Notifications
Clear all
Topic starter
20/08/2026 5:24 pm
TL;DR: The Agentic Development Life Cycle is replacing human-paced SDLC assumptions with autonomous code generation, tool use, and dependency selection, while 81% of organisations still lack visibility into AI use across the development lifecycle, according to Cycode. The security problem is no longer just AI-assisted coding but governed execution at machine speed, where agentic behaviour can amplify supply chain, secrets, and policy drift risks.
NHIMG editorial — based on content published by Cycode: Securing the Agentic Development Lifecycle (ADLC)
By the numbers:
- 100% of surveyed organisations confirmed they already have AI-generated code in their codebase.
- 81% have no visibility into how AI is actually being used across their development lifecycle.
- Gartner projects enterprise applications using agentic AI will rise from less than 1% in 2024 to 33% by 2028.
Questions worth separating out
Q: What breaks when AI agents can make code changes faster than humans can review them?
A: Manual review stops being a meaningful control if it cannot keep pace with change volume.
Q: Why do AI agents complicate existing IAM and NHI governance models?
A: AI agents complicate governance because access is no longer confined to a single environment or a single identity type.
Q: How can teams tell whether agentic access controls are actually working?
A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution.
Practitioner guidance
- Implement agent identity inventory Catalog every AI coding agent, CLI assistant, chat-based assistant, and MCP-connected workflow that can create or modify code, then assign an owner and lifecycle state to each one.
- Scope credentials to the smallest agent task Replace broad automation tokens with task-scoped credentials, isolate secrets used by development agents, and revoke access when the agent or workflow is no longer active.
- Block unapproved MCP and dependency paths Maintain an allowlist for MCP servers and package sources, and validate any AI-suggested dependency before it can enter a build or repository.
What's in the full article
Cycode's full blog covers the operational detail this post intentionally leaves for the source:
- Detailed examples of how Cycode maps AI-generated code, dependencies, secrets, and runtime context into one security graph
- Step-by-step explanation of the AI Guardrails, Exploitability Agent, and Fix and Remediation Agent workflow
- Operational guidance on how Cycode scans terminal-based agents, chat-based agents, and MCP-connected development paths
- Examples of the policy controls used to block unauthorised tools, secrets exposure, and unsafe AI-driven changes
👉 Read Cycode's analysis of securing the agentic development lifecycle →
Agentic development lifecycle security - what practitioners need to know?
Explore further
20/08/2026 6:14 pm
Agentic development creates an identity problem, not just a tooling problem. Once software agents can authenticate, call APIs, and commit changes, they become governed actors in the identity estate. That means access scope, secrets handling, and offboarding all matter, even when the actor is a model rather than a person. Practitioners should treat autonomous development credentials as NHI assets with explicit lifecycle ownership.
A question worth separating out:
Q: What should organisations do first when adopting agentic development?
A: Start by discovering where agents already exist, then bind each one to an owner, a purpose, and a constrained permission set. After that, enforce guardrails at the tool and pipeline layer so agents cannot reach unapproved MCP servers, packages, or secrets. The first goal is visibility, because you cannot govern what you cannot see.
👉 Read our full editorial: Agentic development lifecycle security is exposing new supply chain risk
