Shifting Security Left: Scaling Code Quality in a Regulated Landscape
summary
A regulated Australian organization moves from a fragile self‑hosted SonarQube Server to SonarQube Cloud, enforces mandatory quality gates in every CI/CD pipeline that fail builds when minimum code‑coverage or static analysis thresholds miss, and applies the same checks to IaC pipelines, using gate results as traceable audit evidence for APRA/ASIC/CPS 230. Legacy data stays read‑only and archived during migration, and scanned lines of code surge as AI‑generated code increases pipeline volume.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:40Managing Multi-Cloud Environments & DevOps Tooling
- 4:14Proving Compliance to Auditors with Automated Evidence
- 5:56Why Australian Unity Migrated to SonarQube Cloud
- 7:48Transforming Shadow IT into Enterprise Quality Standards
- 11:23Extending High-Quality Code Standards to Infrastructure as Code
- 15:32Balancing Developer Velocity with Regulatory Safety
- 18:42The Road Safety Analogy for Software Security
- 21:48A Blueprint for a "Boring" (Successful) Cloud Migration
- 24:54Managing Historical Data and Audit Requirements
- 27:06Scaling for the Explosion of AI-Generated Code
- 30:55Governance-First Approach to AI and 2026 Goals
related talks
11mLove Your Security Engineer as Yourself
46mQuality & Security Gates in Our CI⚡CD Pipelines
31mShifting Left Securely
57mShift Left Security with the Security Test Pyramid
42mContinuous Security: Integrate security tools into your DevOps Pipeline
32mAutomating Security Compliance at Scale
15mQuality Engineering Journey from Shift Left to Shift Right and Beyond
42mSecure or Insecure Code, That Is the Question