ADLC metrics: How to measure agentic development security | Endor Labs

Summary

Endor Labs describes ADLC metrics for agentic development, covering two surfaces: the code AI coding agents produce (insecure code, vulnerable dependencies, leaked secrets) and the actions they take (shell commands, file reads, tool calls, package installs). The guide argues that traditional AppSec metrics such as PRs scanned, total findings and scan pass rate scale with agent volume, so it recommends normalizing confirmed findings per merged change or per 1,000 changed lines.

Topics

• AI agents