Securing the Agentic Development Lifecycle (ADLC): A Complete Guide

Key Takeaways

• The Agentic Development Lifecycle (ADLC) is not AI-assisted development. Agents plan, write, test, and deploy code with minimal human direction at each step. That distinction is the entire security problem.
• By 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, according to Gartner.
• OWASP’s Top 10 for Agentic Applications 2026, built by 100+ global security experts, identifies Agent Goal Hijack, Tool Misuse, and Identity and Privilege Abuse as the top three risks, each capable of system-wide damage.
• Traditional SAST, DAST, and PR review gates were designed for deterministic, human-driven systems. ADLC is neither.
• Automated scanning catches known patterns. It cannot catch chained vulnerabilities, business logic flaws, or emergent agent behaviors. That gap is where attacks happen.
• Healthcare, financial services, and critical infrastructure face the highest exposure right now.

The Gap Is Bigger Than Most Teams Realize

Gartner projects that by 2028, 33% of enterprise software will include agentic AI, up from less than 1% in 2024. In that same period, at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from 0% in 2024. The pace of adoption is not a slow ramp. It is a hard curve.

The security readiness has not followed. 81% of organizations have no full visibility into how and where AI is being used across their development lifecycle, according to Cycode’s State of Product Security for the AI Era 2026, a survey of 400+ CISOs and security leaders. That is not a tooling problem. That is a fundamental gap in how the industry is thinking about the Agentic Development Lifecycle and what it actually demands from a security posture.

Most security teams are still treating ADLC like a slightly faster version of SDLC with AI on the side. It is not that. And the difference matters in ways that current controls are not equipped to handle.

What Is the Agentic Development Lifecycle?

The Agentic Development Lifecycle (ADLC) is a structured methodology for building software where autonomous AI agents execute phases of the build process, from planning and coding to testing and deployment, with minimal human intervention at each step. Unlike traditional SDLC, agents don’t wait for human approval between stages; they reason, decide, and act continuously.

That last sentence is where everything changes from a security standpoint.

To understand what that means practically, consider three ways ADLC diverges from what security teams have spent years learning to protect:

Deterministic vs. probabilistic output. Traditional software runs fixed instructions. You give it the same input, and it produces the same output every time. AI agents use reasoning to decide how to achieve a goal. The same input can produce two different outputs. This is not a bug. It is by design. But it breaks almost every assumption that automated security tooling was built on.

Static vs. adaptive behavior. Traditional software only changes when a developer changes the code. Agent behavior can evolve based on environment feedback, mid-task, without a code commit triggering any review gate. This creates new agentic AI security challenges because behavior can change without passing through conventional security controls.

Failure modes are different. Traditional software crashes in traceable, obvious ways. Agents fail through hallucinations and goal misalignment, which are harder to detect, harder to reproduce, and often invisible until damage has already occurred.

The table below captures where these differences sit in context:

Secure Your Agentic Development Lifecycle Before Attackers Exploit It

Choose a partner that helps you identify and fix real security risks before attackers do. Qualysec is here to help.

Talk to an Expert→

The 7 Stages of the Agentic Development Lifecycle

Most security conversations about ADLC treat it as a single surface area. That framing misses where the actual exposure sits. Each stage of the lifecycle carries its own distinct risk profile, and the controls that matter at Stage 1 are largely irrelevant by Stage 6.

IBM’s ADLC documentation outlines core phases including Plan, Code and Build, Test and Release, Deploy, Operate, and Monitor. Architecture and Design sits as a distinct pre-build stage in OWASP’s agentic threat modeling guidance, given how much of the eventual blast radius is determined by decisions made there.

Stage 1: Planning and Intent Definition

This is where goal hijacking (OWASP ASI01) becomes possible. Through techniques such as prompt injection and jailbreaking, malicious or manipulated requirement inputs at this stage can misdirect everything the agent builds downstream. The compromise does not show up in the code. It is baked into the intent before a line is written.

Stage 2: Agent Design and Architecture

Memory sharing scope, tool access permissions, and delegation chains between agents are all decided here. Get these wrong, and no amount of downstream testing fully contains the damage. Architecture decisions set the blast radius for every future compromise.

Stage 3: Tool Integration

Every tool an agent can invoke is an attack surface. OWASP ranks Tool Misuse (ASI02) as the second-highest agentic risk precisely because over-permissioned tool access is both common and catastrophic. Each integration point must be threat-modeled, not just connected.

Stage 4: Code Generation

Three distinct risks converge simultaneously: hallucinated dependencies that become slopsquatting attack vectors, business logic flaws in generated code that pass every syntax check, and non-deterministic outputs that vary across runs. The same code generation prompt does not produce the same security posture twice.

Stage 5: Testing and Validation

Automated scanners were built for deterministic code. A scanner that runs once on a static codebase cannot evaluate a system that behaves differently on every run. Non-deterministic agents require behavioral testing across multiple runs and real-world conditions, not single-pass static analysis.

Stage 6: Deployment

This is where identity and access management gaps become consequential. The NCCoE’s February 2026 concept paper identified this as the most urgent unresolved gap: existing IAM frameworks were designed for human users and static software services, not for machine actors operating autonomously across multiple systems simultaneously.

Stage 7: Monitoring and Governance

Behavioral drift, meaning gradual deviation from intended behavior due to context accumulation, model updates, or memory corruption, is a documented production failure mode. Without active trace logging and anomaly detection, drift is invisible until it becomes a breach. NIST’s AI Agent Standards Initiative designates observability as foundational, not optional.

Why the Security Model Built for SDLC Breaks Down in ADLC

Every security control in traditional SDLC- pull request reviews, CI/CD gates, and post-commit scans- was built on one assumption: a human sat between code and production. ADLC removes that assumption entirely, often at multiple stages simultaneously.

The result is not just a gap in coverage. It is a category mismatch.

IBM’s ADLC documentation puts it plainly: in an agentic system, providing the same input twice might yield two different outputs. The overall failure of a complex multi-step agentic workflow might stem from the incorrect result of a single probabilistic tool call, and that specific failure might not reproduce on a subsequent run. A clean scan does not confirm a clean system. It confirms a clean run.

Snyk, in their analysis of agentic development risks, frames the shift this way: the security question changes from “Is this code secure?” to “Can we trust the system that created it?” Risk enters before code reaches the repository. Agents call external tools, pull dependencies, and query APIs without a developer watching. Attacks begin upstream of the code itself.

Real-World AI Supply Chain Threat

One specific attack vector that has moved from theoretical to confirmed is what researchers now call slopsquatting. What does that mean? AI coding models, when generating code, sometimes recommend software packages that do not actually exist. Researchers analyzed 576,000 code samples from 16 major LLMs and found that nearly 20% of recommended packages did not exist in any public registry. 43% of those hallucinated package names reappeared consistently across prompts, making them predictable, repeatable targets. Attackers register those fictional package names in advance. When an agentic coding system resolves a dependency without human review, it installs an attacker-controlled payload instead of what the agent intended. Security researcher Bar Lanyado registered a single hallucinated package name as an experiment. Within three months, it had accumulated over 30,000 downloads.

These are not edge cases. They are structural properties of how agentic systems behave.

The Security Risks That ADLC Introduces: By Attack Surface

Goal Hijacking and Prompt Injection (ASI01)

Prompt injection in agentic systems is not a jailbreak. A jailbreak makes a model say something it should not. In an ADLC context, prompt injection redirects what an agent builds, deploys, or executes. The compromise does not show up in output text. It propagates through the agent’s entire downstream execution chain before anyone reviews a single line of code.

OWASP’s Top 10 for Agentic Applications 2026 ranks Agent Goal Hijack (ASI01) as the primary agentic risk in the first peer-reviewed framework built specifically for autonomous systems. 

NIST’s CAISI red-team study (January 2025), run across 97 injection tasks and 629 test cases, found novel attack techniques achieved an 81% task-hijacking success rate, versus 11% for the strongest known baseline defenses. The same research found that with 25 repeated attempts per task, success rates climbed from 57% to 80%. Security teams calibrating red-team exercises against existing playbooks are measuring the wrong threat.

Tool Misuse and Exploitation (ASI02)

The attack vector is not the tool. It is the absence of guardrails around how the agent invokes it. An agent chains a low-sensitivity tool with a sensitive API and reaches an objective no human explicitly authorized, with each individual call appearing legitimate in isolation.

OWASP ranks Tool Misuse (ASI02) as the second-highest agentic risk. The Q1 2026 OWASP GenAI Exploit Round-up highlighted multiple agentic incidents involving autonomy failures and privilege abuse leading to lateral movement and data exfiltration. Tool misuse via prompt injection triggers unauthorized actions in a significant portion of evaluated scenarios.

If an agent can call more tools than its current task requires, the blast radius of any compromise expands accordingly. OWASP’s mitigations for ASI02: function-level policies for tool invocation, parameter validation before execution, and least-privilege tool access scoped to the specific task.

Memory Poisoning (ASI06)

Most injection attacks are session-bound. Memory poisoning persists. AI agents store past decisions and context across sessions. The MemoryGraft attack (Srivastava and He, arXiv:2512.16962, December 2025) demonstrated that an attacker who supplies a benign-appearing artifact the agent reads during execution can corrupt its long-term memory without any jailbreak and without ongoing access. The agent recalls the poisoned instruction as its own learned experience and applies it to future tasks. The agent trusts its own memories implicitly. There is no external source to validate against.

Unit 42’s October 2025 proof of concept confirmed this against Amazon Bedrock Agents: indirect prompt injection via a malicious webpage corrupted session summarization, causing injected instructions to persist across future unrelated sessions. OWASP classifies this as ASI06. Mitigations: session memory isolation, source validation before storage, and forensic snapshots enabling rollback.

Architecture Risks in Multi-Agent Systems

Agents in delegation chains trust messages from peer agents. That trust is almost never verified. Research by Lupinacci et al. (arXiv:2507.06850, July 2025) found that while 41.2% of models succumb to direct prompt injection, 82.4% can be compromised through inter-agent trust exploitation. Models that reject malicious commands from users will execute identical commands routed through a peer agent.

The AI Risk Quadrant Q2 2026 report found the Lethal Trifecta (access to sensitive data, exposure to untrusted external content, ability to communicate externally) present in 98% of assessed production agents. One compromised agent can propagate an attack to every dependent agent downstream. Zero Trust principles must apply between agents. Every authority transfer must be scoped, time-bound, auditable, and revocable.

What Secure Agentic Architecture Looks Like

Security teams often focus on testing and monitoring after agents are deployed. In practice, many of the most important security decisions are architectural.

A secure agentic architecture generally follows four principles:

• Separation of duties – Agents responsible for planning, coding, testing, and deployment should operate independently rather than sharing unrestricted authority across the workflow.

• Least-privilege tool access – Each agent should only access the tools required for its immediate objective. Broad tool access increases the impact of prompt injection and tool misuse attacks.

• Isolated memory boundaries – Persistent memory should be segmented between agents whenever possible. Shared memory creates opportunities for cross-agent contamination and memory poisoning.

• Verifiable delegation chains – Every task delegation should produce an auditable record showing which agent initiated the action, what permissions were transferred, and what outcome was produced.

Organizations that implement these controls reduce the blast radius of individual agent failures and improve their ability to investigate incidents when they occur.

If you are evaluating whether your current testing approach is adequate for agentic systems, Qualysec’s AI security validation services are worth reviewing.

Need Help Choosing the Right AI Cybersecurity Partner?

Compare security providers with confidence and identify the right partner to protect your applications, cloud, APIs, and AI systems before threats become breaches.

Schedule a Security Assessment
→

Why Automated Scanning Is Not Enough

Automated scanning tools were built for deterministic code. They match known patterns, known CVEs (a CVE is a publicly catalogued vulnerability, essentially a named and numbered security flaw that scanners are trained to recognize), and known signatures. Agentic code is probabilistic, emergent, and context-dependent. A scanner that runs once on a static codebase is not evaluating a system that behaves differently on every run.

What automation reliably catches: known vulnerability signatures, dependency versions against existing CVE databases, and basic static analysis patterns.

What automation reliably misses: chained vulnerabilities that span multiple agent actions (no single scan sees the full chain), business logic flaws specific to an organization’s context, emergent behaviors that only surface under real-world conditions, trust boundary violations that require understanding what the agent was supposed to do, and the 81% of novel agent hijacking attacks that bypass baseline defenses entirely.

NIST’s CAISI, through the AI Agent Standards Initiative launched in February 2026, emphasizes that security evaluation of agentic AI deployments should shift from one-time pre-deployment checks to continuous operational practices.

This is where Qualysec’s Three-Layered Defence System (human-led AI-powered pentesting) is architecturally relevant, not as a product claim, but because its structure mirrors what NIST and OWASP guidance actually recommends. 

Monitoring After Deployment Is Not Optional

There is a common assumption that a secure deployment stays secure. For deterministic software running fixed code, that is roughly true between updates. For agentic systems, it is not a reasonable assumption at any point in the operating lifecycle.

IBM’s ADLC documentation explicitly identifies behavioral drift as a production failure mode: “Model drift is an inevitable phenomenon that is best addressed with a proactive approach.” Drift occurs through context accumulation, model updates, memory corruption, and environmental changes, gradually pulling agent behavior away from its intended parameters without any single event triggering an alert.

NIST’s CAISI guidance is equally direct: security evaluation of agentic AI deployments should not be treated as a one-time pre-deployment check but as a continuous operational practice. Under the EU AI Act, this is also a legal requirement. Article 12 of Regulation (EU) 2024/1689 mandates automatic recording of events in high-risk AI systems with tamper-evident logging capabilities. Logs must typically be retained for a minimum of six months. For financial services organizations operating under DORA and MiFID II, sector-specific requirements often extend audit-grade retention to five years or longer.

Five monitoring layers that agentic deployments require:

1. Full trace logging of every agent action, tool call, and reasoning step
2. Behavioral anomaly detection, flagging deviations from established baselines before they compound
3. Memory audit trails, designed to detect gradual poisoning of persistent context stores before corrupted instructions execute
4. Tool call inspection, monitoring what tools agents invoke, under what permissions, and whether invocation patterns match expected behavior
5. Hallucination and faithfulness scoring, using per-trace evaluation to flag when agent outputs diverge from input context

These are not monitoring enhancements for mature programs. They are the baseline for any organization running agents in a production environment with access to real data or real systems.

Agent Identity and Delegated Permissions

Traditional IAM assumes a human user or a static application service account. Agentic systems introduce a third category: autonomous machine actors that make decisions, invoke tools, and delegate tasks without human approval between actions.

The challenge is that agents often inherit permissions that are broader than their immediate objective requires. A planning agent may create a task for a coding agent, which then invokes a deployment agent. If permissions are passed unchanged through that chain, a compromise at any stage can inherit the authority of the entire workflow.

Security teams should treat agents as independent identities rather than extensions of a human user account. Each agent should receive:

• Task-specific permissions
• Time-limited credentials
• Auditable authorization records
• Revocable access scopes

Delegation should never automatically transfer full privileges between agents. Every authority handoff must be validated against the minimum permissions required for the next action.

In agentic environments, identity is no longer just about who accessed a system. It becomes a question of which agent acted, under what authority, and why that authority was granted in the first place.

Regulatory Exposure Organizations Cannot Ignore

Regulators are not waiting for the security frameworks to catch up. Obligations are already in force, and the penalty structures were not designed with AI’s scale of potential exposure in mind.

The EU AI Act (Regulation (EU) 2024/1689) is the most comprehensive framework currently operative. Article 12 requires high-risk AI systems to technically allow for automatic tamper-evident logging. 26(6) Article places the obligation on deployers to retain those logs for a minimum of six months. Article 15 requires resilience against adversarial attacks, including those targeting agent actions and tool calls. While the original high-risk obligations were set for August 2, 2026, a provisional political agreement on the Digital Omnibus in May 2026 defers stand-alone high-risk systems to December 2, 2027. Penalties for non-compliance can reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher.

For healthcare organizations, HIPAA’s 2026 inflation-adjusted penalty schedule makes the stakes concrete. Under the current schedule, willful neglect violations carry penalties starting at $14,602 per violation at Tier 3 (corrected within 30 days) and reaching $73,011 per violation at Tier 4 (not corrected), with annual caps up to $2.19 million per violation category. Regulators are explicitly treating under-governed AI deployment as willful conduct, not negligence. In a breach scenario involving an agentic system with access to patient records, the exposure is calculated per record, not per incident.

22 US states have enacted individual privacy laws as of Q1 2026. Under CCPA, under-governed AI deployment is being treated as intentional conduct, which carries penalties of up to $7,500 per violation under the statutory framework.

At a Glance:

The regulatory direction is consistent across jurisdictions: logging is mandatory, human oversight at key decision points is expected, and organizations that cannot demonstrate governance over their agentic systems will be treated as having chosen not to govern them.

Which Industries Are Carrying the Most Exposure Right Now

Healthcare carries the most visible exposure. 275 million patient records were exposed in 2024, a 63.5% increase from 2023 and the largest healthcare data exposure in US history. While 2025 saw fewer total records exposed compared to that peak, the volume of breaches remained elevated. This happened before agentic AI embedded itself in clinical workflows at scale. A compromised agent in a clinical decision support system does not just leak data. It can influence care decisions downstream.

Financial services agents handle fraud detection and real-time trading. A single compromised instruction in a trading agent can cascade across interconnected systems in milliseconds, well before any human review is structurally possible.

Critical infrastructure is where CISA has been most explicit. CISA’s JCDC AI Cybersecurity Collaboration Playbook, published in January 2025, was among the first official US government documents to explicitly name “agentic, copilot, or third-party platforms” in a security reporting context. A joint CISA and NSA publication from December 2025 went further, explicitly identifying AI agents as a new risk class in operational technology (OT) environments, the systems that run physical infrastructure.

Software development pipelines are a target for every organization. A compromised pipeline is not just an internal problem. It is the entry point for downstream vulnerabilities in every product that pipeline produces.

A Security Checklist for the Agentic Development Lifecycle

1. Define agent scope and permissions before deployment. Minimum viable privilege only. Agents should access nothing beyond what the current task actually requires. This directly addresses OWASP ASI03.
2. Threat model every tool-calling pathway. Each tool an agent can invoke is an independent attack surface. Map all tool integrations before deployment, not after an incident identifies the gap.
3. Run security validation that accounts for non-determinism. Single-run scans are insufficient. Testing must account for behavioral variance across multiple runs and under different environmental conditions.
4. Validate all AI-generated dependencies before they enter the build. Do not trust agent-selected packages without human or verified-source confirmation. Slopsquatting has moved from theoretical to confirmed exploitation. CSA Labs documented slopsquatting as an active attack vector in their April 2026 research note.
5. Establish human review checkpoints at high-risk stages. Particularly at deployment authorization and anywhere agents interact with live production data, regulated environments, or financial systems.
6. Apply OWASP’s Top 10 for Agentic Applications 2026 as a baseline threat framework. It is the first globally peer-reviewed framework built specifically for agentic system risks, developed by 100+ industry experts and published in December 2025.
7. Log everything. Agent actions, tool calls, reasoning traces, delegation chains. NIST’s AI Agent Standards Initiative, launched in February 2026, identifies observability as a foundational requirement for secure agentic deployment.

How QualySec Approaches Security Across the Agentic Development Lifecycle

Most security vendors entered the agentic AI conversation by leading with their tools. As a CREST-accredited cybersecurity company, Qualysec took a different position, one grounded in a simple observation: automated tools catch what they already know. They cannot catch what they have never seen before.

Agentic systems, by their nature, produce behaviors that are novel. An agent chaining three legitimate tools in an unexpected sequence to exfiltrate data does not match any known signature. A poisoned memory instruction that surfaces six weeks after injection does not trigger a scheduled scan. These are not edge cases. They are the normal operating conditions of agentic AI in production environments.

Qualysec’s security methodology uses a three-layered structure built specifically for this reality. 

• The first layer runs automated tools to surface known vulnerability patterns and common misconfigurations across the agent environment. 
• The second layer applies AI-powered analysis to identify deeper risk patterns that rule-based scanners miss. 
• The third layer, and the one that distinguishes the process, is human-led expert validation. Certified ethical hackers manually probe agent behavior, test trust boundaries between agents, attempt to manipulate tool invocation sequences, and verify that what the automated layers reported actually reflects the real risk picture.

That third layer is not a final checkbox. It is where roughly 80% of the actual work happens.

For teams building or deploying agentic systems, what this means in practice is that no vulnerability gets classified, reported, or closed without a human expert confirming it. Real-time visibility into testing progress is available through Qualysec’s live client dashboard, so security and development teams stay aligned throughout the engagement, not just at the final report.

Agentic systems are built to act without waiting for approval. The security process that validates them should not be built the same way.

Closing

Gartner projects that 33% of enterprise software will include agentic AI by 2028. The security frameworks are still catching up, and the gap between deployment speed and security readiness is the most consequential risk in this space right now.

The organizations handling this well are combining automated tooling with human-led expert validation, not replacing one with the other. They are applying ADLC-specific threat frameworks, establishing real oversight at the stages that actually carry risk, and treating security as a continuous practice rather than a pre-deployment checkbox.

If you are building or deploying agentic systems and want an honest picture of where your current security posture actually stands, Qualysec’s agentic systems penetration testing is designed specifically for this environment.

Speak Directly With Qualysec’s Certified Security Experts

Discover vulnerabilities before attackers exploit them

Schedule Free Consultation
→

FAQs

1. What are the 6 main stages of an AI project lifecycle?

The Agentic Development Lifecycle typically includes: Planning & Intent Setting, Agent Architecture & Design, Code Generation & Dependency Resolution, Testing & Validation, Deployment, and continuous Monitoring & Optimization. These stages emphasize autonomy, non-determinism, and ongoing human oversight where it matters most.

2. What are the biggest risks in agentic systems?

Top risks include agent goal hijacking, excessive permissions leading to privilege abuse, slopsquatting in dependency resolution, emergent behaviors that evade scans, and chained failures across tool calls. These stem from probabilistic outputs and reduced human checkpoints.

3. Why is security more critical in agentic systems?

Agentic systems act autonomously with minimal human intervention, making decisions in real time. A single compromised instruction or hallucinated dependency can cascade across systems before anyone notices. Traditional controls built for human-driven code simply don’t apply.

4. How often should agents be tested?

Continuously. Single pre-deployment scans are insufficient due to non-determinism. Leading teams run behavioral validation across multiple executions, real-world conditions, and after any prompt or tool change. Treat testing as an ongoing operational practice, not a gate.

5. What industries need secure ADLC the most?

Healthcare, financial services, and critical infrastructure face the highest exposure. Patient safety, high-value transactions, and physical kinetic consequences amplify the impact of any compromise. Software development pipelines matter for everyone else as the upstream vector.

6. How do you prevent agents from leaking data?

Enforce strict least-privilege access, map and monitor every tool-calling pathway, sanitize inputs and outputs, and maintain full logging of reasoning traces. Combine automated boundary enforcement with human review at any point where production or regulated data is involved.