HAMMER: Homegrown Agent Maturity Model for Execution & Risk eBook

A five-level maturity model for finding your weakest domain, and the case for advancing it

Enterprises are building their own AI agents on platforms like AWS Bedrock, Azure AI Foundry, and Google Vertex AI, and on code frameworks. These homegrown agents read sensitive data, call tools and APIs, and act autonomously, often with little oversight. This guide gives security teams a shared language for where they stand, what good looks like at each stage, and what to ask engineering and leadership for next.

That shared language matters because sound controls can still add up to risk. Every step of an agent’s run can be permitted and logged, yet the sequence as a whole can still be harmful. And with a homegrown agent, the control generally doesn’t exist until your teams build it, so what matters is who built each control and how far it goes.

HAMMER makes that measurable. It scores seven security domains across five levels, from Blind to Adaptive, and your anchored level is your lowest domain score, because an attacker only needs one weak domain. The goal isn’t Level 5 everywhere. It’s deliberate, evidence-backed progress that engineering and leadership agree on.

What You’ll Learn

• Why homegrown agents need their own maturity model, and how the work of moving from Level 1 to Level 3 differs when you build the agent instead of buying it.
• How the seven domains, from Discovery & Inventory to Execution Visibility & Risk, describe the full agent lifecycle and the execution sequence that runs through it.
• How to score only what is backed by evidence such as runtime observation, logs, live configuration, and test results, and why claimed controls never raise a score.
• Why agent-to-agent communication creates risk that no single control owns, and how Domain 7 measures whether anyone can see and govern it.
• How to read the maturity matrix, with level-by-level descriptions and in-practice examples for every domain.
• Three ready-to-run prompts that turn your score into a prioritized action plan and a one-page brief for your CISO.

Who This Guide Is For

Security leaders and practitioners responsible for the AI agents their organizations build: CISOs making the case for budget, security architects designing the controls, and AI platform owners and engineers operating them. It’s informed by the OWASP Top 10 for Agentic Applications, the NIST AI Risk Management Framework, and established maturity-model conventions.