Opinion: AI Adoption Maturity Model Urged for Governing Agentic AI Software Development Risk
A contributed piece by Matias Madou (CTO and co-founder of Secure Code Warrior) argues that governance alone is not enough to control the security risks of agentic AI in software development. Organizations also need to know where they sit on an eight-stage AI Adoption Model. The article cites Gartner's prediction that costs of incidents driven by agentic AI will rise fourfold through 2027. It also cites SonarSource's finding that frontier LLMs such as Claude and Gemini, which write the most functional code, also produce the most severe vulnerabilities. No specific incident, vulnerability or threat actor is described. This is vendor-authored thought leadership with no direct threat to defenders.
Technical Details
- The model has three phases and eight stages: AI Assisted (stages 1-2), AI Native (3-4) and Agentic (5-8).
- Stages 1-2 are Minimal AI Use and Supervised Assistance, with low to moderate risk.
- Stages 3-4 are Unsupervised Assistance and AI-Primary Development, with high risk. Agents use standards such as Model Context Protocol (MCP), and developers become reviewers rather than authors. Over-trust in AI is flagged as a major risk.
- Stages 5-8 are Single Agent (CLI agents such as Claude Code and Gemini CLI), Multi-agent Parallel, Scaled Agent Management and Autonomous Orchestration. Risk ranges from very high and critical to extreme and maximum.
- The author claims most developers are currently at stages 2-4.
- Shadow AI, meaning employees bringing their own LLMs, is cited as reducing visibility into who uses AI and how it affects production code.
Remediation
- Establish AI governance early and identify the current adoption stage and the controls it requires.
- Provide verifiable developer upskilling in secure coding and code review.
- Add observability of AI tool use, commits and MCP activity, and detect over-trust.
- At agentic stages, enforce policy, use application risk scorecards and track commits for audit.
Linha do tempo
-
Opinion: AI Adoption Maturity Model Urged for Governing Agentic AI Software Development Risk
ler a análise desta fonte ocultar
A contributed piece by Matias Madou (CTO and co-founder of Secure Code Warrior) argues that governance alone is not enough to control the security risks of agentic AI in software development. Organizations also need to know where they sit on an eight-stage AI Adoption Model. The article cites Gartner's prediction that costs of incidents driven by agentic AI will rise fourfold through 2027. It also cites SonarSource's finding that frontier LLMs such as Claude and Gemini, which write the most functional code, also produce the most severe vulnerabilities. No specific incident, vulnerability or threat actor is described. This is vendor-authored thought leadership with no direct threat to defenders.
Technical Details
- The model has three phases and eight stages: AI Assisted (stages 1-2), AI Native (3-4) and Agentic (5-8).
- Stages 1-2 are Minimal AI Use and Supervised Assistance, with low to moderate risk.
- Stages 3-4 are Unsupervised Assistance and AI-Primary Development, with high risk. Agents use standards such as Model Context Protocol (MCP), and developers become reviewers rather than authors. Over-trust in AI is flagged as a major risk.
- Stages 5-8 are Single Agent (CLI agents such as Claude Code and Gemini CLI), Multi-agent Parallel, Scaled Agent Management and Autonomous Orchestration. Risk ranges from very high and critical to extreme and maximum.
- The author claims most developers are currently at stages 2-4.
- Shadow AI, meaning employees bringing their own LLMs, is cited as reducing visibility into who uses AI and how it affects production code.
Remediation
- Establish AI governance early and identify the current adoption stage and the controls it requires.
- Provide verifiable developer upskilling in secure coding and code review.
- Add observability of AI tool use, commits and MCP activity, and detect over-trust.
- At agentic stages, enforce policy, use application risk scorecards and track commits for audit.