hook be sure that the hook is enabled and is enabled and is enabled and executed every time the executed every time the executed every time the agent writes something.

agent writes something. Yes, sometimes it's Yes, sometimes it's difficult to convince an difficult to convince an difficult to convince an agent to do something. agent to do something. agent to do something. That's right. That's right. We had a case We had a case where an agent where an agent where an agent was asked to get rid of was asked to get rid of was asked to get rid of certain results, and certain results, and certain results, and instead of instead of instead of fixing them, he simply fixing them, he simply fixing them, he simply turned off the checks. turned off the checks. I mean, it I mean, it works. This solved works. This solved works. This solved the problem. In a certain the problem. In a certain the problem. In a certain way. Okay, friends, way. Okay, friends, way. Okay, friends, thank you very much for a thank you very much for a thank you very much for a great session, and we great session, and we great session, and we 'll say goodbye to 'll say goodbye to 'll say goodbye to you.