Four levels for architecting security into the agentic SDLC

AI coding agents are rewriting how software gets built, and AppSec teams are under pressure to keep up without losing control of quality, cost, or trust. This playbook gives you a practical map, organized into the following sections:

• Why AppSec needs a map: Why one engineer’s working agent rarely survives the jump to an enterprise program, and how token economics change everything at scale.
• The model at a glance: Four levels of AI maturity across two tracks, Secure (the code your developers’ agents write) and Defend (AI doing your team’s security work).
• Where are you today? An eight-question self-assessment that places your program on each track based on evidence, not optimism.
• Level 1, Governed generation: How to get visibility and control over coding agents and deliver security guidance as code is written, without falling into the paper governance trap.
• Level 2, Agentic security tools: What purpose-built agents for finding, triaging, and fixing vulnerabilities should deliver, and why verified findings matter more than more findings.
• Level 3, Custom security skills: How your team can encode its own policies and triage rules into skills with evals, and the design decision that sets your token costs.
• Level 4, Orchestrated security agents: How specialized agents work as a governed system, with autonomy earned per agent and per action through promotion gates.
• Build, buy, or both? A five-question test to decide where your engineering time and budget should go at every level.
• The trade-offs: The costs teams most often underestimate, from maintenance and lock-in to the erosion of your team’s own skills.
• Your first 90 days: A phased plan to establish your baseline, measure what you’ve bought, and ship your first custom skill.
• Appendix: A mapping of the four levels to AWS, Cloud Security Alliance, and developer-side autonomy frameworks.

Whether your developers’ agents are still on personal accounts or your team is already building its own skills, you’ll leave with a clear picture of where you stand, what it takes to move up, and the numbers to back your next build-or-buy decision.