Notifications
Clear all
Topic starter
01/08/2026 8:57 pm
TL;DR: As AI coding agents collapse design, implementation, and testing into single sessions, point-in-time security gates and static artifacts lose effectiveness, according to Seezo. The governance challenge is no longer where to place the next review, but how to keep security context, telemetry, and validation aligned with rapidly changing agent workflows.
NHIMG editorial — based on content published by Seezo: Don't Let Security Get Left Behind in Agentic Development
Questions worth separating out
Q: How should security teams control AI-assisted coding without slowing developers down?
A: Put policy into the IDE so security guidance appears during code creation, not after commit.
Q: Why do traditional SDLC checkpoints struggle with agentic development?
A: They assume time between stages, but agentic workflows compress design, build, and test into short loops.
Q: What do teams get wrong about securing AI coding assistants?
A: Teams often focus on code output and ignore the agent boundary, where file reads, tool outputs, and external content shape the next action.
Practitioner guidance
- Embed security context inside the developer workflow Provide policy, standards, and architectural constraints directly in the coding environment so AI agents and developers can reference them during task execution.
- Persist reviewed requirements beyond the session Treat security review output as durable governance data that survives the conversation, branch switch, or tool handoff.
- Instrument agent activity with branch-level telemetry Log what skills or tools were invoked, by whom, on which branch, and whether the implementation honoured the resulting requirements.
What's in the full article
Seezo's full blog covers the operational detail this post intentionally leaves for the source:
- How the workflow maps security context into the coding environment as work is happening.
- How persistent requirements are carried from design review into implementation and CI validation.
- How branch-level telemetry records which skills were invoked, when they ran, and whether requirements were honoured.
- How regulated teams can use the system of record for audit visibility into agent-driven change.
👉 Read Seezo's analysis of security for agentic development workflows →
Agentic development security gaps: are your controls keeping up?
Explore further
01/08/2026 9:05 pm
Agentic development is creating a governance gap, not just a tooling gap. The issue is not that security teams lack controls, but that their controls were designed for a slower lifecycle with human handoffs. When design and implementation collapse into one session, review logic built around waiting for a later stage no longer matches the pace of change. Practitioners should treat agentic development as a workflow governance problem first and a code scanning problem second.
A question worth separating out:
Q: Who is accountable when an AI agent makes the wrong change?
A: Accountability sits with the governance chain that approved the access model, not with the agent alone. Teams need a trace from requester to policy decision to identity issuance to action results. If that chain is missing, incident review becomes guesswork and access governance cannot be defended to auditors.
👉 Read our full editorial: Agentic development needs security that follows the work in real time
