DevSecOps Playbook for AI-Era CI/CD Pipelines
summary
CI/CD pipelines now ingest ~40% AI‑generated enterprise code and 78% of organizations report supply‑chain incidents, so the playbook names concrete defenses: SBOMs and SLSA provenance for traceability, policy as code enforced at commit/build/deploy, disposable container builds plus artifact signing with tools like cosign or sign store to limit blast radius, IaC hardening, runtime monitoring. Targets and metrics are explicit — detect issues in under 2 minutes, remediate in under 10, ~100% signature coverage — and those measures reduce real-world supply‑chain risk.
AI-written summary · about
chapters (12)
- 0:00Introduction and Speaker Background
- 0:20The Shift in Software Development
- 0:44AI's Role in Modern Development
- 1:25Security Challenges with AI-Generated Code
- 2:27New Threat Vectors in AI Development
- 4:32Shift Left Security Principles
- 5:35Building Trust with SBOM and Provenance
- 6:43Consistent Security Enforcement
- 7:12Hardening the Build Environment
- 9:11Monitoring and Detection
- 10:18Sustainable DevSecOps Practices
- 11:25Conclusion and Final Thoughts
related talks
33mAI in the Security Stack
41mHow to protect your CI/CD from a Supply chain attack?
38mSecuring your CI/CD Pipeline
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
35mPractical Guides for Enhancing Your Software Supply Chain Security
21mSecuring the IaC Supply Chain
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
28mStandard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar...