The Fourth Wave describes the current shift in software engineering driven by generative AI and agentic workflows. It reflects a move from isolated automation toward AI that influences the full software lifecycle, including planning, building, testing, securing, deploying, running, and supporting applications.
Expanded Definition
The Fourth Wave of Software Development is a useful label for the stage where generative AI and agentic workflows move beyond narrow code assistance and begin influencing more of the software lifecycle. The term is broader than a single tool category: it covers planning, implementation, testing, security review, deployment, operations, and support when software-producing systems take on more initiative than traditional automation.
The boundary that matters is control. Conventional automation follows predefined steps, while Fourth Wave approaches can infer intent, generate artefacts, call tools, and adapt their output as context changes. That makes the term especially relevant in environments where software delivery is no longer driven only by human developers but by mixed human and AI workflows. Guidance is still emerging, and industry language is not fully settled, so the term is best treated as a descriptive category rather than a formal standard.
For practitioners, the common misunderstanding is to treat this as “just better coding copilots.” In practice, the impact is wider because the same AI workflow can touch requirements, source code, test cases, infrastructure changes, and release decisions. That broader reach is what distinguishes the Fourth Wave from earlier productivity tools.
Examples and Use Cases
- An engineering team uses an AI agent to draft user stories from product notes, then generates implementation tasks and test ideas from the same context.
- A developer asks a model to create code, but also to suggest fixes after static analysis, which changes the role of code review from authorship checking to verification.
- Release engineering uses an agent to prepare deployment changes, update configuration, and summarise rollout risks before a human approves the release.
- Support teams use AI to interpret incident notes, propose likely root causes, and assemble response steps from operational documentation.
- Security teams use AI-assisted workflows to triage findings and draft remediation suggestions, while retaining human ownership of final decisions.
The main trade-off is speed versus assurance. As AI moves deeper into the lifecycle, the organisation gains throughput, but it also accepts more reliance on model output quality, context quality, and approval discipline. The term is therefore not just about coding efficiency; it describes a broader change in how software work is composed and supervised.
Security Implications
The security impact of the Fourth Wave is that AI-generated or AI-orchestrated changes can propagate faster than traditional review processes are designed to handle. If model output is trusted too early, mistakes can enter code, infrastructure, test logic, or operational playbooks at lifecycle points where they are harder to spot. That expands the blast radius from a single bad snippet to a connected delivery chain.
Another concern is control ambiguity. When a human and an agent both contribute to a change, it can become unclear who validated the result, which context the model used, or whether the action was intentional or merely suggested. That ambiguity can weaken accountability, especially when release, security, and operations teams all rely on the same AI-assisted workflow.
Security symptoms often include inconsistent change quality, opaque provenance for generated artefacts, and review fatigue as teams approve more machine-produced output than they can deeply inspect. In NHIMG’s view, the key issue is not that AI writes software, but that software-making authority becomes more distributed across human and machine actors.
Domain and Governance Relevance
The Fourth Wave matters because it changes how software governance is defined. Traditional SDLC controls assume human authorship, human review, and bounded automation. AI-assisted delivery breaks those assumptions when a system can influence multiple stages of the lifecycle without a corresponding increase in assurance, traceability, or ownership clarity.
That shift has direct implications for identity and access governance where AI agents are granted tool access, deployment permissions, or access to development systems. In that setting, the practical question is no longer only whether software is correct, but whether the actor producing or changing it is properly scoped, observed, and constrained. For related machine-identity governance concepts, NHIMG’s OWASP Non-Human Identity Top 10 is useful when AI-enabled workflows depend on service credentials or delegated access.
For organisations, the governance challenge is to keep human accountability intact while the delivery process becomes more autonomous. The Fourth Wave is therefore a software engineering term with immediate security and operating-model consequences, not just a technology trend.
Risk and Threat Considerations
The material risk is that AI-assisted software workflows can introduce errors, insecure changes, or unauthorised actions at a pace that exceeds normal review and validation capacity. This is especially relevant when the same agent can generate code, alter configuration, and trigger downstream tooling.
Failure mechanism: The recognised mechanism is trust overreach: teams accept machine output as if it were bounded automation, then fail to verify provenance, intent, and side effects across the lifecycle. That can let hallucinated logic, unsafe defaults, or maliciously influenced prompts become operational changes.
Impact: The result can be broken builds, insecure releases, weakened change accountability, and faster propagation of defects or abuse across development and production systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST AI RMF, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 42001:2023 | 4 — Context of the organization | Defines governance context for AI-influenced software delivery. |
| Recommendation — Establish AI governance context for lifecycle changes and accountable decision-making. | ||
| NIST AI RMF | MAP — Measure, Assess, and Manage AI Risk | Directly fits risk management for AI shaping software engineering workflows. |
| Recommendation — Measure AI-driven delivery risk and manage it across the software lifecycle. | ||
| NIST CSF 2.0 | GV — Govern | Applies to governance of software delivery processes and accountability. |
| Recommendation — Set governance expectations for AI-assisted development and approval ownership. | ||
| CIS Controls v8 | 6 — Access Control Management | Relevant where AI agents use credentials or tool access in delivery systems. |
| Recommendation — Restrict and review access used by AI-enabled build and deployment workflows. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership of Non-Human Identities | Applies when agentic workflows rely on machine identities or delegated access. |
| Recommendation — Inventory AI workflow identities and assign ownership for every privileged credential. | ||
Practitioner Guidance
Why practitioners should care: Fourth Wave workflows change where assurance has to happen. Validation can no longer sit only at code review, because AI may have already shaped requirements, tests, infrastructure, and support actions before a human sees the final artefact.
Common misunderstanding: The term is often treated as a productivity label, but the governance reality is that authority is being redistributed. Practitioners should treat AI-influenced delivery as a change in control surface, not just a faster way to write software.
Practitioner takeaway: Preserve clear human ownership for decisions that change production behaviour, and make provenance visible wherever AI output enters the delivery chain.
Related resources from NHI Mgmt Group
- Why do AI pipelines expose more credential risk than traditional software development?
- Why do AI-assisted development pipelines change software trust requirements?
- Why does software supply chain security matter more in AI-assisted development?
- How do identity and NHI controls fit AI-assisted software development?
