Gartner® Report: Best Practices to Mitigate Security Risks with Agentic Coding Tools
Agentic coding tools are transforming how software engineers work day-to-day, but securing AI-generated code remains elusive. Software engineering leaders should use the best practices in this research to mitigate the security risks of AI-generated code.
Agentic coding tools are inherently incapable of taking accountability; you and your engineers are. Accountability is what makes a human software engineer second-guess their code quality and security. Software engineering leaders are accountable for ensuring that agentic coding tools are performing as intended and are securely configured.
This report shares several insights into how to:
- Maintain accountability and ownership of AI-generated code by instituting AI software leads for business-critical, customer-facing application
- Establish policy guidelines for the safe use of AI tools in the software development lifecycle (SDLC)
- Apply a minimum viable level of security automation for agentic coding as part of the software development life cycle
Submit the form to view all the insights.
Gartner, Best Practices to Mitigate Security Risks With Agentic Coding Tools, Aaron Lord, Manjunath Bhat, March 24, 2026.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
“Legit is providing us with visibility across the entire software supply chain, which helps us minimize risk and raise analyst and engineering productivity”
“Legit significantly helps organizations to modernize application security programs by seamlessly integrating security into agile development and our modern application stack."
Global CISO
Chicago Board of Options Exchange (CBOE)“Legit helps us secure our CI/CD pipelines including tracking the security posture of different teams, addressing SDLC configuration drifts, and applying security resources where it can help us most."
VP of Security
ACV Auctions"We’re able to inventory all our SDLC systems and security tools, view developer activity, and leverage this visibility and context to remediate vulnerabilities faster."
Head of DevSecOps
Takeda Pharmaceutical Company“Legit gives us governance out of the box, and the ability to have visualization across our SDLC to improve our developer collaboration and security best practices.”
Chief Information Security Officer
Google/Mandiant
Discover more from Legit Security
.png?width=1113&height=626&name=ASPM%20-%20Legit%20Security%20-%20Featured%20Image%20Background%20(1).png)
Application Security Posture Management Platform
Legit is a SaaS security solution & ASPM platform that automates security issue discovery...
CISA SSDF Attestation
Legit provides comprehensive support for security frameworks leveraged to validate and demonstrate compliance.
Software Supply Chain Security
Legit Security | Automatically discover, analyze, and secure your end-to-end software supply chain with real-time SDLC inventory...