By Lina Hope 
The rapid ascent of agentic artificial intelligence in software development bears all the hallmarks of a Hollywood summer blockbuster. Business leaders across industries are electrified by the prospect of Godzilla-sized productivity gains, envisioning a future where software engineering is accelerated by orders of magnitude. Yet, for the developers and security operations center (SOC) teams tasked with protecting corporate infrastructure, these same technological leaps send chills down their spines. Unlike a cinematic release, however, these thrills and chills are projected to last far longer than a single season, and the potential fallout carries consequences far more serious than spilled popcorn in a darkened theater.
The proliferation of advanced large language models, deployed for both specialized software development and broader corporate tasks, is fundamentally reshaping the enterprise landscape. Coupled with an influx of sanctioned productivity tools and unauthorized "shadow AI" quietly brought into the workplace by employees, this technological wave is expanding the corporate attack surface faster than traditional controls can adapt. The risks are no longer theoretical. Gartner projects that the financial and operational costs of security incidents driven directly by agentic AI will escalate fourfold through 2027, highlighting an urgent need for enterprises to rethink how they govern automated systems.
Compounding this challenge is the dual nature of modern frontier large language models. According to findings from SonarSource, models such as Claude and Gemini that generate the most functional, elegant, and efficient code also tend to produce the most severe security vulnerabilities. This sharp double-edged sword means that as developers lean more heavily on AI to optimize their workflows, they may inadvertently introduce deeply buried architectural flaws that conventional testing protocols fail to catch.
Organizations increasingly recognize the imperative to gain control over these risk factors, but the defensive measures implemented thus far frequently prove insufficient. Governance has emerged as the go-to concept for reining in AI-driven software development, and for good reason. Maintaining strict control over what automated AI agents are permitted to do—alongside enhanced observability of AI tool usage and code commits—helps organizations limit their risk exposure while still reaping the rewards of accelerated output.
Yet, governance alone has clear limitations when companies remain largely in the dark regarding their foundational security posture. Many businesses lack a clear understanding of where they currently stand on the ascending scale of AI adoption, leaving them ill-equipped to determine what safeguards they actually require at their specific maturity level. Without a comprehensive grasp of their current AI capabilities, the distinct risks involved, and the level of developer skill required to safely manage autonomous systems, organizations routinely fall short of implementing effective security best practices. What is required is a governance framework that accurately reflects the complex new reality of modern software development.
Know the Different Stages of AI Adoption and Maturity
To successfully navigate the intricate maze of AI implementation without sacrificing risk management, organizations need a structured lens through which to view their progression. A comprehensive three-phase, eight-stage AI Adoption Model offers a practical roadmap, mirroring the evolutionary steps enterprises take along their journey—starting from relatively basic AI assistants that perform routine tasks up to sophisticated autonomous agents capable of initiating and executing complex workflows entirely on their own.
While the model provides granular detail regarding specific organizational behaviors, it can be broadly understood across three distinct phases: AI Assisted, AI Native, and Agentic, each characterized by shifting activity levels, risk profiles, and required developer competencies.
In the initial phase, known as AI Assisted, organizations find themselves operating in the foothills of implementation. Encompassing Stage 1, characterized by minimal AI use, and Stage 2, which involves supervised assistance, this phase primarily features models working directly under a developer’s watchful eye. Risk levels remain relatively low to moderate, making this period an ideal window for enterprises to establish foundational governance policies. At the same time, developers should receive targeted upskilling on topics ranging from secure coding principles to rigorous code review techniques, with their competencies tracked and verified through baseline assessments.
As organizations progress into the second phase, dubbed AI Native, the dynamic shifts. Covering Stage 3, which involves unsupervised assistance, and Stage 4, marking the arrival of AI-primary development, this phase represents a period where developers increasingly allow AI models to operate independently without constant supervision. Productivity frequently skyrockets as agents leverage advanced information-sharing standards like the Model Context Protocol. However, risk levels rise correspondingly. One of the most prominent threats during this phase is over-trust, where developers place too much confidence in unverified AI output. Specialized tools are increasingly required to detect over-trust and monitor protocol activity. Furthermore, Stage 4 initiates the critical transition where developers evolve from primary code authors into code reviewers, a profound cultural and operational shift that demands comprehensive education.
The final tier, the Agentic phase, represents the ultimate destination for many technology organizations, but it brings with it risk profiles ranging from high and critical to extreme and maximum. As organizations climb the ladder of capability, they encounter Stage 5, characterized by single-agent operations where Command Line Interface agents independently execute workflows from start to finish. Stage 6 introduces multi-agent parallel execution, allowing AI to scale operations rapidly as multiple systems collaborate. Stage 7 takes this paradigm further with scaled agent management, while Stage 8 achieves autonomous orchestration, requiring human developers to coordinate a team of AI agents as a unified workforce. To survive and thrive in this phase, developer education must encompass strict policy enforcement, the deployment of application risk scorecards, and the meticulous tracking of code commits for auditability.
The natural progression of these stages demonstrates why establishing robust governance and a comprehensive learning curriculum early on is paramount. Without these controls, risk levels can rapidly spiral out of control as AI agents assume responsibility for increasingly complex, autonomous, and unsupervised operations. Failing to build a governance foundation from the outset can lead to severe operational and security consequences later.
Fortunately, industry analyses indicate that the vast majority of software developers currently operate somewhere between the second and fourth stages of adoption. This means it is not yet too late for organizations to implement the necessary guardrails, oversight mechanisms, and educational initiatives required to successfully navigate the Agentic Development Lifecycle.
Where to Start, How to Proceed
As has frequently occurred with previous technological revolutions, the enterprise adoption of artificial intelligence is currently outpacing the ability of organizations to secure it properly. The headlong rush toward modernization, compounded by unskilled personnel introducing unauthorized large language models into corporate networks without understanding how to perform security assessments or contextual code reviews, has left many enterprises with dangerously limited visibility. Leadership often struggles to answer fundamental questions regarding who is using AI, how they are utilizing it, and what tangible impact it is having on production code bases. Consequently, many companies are flying fast in their AI adoption while simultaneously flying blind, lacking the structural oversight, protective guardrails, and developer-level observability necessary to ensure safe deployment.
Establishing effective AI governance can understandably feel daunting to executive leadership and engineering managers alike. When confronted with the sheer breadth of the challenge, organizations frequently ask where they should begin. The most effective starting point is simply understanding where they currently stand on the maturity spectrum. Identifying their exact position allows companies to pinpoint the specific security controls and developer skill sets required for their current phase of adoption, while simultaneously preparing them for the demands of the next level.
Regardless of where any given organization currently sits on its AI journey, the next tier of capability—and its corresponding risks—will arrive far faster than anticipated.
Raul Delapena Setiawan 
Nana Muazin 
Asro