Shift-left

What it is

Shift-left means moving quality and security activities earlier in the delivery lifecycle — testing and validating in CI and on the developer’s machine, before deployment, instead of only at the end (right).

Why it exists

Catching a defect or vulnerability in code review/CI is orders of magnitude cheaper and faster than catching it in production. Shift-left reduces rework, risk, and the cost of fixing issues late.

Key ideas

• Earlier validation — static analysis (SAST), unit tests, linting, secret scanning in the commit/PR/CI stage.
• Continuous validation — every change runs the same checks, not just releases.
• Shift-left security (DevSecOps) — security gates built into the pipeline (see dev-sec-ops).
• Shift-right complements it — production monitoring/feedback still matters.

Exam notes

• Shift-left = early, automated validation (SAST/DAST/unit/secret scans) in CI.
• It pairs with compliance gates in the pipeline.

Related

static-analysis · dynamic-analysis · dev-sec-ops · compliance-gate

📘 Source: Microsoft Learn — Shift Left