Topic starter
28/08/2026 12:04 pm
TL;DR: The software supply chain is shifting to agentic development, where coding agents write, test, and ship code at machine speed while expanding the attack surface across prompts, plugins, and MCP servers, according to Apiiro. The real control problem is no longer post-hoc detection, but independent prevention and governance across agent-generated code.
Editorial analysis by NHI Mgmt Group, based on content published by Apiiro: “Apiiro Named a Leader in the Gartner® Magic Quadrant™ for Software Supply Chain Security”.
Key questions
Q: What breaks when coding agents can generate code before review catches it?
A: Traditional AppSec breaks because it assumes code exists long enough to be scanned, reviewed, and triaged before release.
Q: Why do coding agents increase supply chain risk even when source code is unchanged?
A: Because the risk often sits outside the repository.
Q: What do security teams get wrong about agentic development controls?
A: They often place too much confidence in review gates, scanning, or vendor-native guardrails after code has already been produced.
Practitioner guidance
- Separate code creation from governance Ensure the agent that writes or edits code cannot approve, release, or govern its own output.
- Inventory every agent connection Map prompts, plugins, extensions, skills, and MCP servers as first-class supply chain dependencies, then review each one for trust, provenance, and access scope.
- Constrain standing access for coding agents Limit repository, secret, and environment access to the minimum scope required for each task, and remove broad default entitlements from agent workflows.
Bottom line: Coding agents change the software supply chain because they can create and move code faster than conventional review and triage were designed to handle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 16 hours ago by NHI Mgmt Group
28/08/2026 12:04 pm
Agentic development creates a control-plane problem, not just a code-quality problem. Once coding agents can generate, test, and ship code across multiple toolchains, the risk boundary moves from a human reviewer to the orchestration layer that governs the agent. That makes independent policy enforcement more important than any one scanner or assistant. Practitioners should treat agent governance as a structural control, not a feature add-on.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern coding agents that can modify code and config?
A: They should treat them like privileged systems that need scoped access, auditability, and explicit approval boundaries. The safest model is to restrict what the agent can read, install, and execute, then require human review for any file that can influence runtime behaviour. In identity terms, the agent is not a casual user; it is a governed non-human actor.
👉 Read our full editorial: Agentic coding agents are becoming the new software supply chain perimeter
This post was modified 16 hours ago by NHI Mgmt Group