DevSecOps

What it is

DevSecOps is a culture and set of practices that embeds security into every stage of the DevOps lifecycle instead of treating it as a separate, last-minute phase. It is DevOps applied to security: development, operations, and security teams share responsibility for shipping software that is fast and secure.

Why it exists

Traditional security was a “gate” at the end of delivery (security reviews just before release), which slowed DevOps down and surfaced problems too late to fix cheaply. DevSecOps makes security a first-class, continuous activity — automated, code-based, and run by the same pipeline that ships features — so vulnerabilities are found early (the shift-left principle) when they cost the least.

Key ideas

• Shift-left — move testing and security checks earlier in the delivery pipeline (set up, code, build) rather than deferring to a release review.
• Security as code — policies, scan configs, and gates are defined in the repo and run in CI/CD, not maintained by a manual checklist.
• Automated scanning pipeline — run multiple scans on every build:
  • SAST on the source (CodeQL, SonarQube).
  • DAST against the running app (OWASP ZAP).
  • SCA / dependency scanning on components.
  • Secret scanning for leaked credentials.
  • Vulnerability monitoring of packages.
• Shared responsibility — developers own security of the code they write; security engineers enable tools, policies, and guidance; operations ensures secure platforms.
• Continuous compliance — security gates run continuously, so compliance is demonstrated by the pipeline, not by an audit at the end.

How it fits

DevSecOps is the rationale that connects all the code-security tools in this learning path: the automated scanners, compliance gates, and signing/validation steps are the implementation of a DevSecOps culture. It pairs with platform-side checks in other paths (secure CD, identity/rbac) to protect the whole value stream.

Exam notes

• DevSecOps = security embedded throughout, not added at the end; shift-left is the memorized motto.
• Security must be automated in pipelines and continuous, not a single manual review.
• Distinguish DevSecOps (culture/process for the code) from the individual tool categories that execute it (SAST vs DAST vs SCA).
• Expect exam scenarios where the “fastest / correct” answer is to add an automated security scan + gate to the build rather than a manual release checkpoint.

Diagram

Related

static-analysis · dynamic-analysis · software-composition-analysis · dependency-vulnerabilities · secret-scanning · compliance-gate · code-signing

📘 Source: Microsoft Learn — Dev Sec Ops