Topic starter
20/08/2026 5:24 pm
TL;DR: The Agentic Development Life Cycle is replacing human-paced SDLC assumptions with autonomous code generation, tool use, and dependency selection, while 81% of organisations still lack visibility into AI use across the development lifecycle, according to Cycode. The security problem is no longer just AI-assisted coding but governed execution at machine speed, where agentic behaviour can amplify supply chain, secrets, and policy drift risks.
Editorial analysis by NHI Mgmt Group, based on content published by Cycode: “Securing the Agentic Development Lifecycle (ADLC)”.
By the numbers:
- Cycode reports that 100% of surveyed organisations confirmed they have AI-generated code in their codebase.
- Cycode reports that 81% have no visibility into how AI is actually being used across their development lifecycle.
Key questions
Q: What breaks when AI agents can make code changes faster than humans can review them?
A: Manual review stops being a meaningful control if it cannot keep pace with change volume.
Q: Why do autonomous package installs by AI agents increase supply chain risk?
A: Autonomous installs increase risk because the approval often happens on reflex, not informed review.
Q: What are the signs that agentic development controls are failing?
A: The main signals are silent dependency choices, unexpected secret access, agent tool calls to services outside the approved workflow and code changes that appear without a clear human decision trail.
Practitioner guidance
- Inventory agentic development surfaces Identify every place where AI agents can create, modify, test or merge code, including chat tools, CLIs, orchestration layers and MCP-connected workflows.
- Bind agent actions to explicit policy Define which repositories, dependencies, APIs and environments each agent may touch, and block any execution outside those boundaries.
- Add continuous supply chain validation Check model provenance, dependency legitimacy and tool-server trust before changes reach merge or deployment stages.
Bottom line: Agentic development exposes a security gap because code, dependencies and tool calls can now be produced by non-human actors that traditional SDLC controls were never designed to supervise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:14 pm
ADLC creates a governance gap, not just a tooling gap: once agents can write, choose and commit code, the old assumption that human review is the primary security checkpoint no longer holds. Security teams are no longer governing developer output alone, they are governing machine decisions that happen before a human sees the change. Practitioners should treat agent execution as a controlled identity and access problem, not only an application security workflow.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools. Define who can start the workflow, which tools and data sources it can reach, what evidence is required for review, and how access is revoked if the workflow expands beyond its intended scope. The key is to govern the chain of delegated action, not only the final code output.
👉 Read our full editorial: Agentic development lifecycle security is exposing new supply chain risk