Skip to content

Back to the catalog

endorlabs.comarticle

The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs

Endor Labs defines the "agentic development lifecycle" (ADLC) — the process by which AI coding agents autonomously plan, write, test, and ship code — and lays out where it introduces new security risk: insecure-by-default code, architectural design flaws that pass static analysis, hallucinated/unvetted dependencies, and a review bottleneck as agents outpace human reviewers. It cites benchmark data (62% of best-model BaxBench solutions insecure, only 10.5% of SWE-Agent/Claude 4 Sonnet solutions secure, only 1 in 5 AI-recommended dependency versions safe) and proposes a control stack — secure-generation prompting, security-aware multi-agent PR review, reachability-based prioritization, and automated remediation — mapped to NIST SP 800-218A, CSA's Agentic SDLC, and OWASP.

TL;DR Vendor explainer defining the "agentic development lifecycle" and the control stack (secure generation, PR review, reachability, remediation) needed to secure AI coding agents that autonomously write, test, and ship code.
Open original ↗

Organisations named here

  • Cloud Security Alliance
  • Faros AI
  • NIST SP 800-218A
  • Stack Overflow Developer Survey

Technologies named here

  • Endor Labs AI Security Code Review
  • AI coding agents / agentic development tools
  • Endor Labs
  • SWE-Agent with Claude 4 Sonnet
  • SAST
  • SCA
  • BaxBench
  • Cursor
  • Claude Code
  • GitHub
  • GitLab
  • Faros AI telemetry
  • Jellyfish
  • Model Context Protocol
  • SWE-Agent

Techniques named here

  • Insecure code generation by default
  • Architectural/design flaw introduction
  • Hallucinated dependency exploitation
  • Transitive/phantom dependency risk
  • Reachability analysis
  • Secure-insecure diff prompting

Related in AI Security