Measuring DevSecOps: building metrics to understand effectiveness and success
summary
Claim: measurable DevSecOps requires a small set of SMART KPIs that track organizational outcomes, not tool hours. Implementation demo pulls Checkmarx, WhiteSource and Anchore reports into Azure DevOps pipelines and Azure Container Registry, stores results in Azure storage and visualizes trends in Power BI, showing security findings per KLOC, fix burn rate and failed-builds-from-security as actionable metrics. Key rules are measure outcomes not outputs, start with KPIs not tools and global metrics over team silos to prove value and prioritize effort.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:07WHAT IS OUR PLAN?
- 6:03DELIVERING THE APPLICATION
- 17:27WHAT: SCOPE
- 20:16WHAT: OVERALL
- 26:06KEY PERFORMANCE INDICATOR (KPD)
- 27:00EVALUATE KPL SMART
- 28:37HOW MANY KPLS DO I NEED?
- 31:37SECURITY KPLS
- 40:12SOLUTION
- 42:55FINAL THOUGHTS
- 45:15CALL FOR ACTION
