Let’s address the elephant in the room: Coding agents don’t generate secure code. Securing the AI-generated code is left as a separate activity, and it’s only part of the job. Coding agents also select dependencies, invoke tools, and execute tasks. Application security teams must govern those activities, protect the development and delivery environment, and validate the software that these coding agents produce, which can include AI applications and agents.
We published The Forrester Wave™: Agentic Development Security Tools, Q4 2026, evaluating 12 providers across 29 criteria. The evaluation examines how vendors support this broader security mandate, including AI coding guardrails and toolchain protection; finding AI-specific and semantic flaws; AI software supply chain security and application security posture management for AI; and contextual AI prioritization and autonomous remediation.
In my earlier post, Agentic Development Security: Why AppSec Needs A New Operating Model, I argued that traditional application security approach no longer suits agentic development, where still buggy AI code generation outpaces human review capabilities, AI expands vulnerability discovery, and AI turns exploitation into a commodity. This market evaluation puts that operating model into practical buying terms: What can tools prevent, what can they validate, and what still requires your team’s intervention?
Agentic Development Security Tools Must Include A Breadth Of Capabilities Around A Complex, Changing Environment
The evaluation surfaces important distinctions that buyers should investigate, such as:
- Coding guardrails must do more than validate code as it is generated. Providing security instructions to the coding agent, inspecting generated code, and blocking a risky tool call are different capabilities. Buyers should assess where enforcement happens and whether it covers local, cloud-based, and background agents. Ask vendors to demonstrate intervention in your actual agentic workflows, not just how a Model Context Protocol (MCP) server can be called by an AI coding tool.
- The coding toolchain is now part of the security scope. Models, MCP servers, skills, hooks, extensions, instructions, and tools are a new type of dependency that AI coding agents rely on. These dependencies can be vectors for attack that code scanning alone cannot govern. Require visibility into what agents use, what they can access, and which actions policies can block. An inventory is useful, but buyers also need to understand whether the tool can enforce decisions before risky actions occur.
- An AI-generated fix is not the same as validated remediation. The evaluation distinguishes between generating guidance, creating a pull request (PR), validating a change, and supporting policy-controlled automation. Strength in automating dependency updates does not guarantee strong automated code remediation where context about the application and organization practices leads to better PRs. Test both against your applications, including dependency updates that require changes to first-party code.
- Context must factor into what gets fixed first. Reachability, runtime exposure, sensitive data, business context, and compensating controls help distinguish actionable risk from another finding in the queue. Evaluate whether prioritization explains the risk and directs remediation, rather than simply producing a score. Also examine how the tool uses prior triage decisions and whether security teams can review and audit automated decisions.
- “Secure by design” for the agentic software development lifecycle is a work in progress. Few vendors support analyzing requirements and design artifacts to flag security concerns or gaps such as missing authentication, lack of auditing, or incompatible data-handling requirements. AI-driven threat modeling — that continuously assesses AI applications to surface missing controls and risky action paths, improve detection, guide remediation, and identify where human approval or guardrails are needed — was not well demonstrated by vendors, but there are likely capabilities to come.
Buy An Agentic Development Security Tool For Your Development Reality
Coding agent adoption isn’t all or nothing. Some organizations are going full steam ahead, while others are deliberately limiting where, when, and how developers can use them.
- No provider earned the highest score across all current-offering criteria. The scorecard shows different strengths across AI code analysis, AI software supply chain controls, governance, developer experience, and remediation. Start with the risks and workflows you need to control, then investigate the gaps you would need to cover through integrations or additional tools.
- Keep current capabilities separate from roadmap commitments. Our evaluation used materials provided by August 28, 2026. Because this market is changing fast, buyers should ask vendors to demonstrate what is available now and explain what remains planned, separately installed, and/or dependent on partners.
Turn The Evaluation Into Your Shortlist
Read the report, then use the accompanying spreadsheet’s “My Scores” worksheet to prioritize the criteria that matter most to your organization. Bring security and development leaders together to test shortlisted tools against the same workflows. The goal is not more findings — it’s secure agentic development with controls that your teams can trust.
If you’re a Forrester client, book an inquiry or guidance session with me if you have questions about the results.
