DevSecOps
12 articles
Balancing Security Debt Against Feature Velocity
Security debt accumulates the same way technical debt does, but it's usually invisible until an incident forces the reckoning. Here's how to manage it as a first-class prioritization problem.
Threat Modeling for Engineering Teams
Threat modeling is the one security practice automated scanning can't replace, because it catches design flaws before a single line of code exists. Here's a lightweight way to run it.
Secrets Management: Keeping Credentials Out of Code
A hardcoded API key in a git repository is one of the highest-confidence, most preventable security findings there is. Here's how to build secrets management that actually gets used.
Measuring the ROI of a DevSecOps Program
Findings count is an easy metric and a bad one. Here's a practical framework for measuring whether a DevSecOps program is actually working, in terms a CFO or CTO will accept.
Making Security Findings Actionable for Developers
A vulnerability report full of CVE numbers and CVSS scores rarely gets fixed quickly. Here's what actually makes a security finding actionable to the engineer who has to fix it.
Infrastructure as Code Security Scanning
A misconfigured cloud resource defined in Terraform is a security bug like any other — and it can be caught before it's ever applied. Here's how IaC scanning works and where it falls short.
Dependency Scanning and Software Supply Chain Risk
Most modern applications are mostly someone else's code. Here's how dependency scanning works, its real limits, and what a mature supply chain security program adds on top.
Building a Security Champions Program in Engineering
A security champions program can multiply a small security team's reach across engineering, or become a title with no substance. Here's how to build one that works.
Security Gates: When to Block a Release
Blocking every release on every finding kills velocity; blocking on nothing lets risk accumulate. A practical framework for deciding what actually stops a deploy.
Integrating Security Scanning Into CI/CD Pipelines
A practical guide to wiring SAST, dependency, secrets, and container scanning into a CI/CD pipeline without turning every build into a bottleneck.
Shifting Security Left Without Slowing Down Engineering
Shift-left security often becomes shorthand for more friction earlier. Here's how to move security checks upstream while keeping engineering velocity intact.
What Is DevSecOps, Really
DevSecOps gets used as a label for almost any security automation. Here's a grounded definition, the three shifts that actually matter, and where teams get it wrong.