Notifications
Clear all
Topic starter
18/08/2026 2:13 pm
TL;DR: Agentic development lifecycle security is no longer just a software delivery issue, because Cycode’s analysis says 100% of surveyed organisations already have AI-generated code in their codebases while 81% lack visibility into how AI is used across the development lifecycle. The control problem is now governance of agents, tools, credentials, and review boundaries, not simply code scanning.
NHIMG editorial — based on content published by Cycode: Agentic Development Lifecycle (ADLC): What You Need to Know
By the numbers:
- 100% of surveyed organisations confirmed they have AI-generated code in their codebases, while 81% have no visibility into how AI is used across the development lifecycle.
- Gartner projects that 33% of enterprise software applications will include agentic AI by 2028, up from less than 1% in 2024.
- A 2025 USENIX Security Symposium finding reported that roughly 20% of package references in AI-generated code pointed to packages that do not exist.
Questions worth separating out
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Q: Why do AI agents complicate existing IAM and PAM controls?
A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed.
Q: How do organisations know if agentic identity controls are actually working?
A: They should look for auditable consent histories, fast revocation, accurate scope logging, and blocked-request telemetry that matches policy.
Practitioner guidance
- Define each agent as a governed non-human identity Assign every coding or workflow agent a distinct identity, scoped permissions, and approved tool list.
- Enforce pre-commit controls at the point of generation Run secrets detection, dependency validation, and policy checks where the agent writes code, not only after pull request creation.
- Separate functional success from security acceptance Do not treat passing agent-written tests as evidence of safety.
What's in the full article
Cycode's full article covers the operational detail this post intentionally leaves for the source:
- Stage-by-stage guidance for requirements, planning, coding, testing, deployment, and monitoring in the agentic development lifecycle
- Examples of AI guardrails, allowlists, and AIBOM workflows for agent governance
- Specific detection and response patterns for prompt injection, unsafe dependencies, and leaked secrets
- Cycode's platform mapping for visibility, governance, guardrails, and orchestration
👉 Read Cycode's analysis of the agentic development lifecycle and its security risks →
Agentic development lifecycle security: what IAM teams need to watch?
Explore further
18/08/2026 3:05 pm
Agentic development is becoming an identity governance problem, not just a DevSecOps problem. Once AI agents can execute across planning, coding, testing, and deployment, the meaningful control question becomes who or what is allowed to act inside the pipeline. That pushes IAM, PAM, and secret governance into the software factory itself. Practitioners should treat every agent as a governed non-human identity with explicit boundaries.
A question worth separating out:
Q: What frameworks should teams use to assess agentic identity risk?
A: Teams should map agentic identity risk to OWASP-NHI for non-human identity controls, ZT-NIST-207 for zero-trust access boundaries, and NIST-CSF for governance and monitoring. Those frameworks help teams translate agent behaviour into ownership, access, detection, and response requirements without reducing the problem to a single tool decision.
👉 Read our full editorial: Agentic development lifecycle security is now an IAM problem
