Security has been a constant concern for many IT professionals over the years. Many of us are trying to implement better security controls, and yet at the same time, we try to avoid anything that slows us down. Security clearly hasn’t been a big enough concern, as we’ve had more than our share of SQL Injection issues. These often come about from poor practices, lack of education, and too many people not learning to adopt better habits across time.
We’ve also had no shortage of lost backups, open cloud buckets, and more over the years. While security (or cybersecurity) is listed as a concern for tech management, they are quick to avoid slowing down any development or deployment of software. While it is easier to get time for patching these days, it’s still not easy. There are plenty of organizations that prioritize resources spent on tasks other than patching, upgrading systems, or training developers.
One of the ideas in modern software development is to often build an MVP, a minimally viable product, where we can test ideas and determine if our solution is worth pursuing. This could be a greenfield application, or even a feature enhancement to an existing system. In the age of GenAI, vibe-coding, and more, this might be MCP or agent-based AI additions to software that are being developed and enhanced rapidly, incorporating feedback from customers.
If we allow minimal amounts of features to test things, shouldn’t we have minimal levels of security as well? That’s the thrust of a blog post from Forrester that discusses how we might look forward in 2026 to protecting our digital systems. There ought to be a minimum set of controls, testing, and more that ensures we can build software that doesn’t cost more from security issues than it generates in revenue. This might be especially important in the age of GenAI-coding where we can have less experienced engineers or even helpful agents committing lots of code they expect to deploy to production.
Education is important here to ensure everyone is aware of your MVS (minimal viable security) before they get too far along. It might be especially important in helping others guide their GenAI tools to ensure security is being considered early on. Adding in security requirements as a standard for your tools, such as in a Claude.MD file is a best practice that should be required for all future software development. You never know who might start to add AI coding tools or agents to your codebase, so be prepared now.
Education isn’t enough. It’s too easy for someone to forget what they learned. It’s also easy to assume many people have learned something when they haven’t. To me, part of an MVS is ensuring you have a framework or platform that can test all code and ensure that your systems are being securely built and deployed. This includes third-party software, especially SaaS products, where vendors might be tempted to sell you their own MVP without any MVS.
I was looking back at my year and decided to see if SQL Prompt could help me with some analysis. I was pleasantly surprised by how this went. This post looks at my experience using this to help me write a few queries.
This year was a big one for me and New York City. By my count, I went there five times. I wanted to see if that was right.
I started by loading up a bunch of travel data I keep into a database. I do this to keep an eye on where/when I’m going places, so that I have a few of how busy I’ll be. In this case, I loaded data into a table. Here’s a short sample of data.
I started by asking Prompt AI to write me a query. Here’s the prompt:
Simple enough. I could have written what it gave me, so I asked for more. Since I’m not tracking trips, but where I am on days, I needed something better. My prompt is what I might express to someone else, non-continuous trips.
I got a 4 back from more complex code, which is looking for entries with the city being NYC or a variant. It then adds a LAG(), which is what I was thinking before I decided to let Prompt do this. Notice above I was already asking for dates.
I got my dates, but still 4 trips. I know I flew to the NYC area more times. In looking at the dates, I realized that one of the trips, Mar 31-Apr 2, was only to Jersey City. So I had asked for that above.
You can see more more complex code, which adds in New Jersey. The results were interesting. This has 6 trips, because on one another trip, I went to New Jersey for a day. I had forgotten that one.
Checking Countries
I wanted to do some country analysis. I knew there was a bunch of country data from 2025 in there, so I wrote a simple query. That gets me some data, but it’s a bit of a mess. I really want to know when I visited countries.
I used PromptAI with a simple request.
I got some results back, which were good, but included the USA. I then asked to remove this and you see the result.
This was a good query, overall, so I clicked the “Optimize SQL” button. I got these items added as comments.
There isn’t a lot to do here, but I created the index. The “optimize” had also added a FORCESEEK, which I didn’t realize at first, so I removed it.
Eventually I added back the USA, partially as this improves performance, but also, with the results, I got a good look at travel patterns. In this case, I can see when I’m in the USA and when I’m not. I liked that I had asked for the trip duration, but the GenAI also added days traveling on the trips, which was fascinating.
The final query is here:
;WITH TravelCTE
AS (SELECT Country,
TravelDate,
DaySpentTraveling,
ROW_NUMBER() OVER (PARTITION BY Country ORDER BY TravelDate) AS RowNum
FROM dbo.Travel WITH (INDEX = IX_Travel_YearCountry) -- Use existing index to improve performance
WHERE TravelDate >= '20250101' -- Using efficient date literal format
)
SELECT t.Country,
t.TripStartDate,
t.TripEndDate,
t.TripDuration,
t.TotalDaysSpentTraveling
FROM
(
SELECT Country,
MIN(TravelDate) AS TripStartDate,
MAX(TravelDate) AS TripEndDate,
DATEDIFF(DAY, MIN(TravelDate), MAX(TravelDate)) + 1 AS TripDuration,
SUM(DaySpentTraveling) AS TotalDaysSpentTraveling,
DATEADD(DAY, -RowNum, TravelDate) AS GroupingKey
FROM TravelCTE
GROUP BY Country,
DATEADD(DAY, -RowNum, TravelDate)
) AS t
ORDER BY t.TripStartDate;
Summary
This was an interesting experiment in having an AI help me do some data analysis. I could have written these queries, but it would definitely have taken me as long as it took to ask the AI and write this post to do so. I’d be messing with data, double checking myself, and trying to decide what I wanted.
I also found it interesting to have the AI write the code and I could think more about the data being returned. I found a few data anomalies that I corrected along the way.
Prompt AI is proving useful, though when I was going back and forth a lot, I got this message.
In his book, The Coming Wave, the CEO of Microsoft AI laid out the risks of AI tech bluntly. “These tools will only temporarily augment human intelligence. They will make us smarter and more efficient for a time, and will unlock enormous amounts of economic growth, but they are fundamentally labor-replacing,” he wrote. Suleyman advocated for regulatory oversight and other government interventions, such as new taxes on autonomous systems and a universal basic income to prevent a socioeconomic collapse. This book was published before Suleyman joined Microsoft.
Satya Nadella is more optimistic than his new deputy. In an interview at Microsoft headquarters, while sitting next to his human chief of staff, Nadella said that his Copilot assistants wouldn’t replace his human assistant. As his chief of staff sat typing notes of the conversation on her tablet, Nadella acknowledged that AI will cause “hard displacement and changes in labor pools,” including for Microsoft. Judson Althoff, Chief Commercial Officer, said that Nadella was pressuring his team to find ways to use AI to increase revenue without adding headcount.
In 2025, Microsoft has reduced quite a bit of its workforce. Over 9,000 earlier this year, though perhaps there will be some hiring in the future, according to Nadella. Nadella contends that AI could end up delivering more societal benefits than the Industrial Revolution did. “When you create abundance,” Nadella said, “then the question is what one does with that abundance to create more surplus.”
As I discuss AI with different people, I get wildly different opinions. The pace of GenAI model growth across the last two years has led quite a few people to believe that the technology will approach mimicking the average human’s intelligence in just a few years. That’s a scary thought, and it certainly could lead a lot of executives to place a bet on fewer human employees and more digital ones.
However, many more people believe that the GenAI models still need a lot of guidance, and they are best suited for partnerships with humans. That’s good, in a sense. If a smart or talented human can use an AI partner and get a lot done, that means we still need some humans.
Some.
That use of AI by a few talented people might also lead us to a reduction in labor for a lot of organizations. Maybe fewer humans get more done with AI, and it’s possible organizations want to make that trade. It’s easy to think we’ll find things for more humans to do, but computers are incredible levers, and this worries me.
A little.
What I also think is that there is so much work we’d like to get done, but we can’t, at least in the technology space. We don’t have enough people to do the work, so GenAI agents or partners working with humans might let us catch up on the backlogs we have.
Of course, I don’t know that all that backlogged software we went is something we need, if it’s good for the world, and if it will end up putting even more people in the real world out of work.
Lots of challenges ahead. Let me know what you think.
A customer was asking about tracking logins and logouts in Redgate Monitor. We don’t do this natively, as this really needs an XEvent session. I decided to see if an AI could help me get a solution setup that might let me build a custom metric to track this.
I could do this myself, but it’s some looking syntax and capabilities, futzing with different code items, and trying to think about options. The goal here is can an AI help and save time. Not do the work for me, but assist.
So maybe not Vibe coding per se, but felt like I did little.
Note: This isn’t something I necessarily worry about. The rate might tell me if I’m under attack, but I’d hope applications would detect this first (and be able to block things)
The Problem
The customer just asked if they could track logins and logouts. I mentioned the Server Properties (shown below), to see what they’d done. They hadn’t used this, but also, it’s not very flexible or reportable as it puts info in the error log.
Tracking this info really requires an XE (Extended Events) session. That’s a lightweight way to capture this information. If I want to capture some info about the client logging in, or failing to log in, that’s the way.
A separate request was could we also get logouts. The only way to do this is with an XE session and the sqlserver.logout event.
With that in mind, let’s see how my assistant can help.
Using Claude
I opened Claude and asked this: “in sql server can I track login counts and logout counts from t-sql?” and actually spelled everything correctly. No savings here.
The base answer I got started like this, giving me a few options.
The ending asked me if I’d like to get the Extended Event option. It had provided only the login trigger option. I need an assistant, so I said yes.
That first answer was maybe 20-30 sec, but I started reading things, so this felt like a discussion with another DBA. Once this started, I let it go and it started to write out and work on code on the right, and then fill in the results on the left. This was a few minutes, so I flipped over to answer a few emails while I saw this on another monitor.
The results started with a table to store data and then an XE session. The whole page looks like this, which is a lot.
Here’s the full left side. Notice that it asks me for a next step. I’ve met a lot of junior DBAs, or even Senior-DBAs-with-1-year-of-experience-10-times that didn’t do this.
The actual code doesn’t matter yet, since I realized this isn’t getting failed logins. I asked another question and got a response. A polite Claude complements me and then rewrites code. This took another few minutes, and it was neat to see it rewriting its code on the right, adding in a new field in the table and adjusting the session.
I watched a bit, but got distracted with a Slack message. One nice thing is I can move on to another task while my assistant keeps working.
At the bottom, I liked the summary of how it works.
My Slack message was from an AE, asking a question about the server property stuff (from the customer). I could have typed a bunch, but when I looked back, Claude was finished, so I asked it.
I copy/pasted this to the AE, as it’s a good summary for the customer. This assistant is making my job easier.
Testing the Solution
I didn’t just send this. Instead I decided to test this on a few local systems. I keep a DBA database on each instance, so I ran the code in there to create the table and session. As a precaution, since this isn’t my code, I ran each item separately.
The table worked here. I had another window for the session, which I looked over, but didn’t extensively check. I’m not an XE expert, and I’d likely fumble this code worse than an AI at first, so I checked the events and actions. I decided to just run this since it looked good.
When it came to the procedure, I got an error. I copied and pasted this into Claude. It recognized an issue and fixed it. This took a few minutes, but this is faster than I could have corrected my own amateurly written query against XE.
Now I had a procedure. One thing I edited in both the session and proc is that I removed the hard coded c:\SQLData path. I wanted this captured with my other instance stuff in the \logs folder, so I left just the name of the XE session.
Adding Archival
One of the things that Redgate Monitor does really well is manage older data. I’ve seen so many people, including myself, set up something like this and then a year later realize they’ve captured GB of data.
I asked Claude to just fix this for me.
I grabbed the second command for my Agent Job and changed 180 to 90.
SQL Agent Job
Claude again asked me above about jobs, but jobs are simple and easy, and I wanted to think about it for a minute. I right clicked and created a new job. I thought about the name and description I wanted. Then I made two steps, pasting in two exec proc commands for the procs my assistant had written.
The last thing was some testing. I ran my job to be sure it was working. It completed, which was good.
I made a few logins and logouts, including a few failed logins. Then I queried my table. I didn’t remember the name, but my assistant tends to pick plain/boring names. So I used SQL Prompt to find it with a ssf <tab> l and got this:
When I got a query and checked, I see logs of my logins and logouts.
Redgate Monitor Custom Metric
My AE and customer wanted to see this in Redgate Monitor, so I decided to ask Claude. It was happy to help.
I could repeat that for the other items (failed logins and logouts). I didn’t, but this gets me ready to add this to Redgate Monitor.
Summary
This shows how an AI assistant can help me set up some auditing for security purposes. There is nothing complex here, and I’ve set up a bunch of this myself in the past. I even have a blog on this.
However, the code is cumbersome and slow to write for me. Or most humans unless you end up working with XE every day. Even if you use SSMS and the GUI to generate the script, it can be slow. I know I’d certainly have to look things up. In less than 15 minutes, I had a fairly well working solution, with archiving (deleting) old data and I didn’t need to focus tightly the entire time or type a lot. I did some other work, and I could focus on just testing.
Claude was a great AI assistant to this problem, which is similar to a lot of DBA-type work I’ve done in the past.
I tried Google Gemini and ChatGPT. A quick summary of those, which didn’t work as well. At least not to me.
Note that I use the free versions for all of these tools right now.
Gemini
The first prompt got me just a table and trigger, with a followup if I wanted more. I asked about XE and got a basic session, not as easy to read as Claude and embedded inside the response. It also had fewer actions.
I got to the same place, but it was more prompts and I had to keep guiding it along, like micro, or at least mini, managing another DBA. On the plus side, this was faster.
ChatGPT
ChatGPT suggested a trigger, but noted this wasn’t great. It did suggest extended events, and a complete solution. I could have just entered “yes”, but I didn’t. I’m still working on muscle memory at times.
I got each part of the solution separate, but this has me scrolling through explanation and code. Again, I prefer the Claude side-by-side approach, but this works. And it’s fast.
This also kept leading me along the process, which I liked. It certainly likes the checkboxes and Xs in its results.
Both tools helped me with custom metrics.
Video Walkthrough
Here is a a retry, and then showing the first solution. I think Claude learned a bit the second time.
