The End of DevSecOps?
summary
Argues that security belongs inside engineering workflows and shows concrete automation: a centralized SBOM database collects 15 months of SBOMs at scale, enabling a 10‑second query to locate a supply‑chain issue; open source tooling like Syft/Grype generates and scans images, while an app called Bomber normalizes SBOMs, flags transitive vulnerabilities and creates ticketable findings; threat models are autogenerated with STRIDE‑GPT and AI adds plain‑English explanations so tickets route to the responsible team without manual triage.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 5:23DevOps and DevSecOps history
- 8:36DevSecOps challenges and solutions
- 12:12SDLC system-level view
- 17:13Automation in secure code and containers
- 20:52Centralizing SBOM inventory
- 25:52Collecting and managing SBOMs
- 31:19Bomber for vulnerability scanning and AI
- 34:35Decoding CVEs for prioritization
- 39:33Threat models with generative AI
- 46:25DevSecOps next steps
- 48:14Summary
related talks
30mSecuring DevOps using OWASP DevSecOps Tools
32mDevSecOps is Dead, Long Live DevSecOps
27mMulti Security Checkpoints on DevOps Platform
06mDevSecOps is a Misnomer
45mDevSecOps : add Security to your DevOps!
23mDevSecOps - By Any Other Name
30mDevSecOps: More Than Just Pipelines
36mUnderstanding the Sec in DevSecOps: Beyond Just Shifting Left