Agents have hit the mainstream in software engineering, but security and governance practices aren’t evolving fast enough

Agentic AI adoption is surging in software engineering, but new research shows security is still a persistent issue for teams.

Analysis from Harness shows 87% of engineering teams have experienced an “agent-related security event” over the last year.

Harness said a key factor behind this lies in a lack of visibility and controls, while overconfidence is creating an environment where engineers overlook potentially dangerous actions.

More than three-quarters (77%) of respondents said they are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, yet fewer than half (44%) are able to verify this.

Crucially, 75% said they are confident that their agents are secure “end to end”, but respondents in this group had security incidents at nearly the same rate as those who weren’t.

Confidence in agent security has almost no relationship to actual resilience. 75% say their agents are secure end to end, but that group had security incidents at almost the same rate (88%) as the overall respondent population (87%).

Keith Mann, Field CTO and Head of Research at Harness, said these findings bear similarities to security-related issues during the early days of mobile and cloud development.

Both of these trends “went through a phase where confidence outran governance,” he said. Reaching a point of maturity in terms of governance and security took time, and that same process is unfolding in agentic development.

“Eventually the controls caught up because the underlying systems stayed predictable once you built the guardrail,” he added.

Mann noted that agents create a new risk layer for engineering teams, however, especially in terms of visibility and verification.

“Agents don't hold still in the same way. A control that worked in testing can still miss something in production because an agent doesn’t behave the same way every time,” he said.

“That's why closing this gap takes real verification. Organizations need to test whether a control actually holds up against an agent's variability, not assume it does because the control exists.”

Nipping problems in the bud

Harness warned that a concerning number of engineering teams aren’t prepared for agent-related security issues when they arise.

While 74% are confident that testing could catch a “production-impacting failure”, only 19% have a ‘gate’ in place to prevent this.

A gate is essentially a checkpoint in the software development lifecycle that blocks potentially flawed code from advancing until it meets the necessary criteria.

Similarly, in the event that something does go wrong, most couldn’t react quickly enough. More than three-quarters (76%) believe they could “disable a misbehaving agent” in under 15 minutes.

Only around one-third have a kill switch in place to rapidly shut down agents, however.

With enterprises scaling the use of agents in engineering, Harness warned that incidents will likely continue to climb. More than half (58%) have already reported an increase in production-related incidents since deploying agents, the study noted.

"The truths we found in the report are the same ones we're hearing in daily conversations with customers," said Trevor Stuart, SVP and General Manager at Harness.

"Teams moved fast to build and release agents, and are now circling back to ask how to actually govern what they've already shipped. The teams furthest ahead have already adopted a governed orchestration engine for agent changes, instead of waiting for an incident to force the question."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.