Integration of security practices throughout the software development lifecycle, automating security controls in the CI/CD pipeline.
DevSecOps integrates security as part of the development process, not as a gate at the end. "Shift left" means moving security controls as early as possible in the development cycle.
| Stage | Controls |
|---|---|
| Code | SAST, secrets scanning, dependency check |
| Build | Container scanning, SBOM |
| Test | DAST, penetration testing |
| Deploy | Policy as code, admission control |
| Runtime | WAF, anomaly detection, RASP |
| Category | What it detects | Tools | When to run |
|---|---|---|---|
| SAST | Source code vulnerabilities | Semgrep, SonarQube, CodeQL | On every PR |
| SCA | Vulnerable dependencies | Snyk, Dependabot, Trivy | On every PR + daily |
| Secrets | Credentials in code | GitLeaks, TruffleHog | Pre-commit + CI |
| Container | Image vulnerabilities | Trivy, Grype | On image build |
| DAST | Runtime vulnerabilities | OWASP ZAP, Burp Suite | In staging |
DevSecOps integrates security into every phase of the development cycle, not as a final review. When vulnerability scanning, static analysis, and security policies are part of the pipeline, issues are detected when they are cheap to fix.
Culture and set of practices that unify development (Dev) and operations (Ops) to deliver software with greater speed, quality, and reliability. It's not a role — it's a way of working.
Continuous Integration and Continuous Delivery/Deployment — practices that automate code integration, testing, and delivery to production. Foundation of modern software engineering.
Practices for ensuring the integrity and security of all dependencies, tools, and processes comprising the software development pipeline.
Automated process of identifying known vulnerabilities in code, dependencies, containers, and infrastructure before they reach production.
Development practices preventing security vulnerabilities from design, including input validation, error handling, and defense-in-depth principles.
Practices and tools for securing containers throughout their lifecycle: image building, runtime, orchestration, and compliance.