DevSecOps

Description

Automated code scanning (SAST), dependency analysis (SCA), and container scanning in CI/CD.

Security as Code — security policies defined and versioned as code.

Shift-left approach: vulnerabilities are found in development, not production.

Requires collaboration between development, security, and operations teams.

What people often say

• DevSecOps is not just adding tools to a pipeline — it requires cultural change.
• SAST tools produce false positives — triage by developers is needed.

Covers / does not cover

Covers

• SAST, DAST, and SCA scanning in CI/CD
• Infrastructure as Code scanning
• Automated security checks before deployment

Does not cover

• Runtime protection in production (that is EDR/WAF)
• Network segmentation and access controls
• End user awareness