DevSecOps Guide to Bulletproof Your Development Workflow
summary
Adopts a concrete workflow: run SCA, SAST and infra checks in CI, DAST and container scans in CD, schedule slower scans, and add observability; cites ~40–50% org adoption and estimated 40–45% vulnerability rate in AI‑generated code versus ~20–25% for human code. Recommends incremental rollout, using tools that can create backlog or open PRs, automating from vulnerability finding to fixing, and enforcing establish a baseline to decide when to shift security left and when to break the build.
AI-written summary · about
chapters (22)
- 0:00DevSecOps introduction
- 1:52Security breach scenario
- 6:44Security vs time-to-market
- 7:26Origins of DevOps
- 9:33Shifting security left
- 11:16DevSecOps in 2025
- 14:23Software components to protect
- 16:07Scanning third-party libraries
- 17:52Static and dynamic testing
- 19:59Container and infra scanning
- 21:42Kubernetes scanning
- 23:10Security scans in CI/CD
- 25:56Choosing security tools
- 27:36Automating vulnerability finding and fixing
- 28:57DevSecOps challenges
- 29:20Avoid tool overload
- 30:44DevSecOps culture
- 33:11Standardizing processes
- 34:37Promoting awareness
- 35:39Sustaining DevSecOps
- 36:20Security debt handling
- 39:48Summary
related talks
37mDevSecOps Guide to Bulletproof Your Development Workflow
38mDevOps Meet Sec: Your Journey To Delivering Secure Code Fast
32mHow to fit Sec into DevOps without Security team
45mDevSecOps : add Security to your DevOps!
28mThe path to agile DevSecOps – a holistic approach of automation, orchestration and correlation
44mSecurity Practices Useful in Agile Development
42mContinuous Security: Integrate security tools into your DevOps Pipeline
27mSecurity Learns to Sprint: DevSecOps