f5d78e1004
- New guide section: guide/ecosystem/mcp-vs-cli.md (4 decision dimensions, 15-row guidance table, token cost analysis, practitioner quotes) - New landing page: cc.bruniaux.com/ecosystem/mcp-vs-cli/ (4 decision cards, collapsible guidance table, zero JS, WCAG-compliant badges) - ICM v0.5.0 setup guide corrections + icm-session-starter.md template - 3 resource evaluations: mcp2cli, MCPorter, CircleCI MCP vs CLI blog - WP10 v1.2.0 DAF/finance feedback corrections (FR+EN) - Recap cards EN translations (57 cards) + FR version bump 3.32.1 → 3.36.0 - Whitepapers v2.2: 7 WPs synced with guide v3.27.6 → v3.36.0 delta - check-landing-sync.sh: section 7 for MCP vs CLI sync tracking - docs/for-cto.md: whitepapers links updated to florian.bruniaux.com/guides Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
108 lines
4.8 KiB
Markdown
108 lines
4.8 KiB
Markdown
# Claude Code — For CTOs & Decision Makers
|
||
|
||
> Your engineering team is probably already using AI coding tools. The question isn't whether to adopt Claude Code — it's whether to do it in a controlled, secure, measurable way or let it happen organically (which means inconsistently).
|
||
|
||
---
|
||
|
||
## The business case in 3 data points
|
||
|
||
- **62-85%** of developers already use AI coding tools daily (Stack Overflow 2025)
|
||
- **91%** of organizations have adopted at least one AI tool in their engineering workflow
|
||
- Teams with structured Claude Code adoption report **30-50% reduction** in routine coding tasks (config, boilerplate, test generation, code review)
|
||
|
||
The gap isn't adoption — it's structured adoption. Most teams are using 10% of what Claude Code can do.
|
||
|
||
---
|
||
|
||
## What decision makers need to know
|
||
|
||
### Security & Compliance
|
||
|
||
Claude Code runs locally. It does **not** send your codebase to Anthropic — only the specific context you include in a prompt. What matters for compliance:
|
||
|
||
- Data retention: configurable (0 to 30 days), or disabled
|
||
- GDPR: clear opt-out path, no training on your data by default
|
||
- Access control: granular permissions per project, per user, per tool
|
||
- Audit trail: every action logged via hooks
|
||
|
||
Full breakdown: WP06 — Privacy & GDPR Compliance (20 min) — [florian.bruniaux.com/guides](https://www.florian.bruniaux.com/guides)
|
||
|
||
### Threat landscape
|
||
|
||
This is the only public resource tracking AI coding tool vulnerabilities: **15 vulnerabilities and 655 malicious skills catalogued**. Key vectors relevant to enterprise:
|
||
|
||
- Prompt injection via untrusted file content (e.g. malicious comments in dependencies)
|
||
- Supply chain attacks via MCP servers (treat like npm packages)
|
||
- Overpermissive configs in CI/CD pipelines
|
||
|
||
Mitigation framework: WP03 — Security in Production (25 min) — [florian.bruniaux.com/guides](https://www.florian.bruniaux.com/guides)
|
||
|
||
### Team adoption
|
||
|
||
The ROI scales with structure. An individual developer gets 2-3× productivity on routine tasks. A team with shared configuration, hooks, and standardized workflows gets more, with consistent quality and security posture.
|
||
|
||
Realistic adoption timeline: 4-6 weeks to full team competency with structured onboarding.
|
||
|
||
WP05 — Deploying with a Team (25 min) — [florian.bruniaux.com/guides](https://www.florian.bruniaux.com/guides)
|
||
|
||
---
|
||
|
||
## Recommended reading path (60 min total)
|
||
|
||
> Whitepapers are available at [florian.bruniaux.com/guides](https://www.florian.bruniaux.com/guides)
|
||
|
||
| Document | Time | What you'll get |
|
||
|----------|------|----------------|
|
||
| WP06 — Privacy & GDPR | 20 min | Data flows, retention policy, compliance checklist |
|
||
| WP03 — Security | 25 min | Threat model, CVE database, mitigation framework |
|
||
| WP05 — Team Deployment | 25 min | Adoption phases, ROI, governance |
|
||
|
||
---
|
||
|
||
## The adoption path that works
|
||
|
||
Most teams that succeed follow the same sequence:
|
||
|
||
**1. Pilot (2-3 devs, 2 weeks)**
|
||
Identify 2-3 motivated engineers. Let them configure and experiment. Measure time saved on specific tasks (code review, test generation, documentation).
|
||
|
||
**2. Config standardization (1 week)**
|
||
Tech lead or external expert reviews their setup. Creates a shared `CLAUDE.md` for the team. Adds security hooks and CI/CD integration. Documents "what's allowed, what's not."
|
||
|
||
**3. Team rollout (2-3 weeks)**
|
||
1h onboarding session for the full team. Champions support peers. Shared config versioned in the repo.
|
||
|
||
**4. Governance**
|
||
Monthly review of usage patterns, cost, and security posture. Adjust permissions as AI capabilities evolve.
|
||
|
||
---
|
||
|
||
## Costs
|
||
|
||
Claude Code subscription: $100/month per developer (Claude Max plan, includes full API access).
|
||
|
||
At a loaded developer cost of €500-700/day, recovering 30 minutes per day per developer pays back the subscription in week 1.
|
||
|
||
The real cost isn't the subscription — it's unstructured adoption creating security debt and inconsistent output quality.
|
||
|
||
---
|
||
|
||
## External support
|
||
|
||
If you want to accelerate adoption or get an independent assessment of your current setup:
|
||
|
||
**Brown Bag Lunch, talk, or panel (1-3h, free)** — executive + team intro, live demo, Q&A, or speaker slot. I do these for the pleasure of it — getting challenged, sharing what I know, building network. No strings attached.
|
||
|
||
**Config audit (half-day)** — review your current setup against security and productivity standards.
|
||
**Team formation (1-3 days)** — hands-on training, your codebase, your workflows, measurable outcomes. Not something I'm actively seeking right now, but I'm open to the right conversation.
|
||
|
||
→ [Contact Florian Bruniaux](https://florian.bruniaux.com/) for availability and, depending on the mission, pricing
|
||
|
||
---
|
||
|
||
## Quick links
|
||
|
||
- Whitepapers — 10 focused deep-dives: [florian.bruniaux.com/guides](https://www.florian.bruniaux.com/guides)
|
||
- [Security Hardening Guide](../guide/security/security-hardening.md)
|
||
|
||
← [Back to main README](../README.md)
|