Measuring DevSecOps: building metrics to understand effectiveness and success
summary
Argues that DevSecOps needs measurable KPIs, not tool shopping, and demonstrates a working pipeline that collects findings from SonarQube, WhiteSource, Anchore and OWASP ZAP into Azure DevOps boards via Azure Functions, stores metrics and visualizes them in Power BI. Recommends starting with about five KPIs such as number of security findings per 2,000 LOC, mean time to remediate vulnerabilities, top recurring vulnerability types, and percent of builds failing for security checks; the demo shows these metrics tracked end-to-end.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:27What is DevSecOps
- 13:20What should be measured
- 16:28The Signs of the DevOps
- 20:15Dont start with tools
- 21:29Key performance indicators
- 24:50How many KPIs do you need
- 32:06How their code is in the practice
- 33:36How should I measure them
- 35:19Practical example
- 42:09Key takeaways
related talks
47mMeasuring DevSecOps
46mMeasuring DevSecOps: Building Metrics to Understand Effectiveness and Success
01h 00mTop 10 Metrics for Successful DevSecOps Projects
59mDevSecOps Productivity Metrics and Tools
42mData-Driven DevOps
29mMeasuring Devops Success with Pipeline Analytics
33mMeasuring Developer Efficiency in DevOps: Key Questions, Metrics, Best Practices
41mWhat Is Devsecops? Key Steps to Do It Well