Let’s address the elephant in the room: coding agents don’t generate secure code. Securing the AI-generated code is left as a separate activity and it’s only part of the job. Coding agents also select dependencies, invoke tools, and execute tasks. Application security teams must govern those activities, protect the development and delivery environment, and validate the software these coding agents produce which can include AI applications and agents.

We published The Forrester Wave™: Agentic Development Security (ADS) Tools, Q4 2026, evaluating 12 providers across 30 criteria. The evaluation examines how vendors support this broader security mandate, from AI coding guardrails and toolchain protection; to finding AI specific and semantic flaws; to AI software supply chain security and ASPM for Ai; to contextual AI prioritization and autonomous remediation.

In my earlier post, Agentic Development Security: Why AppSec Needs A New Operating Model, I argued that traditional application security approach no longer suits agentic development where still buggy AI code generation outpaces human review capabilities, AI expands vulnerability discovery, and AI turns exploitation into a commodity. This market evaluation puts that operating model into practical buying terms: What can tools prevent, what can they validate, and what still requires your team’s intervention?

ADS Tools Must Include A Breadth Of Capabilities Around A Complex, Changing Environment

The evaluation surfaces important distinctions that buyers should investigate such as:

      • Coding guardrails must do more than validate code as it is generated. Providing security instructions to the coding agent, inspecting generated code, and blocking a risky tool call are different capabilities. Buyers should assess where enforcement happens and whether it covers local, cloud-based, and background agents. Ask vendors to demonstrate intervention in your actual agentic workflows, not just how a Model Context Protocol (MCP) server can be called by an AI coding tool.
      • The coding toolchain is now part of the security scope. Models, MCP servers, skills, hooks, extensions, instructions, and tools are a new type of dependency that AI coding agents rely on. These dependencies can be vectors for attack that code scanning alone cannot govern. Require visibility into what agents use, what they can access, and which actions policies can block. An inventory is useful, but buyers also need to understand whether the tool can enforce decisions before risky actions occur.
      • An AI-generated fix is not the same as validated remediation. The evaluation distinguishes between generating guidance, creating a pull request, validating a change, and supporting policy-controlled automation. Strength in automating dependency updates does not guarantee strong automated code remediation where context about the application and organization practices leads to better PRs. Test both against your applications, including dependency updates that require changes to first-party code.
      • Context must factor into what gets fixed first. Reachability, runtime exposure, sensitive data, business context, and compensating controls help distinguish actionable risk from another finding in the queue. Evaluate whether prioritization explains the risk and directs remediation, rather than simply producing a score. Also examine how the tool uses prior triage decisions and whether security teams can review and audit automated decisions.
      • Secure-by-design for the Agentic SDLC is a work in progress. Few vendors support analyzing requirements and design artifacts to flag security concerns or gaps such as missing authentication, lack of auditing, or incompatible data handling requirements. AI-driven threat modeling to continuously assess AI applications to surface missing controls and risky action paths, improve detection, guide remediation, and identify where human approval or guardrails are needed were not well demonstrated by vendors but likely capabilities to come.

Buy An ADS Tool For Your Development Reality

Coding agent adoption isn’t all or nothing. Some organizations are going full steam ahead, while others are deliberately limiting where, when, and how developers can use them.

      • No provider earned the highest score across all current offering criteria. The scorecard shows different strengths across AI code analysis, AI software supply chain controls, governance, developer experience, and remediation. Start with the risks and workflows you need to control, then investigate the gaps you would need to cover through integrations or additional tools.
      • Keep current capabilities separate from roadmap commitments. Our evaluation used materials provided by August 28, 2026. Because this market is changing fast, buyers should ask vendors to demonstrate what is available now and explain what remains planned, separately installed, and/or dependent on partners.

Turn The Evaluation Into Your Shortlist

Read the report, then use the accompanying spreadsheet’s “My Scores” worksheet to prioritize the criteria that matter most to your organization. Bring security and development leaders together to test shortlisted tools against the same workflows. The goal is not more findings. It is secure agentic development with controls your teams can trust.

If you’re a Forrester client, book an inquiry or guidance session with me if you have questions about the results.

 

Share