Agentic AI in the Software Development Lifecycle (SDLC)

Julie Isdahl · pdf · 2025-11-19 Reader 🖥️

Agent Governance (Internal)Agentic AI AI-Driven Vulnerability Discovery Enterprise AI Adoption & Readiness Measuring AI Impact Talent Density

Agentic AI integrated across the software development lifecycle is a strategic transformation Telenor's technology leadership should actively sponsor and scale now, not a tooling upgrade engineering teams can adopt on their own, provided it is paired with governance, security oversight, and workforce reskilling.

practical · expository — A leadership-alignment memo: states a position (accelerate agentic AI adoption), supports it with external market statistics, and issues a call to action (leader actions, workshop nominations).

Structure

Part	Role
Purpose and executive summary	frames the memo as leadership alignment, not an engineering decision
Market insights (Gartner, Copilot revenue, Singapore government rollout, Salesforce, McKinsey, Google/Microsoft code-generation shares, Amodei's 90% prediction)	external evidence establishing momentum and urgency
Potential for Telenor (specific percentage targets: 50% faster features, 60% faster QA, 70% fewer manual deployment steps, 35% faster incident resolution, 25% cost savings)	translates external benchmarks into Telenor-specific targets
Status in Telenor (TnNorway piloting, DNA expanding Copilot, Telenor Sweden's FlowOps, Nordic strategy across 80+ product teams)	internal precedent establishing feasibility
Potential risks (amplified traditional risks, insecure training data, backdoors)	acknowledges the counter-case
Accelerating agentic support in SDLC (leader actions, reskilling, workshop)	call to action / conclusion

Key terms

agentic AI Agentic AI
AI that autonomously pursues intent, plans multi-step actions, interfaces with enterprise systems, adapts from feedback, and escalates decisions at defined thresholds — in SDLC terms, understanding requirements, proposing architectures, generating/reviewing code, running self-healing tests, orchestrating deployments, and managing incidents.
AI-native SDLC framework
A software development lifecycle with agents integrated 'across every phase,' not bolted onto one stage (e.g. just code completion).
strategic transformation (vs. technical enhancement)
A deliberate distinction used to argue that agentic AI in the SDLC requires executive ownership and company-wide sponsorship, not just a developer-tooling rollout owned by engineering.

Propositions

explicitcontestedAgentic AI integrated across the SDLC could let Telenor deliver features up to 50% faster, cut QA cycle time by 60%, eliminate up to 70% of manual deployment steps (reducing human-error incidents by 40%), resolve issues 35% faster, and save up to 25% in costs.conf: low
contradictsStop Automating Old Processes. Design New Ones Instead. · p1 — Isdahl's memo projects large, straightforward delivery/cost gains from agentic AI adoption; the HBR piece's BCG-sourced data shows enterprise AI investment scaling rapidly while only a small fraction of companies see enterprise-wide ROI — a complicating fact this memo does not engage.
explicitAgentic AI in the SDLC is a strategic transformation in Telenor's IT domain, not a technical enhancement, and therefore requires every technology leader's active engagement and executive sponsorship.conf: high
explicitcorroboratedRealizing the benefits of agentic AI requires reskilling developers away from traditional coding skills toward problem decomposition, systems thinking, communication, collaboration, and continuous learning.conf: medium
supports ←Gene Kim on Vibe Coding - Part III | Episode 412 | Troubleshooting Agile · p5 — Both identify the same reskilling target — decomposition and delegation over raw coding — as the actual bottleneck skill for realizing agentic AI's benefits.
explicitAgentic AI does not remove traditional software risks (flawed logic, architectural weaknesses, malicious code insertion) and can amplify them, because agents trained on large public code repositories may inherit insecure practices absent robust human oversight.conf: high
explicitAI-driven security agents can continuously scan for vulnerabilities, detect anomalies, and identify threats including zero-day exploits faster than manual review, and Telenor is already using such agents to monitor and protect core systems.conf: low
supportsGoogle Mantis: An Agentic Vulnerability Scanning Harness for Reducing False Positives · p1 — Mantis is a concrete, specified example of exactly the kind of AI-driven vulnerability-scanning agent this memo asserts Telenor is 'already leveraging' in more general terms.
implicitThe memo's case for urgency rests on treating externally sourced, largely vendor- or analyst-produced market statistics (Gartner's market forecast, GitHub Copilot's own revenue/user figures, McKinsey's process-acceleration estimate, Anthropic's CEO predicting up to 90% AI-generated code) as sufficient evidence that similar gains are achievable specifically within Telenor's codebase, regulatory context, and workforce.conf: medium
extendsChatGPT Just Became A Work Agent · p9 — This memo is a concrete, internal-facing instance of the general pattern that extraction names: vendor-reported productivity statistics (here, GitHub Copilot's own revenue/user figures and Gartner's market forecast) being treated as sufficient evidence to justify adoption decisions.

Arguments

Telenor's technology leadership should accelerate and scale agentic AI adoption across the SDLC now, under strong governance and with executive sponsorship. strength: low

Explicit premises:

External market and vendor benchmarks (Gartner, GitHub Copilot, Singapore government, Salesforce, McKinsey, Google, Microsoft) show double-digit to triple-digit productivity and cycle-time gains from agentic AI in software delivery.
Telenor already has early pilots underway (TnNorway, DNA's Copilot expansion, Telenor Sweden's FlowOps) and a Nordic strategy to scale to 80+ product teams, showing internal feasibility.
Traditional and amplified security risks from coding agents can be mitigated through governance, human oversight, and continuous security scanning — which Telenor is reportedly already doing for core systems.

Implicit premises:

Productivity and cycle-time gains measured in other companies' codebases, workforces, and regulatory environments (a Singapore government agency, Salesforce, Google) will transfer comparably to Telenor's own stack and telco-specific constraints.
The reskilling program described only in general terms (problem decomposition, systems thinking) will be sufficient to prepare the existing workforce without material attrition or capability gaps.
Executive sponsorship and governance, as described, are sufficient to prevent the stated security risks from materializing at scale.

Inferences:

If the external benchmarks don't transfer cleanly, the specific Telenor percentage targets (50% faster features, 60% faster QA, etc.) are more aspirational than load-bearing, and leadership decisions anchored to them could be miscalibrated.

Narratives

Telenor Sweden's FlowOps initiative, embedding AI agents throughout the product lifecycle within the eONE ecosystem, targeting a 50% improvement in deployment frequency and a 20% increase in employee satisfaction, as part of a Nordic strategy to scale agentic AI across 80+ product teams.
→ Serves as the memo's one piece of internal (rather than external-benchmark) evidence that agentic AI adoption is already happening and can scale within Telenor specifically.

Questions addressed

✅ Should Telenor's technology leadership accelerate investment in agentic AI across the SDLC?
Yes — with executive sponsorship, governance, reskilling investment, and a planned cross-business-unit workshop to coordinate adoption.
✅ What security risks does agentic AI introduce into the SDLC, and can they be managed?
Risks (amplified flawed logic, insecure training data, backdoors) are named and judged manageable through governance, oversight, and continuous scanning — though the argument for sufficiency is asserted rather than demonstrated.
⭕ Do the cited external benchmarks (Gartner, McKinsey, Singapore government, Salesforce, GitHub Copilot) actually apply to Telenor's specific codebase, regulatory environment (critical telecom infrastructure), and workforce?

Gaps

incompleteThe Telenor-specific percentage targets (up to 50% faster feature delivery, 60% faster QA, 70% fewer manual deployment steps, 35% faster incident resolution, 25% cost savings) are presented immediately after a list of external, unrelated-company benchmarks with no connecting data, pilot results, or methodology from Telenor's own TnNorway, DNA, or FlowOps pilots to substantiate that these particular numbers are achievable locally rather than aspirational extrapolations.
Read next: Any internal Telenor pilot retrospective or FlowOps results readout, if one exists, would be the natural next read to check these targets against measured outcomes.
uninformedNearly every external statistic cited (GitHub Copilot's $600M revenue and 15M users, Gartner's 2028 market forecast, AWS and Microsoft named as workshop partners, Anthropic CEO's 90%-AI-generated-code prediction) comes from a vendor or analyst with a direct commercial stake in agentic AI adoption, and the memo does not discuss this conflict of interest or seek independent corroboration.
Read next: extract-ai-daily-brief-chatgpt-work-agent#p9 (vendor-reported productivity claims treated as adequate evidence) names the same general pattern this memo instantiates.
incompleteThe reskilling plan ("problem decomposition, systems thinking, effective communication, collaboration, and continuous learning") has no concrete program, timeline, budget, or success metric, and the memo is silent on what happens to developers whose skills or roles don't successfully transition — a displacement/attrition risk this corpus repeatedly surfaces elsewhere when AI reshapes engineering roles.
Read next: extract-engineering-manager-role-splitting-in-two and other corpus pieces on role flattening/displacement under AI adoption.
uninformedThe claim that Telenor is 'already leveraging' AI-driven security agents 'emulating best practices from leaders like Google and Microsoft' gives no specifics on what these agents actually do, what they have caught, their false-positive rate, or how they are governed — making the risk-mitigation claim unverifiable as stated.
Read next: extract-google-mantis-vulnerability-scanning for a concretely specified example of what a comparable AI security-agent system actually looks like in practice.