A three-person team describes fending off an active cyber attack on one of their products and argues that a cloud-hosted "software factory" of coding agents, log access, and automated validation is now basic equipment for responding to fast, automated adversaries. They say the groundwork they laid beforehand, including six weeks of pausing feature work to get unreviewed PRs reliably shipping, is what let them respond in time.

• A pre-provisioned cloud coding server with read-only access to logs and observability tools gives a team fast situational awareness and lets agents validate fixes against real observed attack patterns.
• They paused all new product development for about six weeks to build validation systems that let them ship PRs without human code review, which they say paid off in velocity and in this incident.
• Defensive access to Anthropic and OpenAI cyber programs took about a day to get through KYC, and they advise applying before you need it.