The ADLC maturity model: 5 stages of agentic development security | Endor Labs

What it is

The ADLC maturity model is a proposed framework from Endor Labs that scores security controls over coding agents in five stages. It measures security maturity, not adoption. ADLC here means the agentic development lifecycle (plan, build, test, deploy, maintain with agents inside it), not building AI agents as products. The page says no official standard exists, and OWASP SAMM has no practice streams for agentic AI yet.

How it works

Every stage has a requirement on two tracks: agent actions (shell commands, file access, MCP calls, package installs) and agent output (code, dependencies, secrets).

Stage 3 is the threshold. A rule in a system prompt, AGENTS.md or .cursorrules is guidance, because the model can ignore it or be talked out of it by prompt injection. A hook that blocks a command before it runs is enforcement. The page's test: if the model can bypass a control by changing its mind, it does not count toward stage 3. Stage 3 controls are least-privilege credentials, sandboxing, MCP allowlists, action policies, and install-time blocking of malicious packages.

Stage 4 often stalls because agents open many more PRs, which multiplies findings. The page recommends reachability-based prioritization and exploitability confirmation on PRs.

Stage 5 adds adversarial regression tests (plant a malicious instruction in a test issue and confirm the action is blocked), bypass checks (agents cannot disable hooks, edit their own policy or route around an MCP allowlist), policy drift reviews when new agents or MCP servers appear, and AI components in SBOMs.

What to do

Score each area separately: inventory, permissions and tool access, code security, secrets, supply chain, oversight, and monitoring and response. For each assessment question, produce the artifact or score it missing. Examples:

• Export every MCP server in use this week.
• Show a blocked action and its policy.
• Show a secret caught before commit, and whether it was live.
• Show the last prompt injection regression test result.

The lowest-scoring area is the real stage. A team with stage 4 code security and stage 1 inventory is a stage 1 team. Spend on that gap first.

Metrics suggested by stage:

• Share of agent sessions under policy (stages 2 and 3).
• Unapproved MCP servers found per month (stage 2).
• Risky actions blocked, by policy (stage 3).
• Time to remediate agent-introduced findings (stage 4).
• False positive rate on findings sent to developers and agents (stage 4).
• Share of audit evidence produced automatically (stage 5).

Traps named: counting tools as progress, relying on prompt-level rules (a stage 2 team believing it is at stage 3), approving a few agents while unreviewed MCP servers spread, and noisy blocking checks that push developers to unmanaged tools and personal accounts.

Caveats

The page is a vendor post. Its stage 3 and 4 examples are Endor Labs products (Coding Agent Governance, Package Firewall, AURI, AI Security Review). Endor Labs reports up to 95% false positive reduction for AI SAST and 83% fewer blocked PRs, with no method given. The page says stages are mostly sequential but areas can mature at different speeds. It cites ISO/IEC 42001 and 2026 CISA and Five Eyes agentic AI guidance, and advises confirming applicable clauses with an auditor.