Topic starter
02/08/2026 12:25 pm
TL;DR: AI agents are moving into mainstream software engineering and can now code, test, document, and help ship changes far faster than traditional release cycles, according to Checkmarx's analysis of Gartner research. That speed shift breaks AppSec assumptions that controls can wait until staging or production, because governance now has to operate inside the workflow.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “AI Agents and Secure Software Engineering”.
By the numbers:
- Over 50% of respondents said they are currently using or actively planning to adopt generative or autonomous AI tools in Gartner's 2024 Software Engineering Leader survey cited by Checkmarx.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: How should security teams implement AI release governance in software delivery pipelines?
A: Start by making governance executable inside the release workflow, not in a separate document trail.
Q: How do teams know whether checkpoint controls for agentic AI are working?
A: They are working only if the most sensitive actions consistently pause for fresh human verification and cannot complete on ambient trust alone.
Practitioner guidance
- Constrain agent authority to task-specific scope Limit each agent to the smallest repository, pipeline, package, or environment scope needed for the task.
- Move AppSec controls into the workflow Apply policy-as-code, merge-request checks, and build-time validation before an agent can complete code changes or dependency updates.
- Monitor agent behaviour and dependency choices Log prompts, tool calls, package selections, and unusual resource spikes so you can detect prompt injection, supply chain drift, and denial-of-wallet patterns early.
Bottom line: AI agents are no longer just productivity helpers in software delivery. They can now become execution actors that change code, tests, dependencies, and release flows at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
Agentic AI has turned software delivery into an identity and governance problem, not just a tooling problem. When an agent can create code, tests, and workflow actions, the question is no longer whether the output looks valid. The question is what authority the agent had to produce it and what controls bounded that authority. For IAM and NHI teams, that is the same governance shift seen in machine identity programmes: access must be shaped around delegated capability, not assumed human oversight.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Why do autonomous AI agents create new AppSec risk in CI/CD workflows?
A: Autonomous agents compress code creation, testing, dependency selection, and execution into a single machine-driven sequence, so a bad instruction or unsafe dependency choice can propagate before a human review happens. The risk is not just faster mistakes. It is that the control point moves earlier, and many traditional AppSec checks are positioned too late to stop the decision that caused the issue.
👉 Read our full editorial: AI agents are changing software delivery and AppSec governance