Notifications
Clear all
Topic starter
02/08/2026 12:25 pm
TL;DR: Agentic AI is moving into mainstream software engineering, with Gartner noting that over 50% of software engineering leaders are already using or planning to adopt generative or autonomous AI tools. The shift improves speed and throughput, but it also breaks assumptions in traditional AppSec because agents can write, test, and ship in real time, so governance must move into the workflow.
NHIMG editorial — based on content published by Checkmarx: AI Agents Mark a True Turning Point
By the numbers:
- In Gartner’s 2024 Software Engineering Leader survey, over 50% of respondents said they are currently using or actively planning to adopt generative or autonomous AI tools.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern AI-generated code in production pipelines?
A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact.
Q: Why do AI agents create new AppSec risk even when code quality improves?
A: AI agents reduce manual work, but they also compress decision-making into machine-paced actions that can bypass human review windows.
Q: What breaks when policy controls are only applied after code is generated?
A: When policy checks happen too late, the agent has already influenced code, dependencies, or pipeline behaviour.
Practitioner guidance
- Define agent identity boundaries Assign every AI agent a distinct identity, bounded permissions, and a named owner so access can be revoked, reviewed, and audited like any other privileged workload.
- Constrain tool and data access Limit which repositories, registries, prompts, and internal systems an agent can reach.
- Enforce policy at execution time Apply policy-as-code in pull requests, build steps, and deployment workflows so an agent cannot bypass controls simply because it operates faster than a human reviewer.
What's in the full article
Checkmarx's full article covers the operational detail this post intentionally leaves for the source:
- Examples of how the vendor suggests embedding controls into IDEs, build pipelines, and merge workflows
- Specific use cases for AI-augmented vulnerability remediation and code-fix practices
- The vendor's practical guidance for secure prompt design and monitoring agent behaviour
- Implementation-oriented discussion of multidisciplinary governance teams for DevSecOps adoption
👉 Read Checkmarx's analysis of AI agents and application security governance →
AI agents in software delivery: are your AppSec controls keeping up?
Explore further
02/08/2026 1:24 pm
AI agent governance has become an access-control problem, not just a development efficiency issue. Once agents can independently create, modify, and route software artefacts, they behave like privileged operational actors inside the delivery chain. That means the core control question shifts from code quality alone to authorisation, delegation, and auditability. Teams that treat AI agents as enhanced tools rather than governed runtime entities will leave gaps in accountability and access control.
A question worth separating out:
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.
👉 Read our full editorial: AI agents are changing software delivery and AppSec governance
