{
  "id": 9319064,
  "title": "Why Shift Left is Dead",
  "url": "https://urgent.news/2026/09/23/why-shift-left-is-dead",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-23T10:38:31.000Z",
  "source": {
    "name": "DevOps.com",
    "slug": "devops-com",
    "url": "https://devops.com/why-shift-left-is-dead/"
  },
  "original_language": "en",
  "account": "Shift left, once a cornerstone of secure software development, has become obsolete due to the advent of AI-driven development. First introduced in 2001, this philosophy advocated for catching issues as early as possible in the development process, streamlining downstream operations. However, AI-driven development has disrupted this approach by introducing new sources of risk that were not accounted for in shift left's design.\n\nNow, risks emerge even before any code is written, rendering shift left's reactive nature ineffective. Security teams must now be proactive, shaping and securing the environment before AI-generated code enters the pipeline. A recent survey among over 400 CISOs and security professionals revealed that nearly all organizations have AI-generated code in their systems, yet 81% lack complete visibility into how and where AI is utilized throughout the development lifecycle.\n\nThis shift in development methodology brings significant changes. AI assistants can now generate substantial code from simple prompts, increasing the volume of code that needs oversight. Autonomous agents can also perform tasks previously requiring human intervention, simultaneously accelerating development and increasing potential vulnerabilities. Checkpoint-based security controls, which traditionally review code at specific stages, may struggle to keep up with the rapid pace of AI-generated code changes.\n\nMoreover, AI agents can influence development before code reaches conventional security checkpoints, through prompts, tool use, data access, and interactions with other systems. This creates additional risks around the information provided to AI tools and the permissions granted to agents. Consequently, security must now govern AI activity throughout the entire lifecycle, not just after code is checked in. This requires extending security models to the developer endpoint, where agents access sensitive information and install files, and monitoring AI agents across the entire lifecycle, not just at predefined stages.\n\nTo address these challenges, organizations need greater visibility into the AI tools used in development, including shadow AI, which refers to unauthorized AI services. By understanding which AI tools are being used and what information they can access, security teams can implement controls to prevent malicious packages and sensitive data from being introduced via AI. These controls, known as guardrails, can block malicious installations and prevent prompts from containing secrets, among other actions.\n\nIn essence, the transition from Software Development Lifecycle (SDLC) to AI-driven Agentic Development Lifecycle (ADLC) necessitates a comprehensive, proactive security model that extends from the developer endpoint through the entire development process, ensuring AI activity is governed and monitored effectively.",
  "summary": "AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire development lifecycle.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}