NIST’s New Security Controls Address Agents in Software Development

Researchers at the National Institute of Standards and Technology are developing a framework to demonstrate how organizations can integrate security into the software development process to protect against cyberattacks.

The goal of NIST’s DevSecOps Practices Project is to protect the software supply chain from cyber and AI-based attacks. In recent years, the software supply chain has become an increasingly targeted attack vector across government and industry, said Michael Ogata, a computer scientist with NIST’s Applied Cybersecurity Division.

“Adversaries are no longer just probing production systems. They’re actively infiltrating developer environments and continuous build and integration runners and third-party dependencies,” Ogata said during a NIST webinar.

Putting the threat into perspective, Ogata added that attackers do not need to breach a production firewall “if they can just simply compromise an upstream dependency, or poison a build artifact, or hijack a long-lived service token.”

When adversaries gain control of a production pipeline, they inherit the trust of the build environment itself, he said.

Solving the Vulnerability Challenge

Recognizing these vulnerabilities, NIST launched the DevSecOps Practices Project in March 2025 to address a fundamental challenge: integrating security into software development without slowing innovation.

“Organizations understand the risks, but they often struggle to implement security without creating a sever operational friction and stalling developer velocity,” Ogata said.

While high-level policies define secure software development requirements, engineering teams need practical, repeatable implementation patterns, Ogata explained. To address this challenge, the project developed a risk-based approach grounded in NIST’s Secure Software Development Framework.

The project demonstrates these practices through hands-on, proof-of-concept reference architectures. By integrating real-world tools with zero-trust principles, NIST aims to provide organizations with a blueprint to evaluate and strengthen their development pipelines, Ogata said.

AI in the Mix

As organizations integrate generative AI into workflows, unconstrained model behavior presents a significant security concern, said Alper Kerman, the project’s co-principal lead at NIST’s National Cybersecurity Center of Excellence (NCCoE).

The project’s test beds prohibit generative AI from having unchecked access to development environments. SI capabilities are bound across three operational areas: planning and task management, code development and testing, and security and infrastructure.

What makes the project’s architecture secure “is that every single one of those capabilities operates within a strict zero trust perimeter,” Kerman said.

Core security controls, including strict access management and least-privilege principles, apply to all human, machine and AI actors.

These controls aim to prevent lateral movement across networks by securing identities, restricting access and protecting development pipeline activities. Additional safeguards include device posture verification, artifact and container security, and continuous diagnostics.

Guidance for AI Agents

Another goal of the project is to demonstrate how organizations can identify, authenticate and manage AI agents operating within software development environments.

“We want to be able to authorize agents. We want to be able to revoke that authorization. We want to be able to do things like collect intent and consent, and we want to be able to audit and log and go back and see what happened,” said Bill Fisher, a security engineer at NIST’s NCCoE.

Fisher said agents are transforming the software development life cycle by accelerating the speed and volume of code generation. Agents can produce code faster and in greater quantities than human developers, with their capabilities accelerating across successive development and build phases.

While traditional development phases are not disappearing, the speed of agent-driven workflows could fundamentally change how organizations approach them.

“These things are happening so fast that you might actually have to treat them like they’re one part of a process now,” Fisher said.

Keeping Humans in the Loop

Researchers are tracking a “profound shift” from assistive generative AI to agentic systems.

Kerman said NIST is developing the next version of its notional reference model to account for agentic AI, with a focus on next-generation identity and access management for autonomous agents operating in cloud environments.

Launched in September, the project’s new phase examines how agents could fundamentally reshape secure software development and the responsibilities of human developers.

“We think that agents will have an impact on the traditional develop, build and test phases. We also think that agents will fundamentally change human responsibilities,” Kerman said.

As agents take on more development tasks, humans are expected to shift toward oversight responsibilities, including planning, specification-based development, prompt engineering and skills engineering, Fisher said. Developers will also determine which tools and resources agents can access.

This shift raises new questions about where human oversight should occur throughout the development process and how organizations can ensure people retain control over critical decisions.

“What are the right decision gates, phase gates, review gates? What kind of information are agents going to be responsible to give to humans … to help humans make value add decisions inside the SDLC [software development life cycle],” Fisher said.