Layer 05 · Engineer · Project or subscription
DevSecOps: Security from Commit to Production
DevSecOps is how STP makes security part of delivery and operations rather than a review at the end: checks run in the CI/CD pipeline on every change, releases are signed and verified before they run, infrastructure and Kubernetes policies are enforced as code, secrets are managed centrally, and production is watched for new vulnerabilities and misconfiguration after release.
Overview
Security that waits for a review at the end of a project finds problems when they are most expensive to fix, and finds them once. Software changes every week; a review does not.
DevSecOps puts the checks where the change happens. The pipeline scans code, dependencies, infrastructure-as-code and container images on every change, and each release is signed so the cluster can verify that what runs is what was built and tested. Policies for infrastructure and Kubernetes are written as code, reviewed like code and enforced automatically.
It continues after release. Production is scanned for new vulnerabilities in software that was clean when it shipped, configuration drift is detected, and findings go back to the team that owns the code with a priority and an owner, rather than into a report nobody reads.
It joins our DevOps and Secure SDLC work into one path: DevOps makes change routine, Secure SDLC moves findings to the developer, and DevSecOps keeps everything from commit to production secured and observed.
What is included
- Security review of existing CI/CD pipelines and who can change them
- Pipeline hardening: least-privilege runners, protected branches, reviewed changes
- Code, dependency, infrastructure-as-code and container image scanning on every change
- Dynamic testing of the running application in the pipeline
- SBOM generation and release signing, verified before deployment
- Policy-as-code for infrastructure and Kubernetes admission
- Centralised secrets management, kept out of code and pipelines
- Continuous vulnerability management in production
- Configuration drift and misconfiguration detection
- Findings routed to the owning team with priority
- Security monitoring and alerting for production environments
- Knowledge transfer so your team runs the practice
What you get out of it
- Every change checked by the same controls, automatically
- Only signed, verified releases running in production
- Vulnerabilities in running software found and owned, not left for an attacker to find
Technologies we deliver it with
- Trivy
- SAST
- DAST
- OWASP ASVS
- Terraform
- GitHub Actions
- Argo CD
- Kubernetes
Named to describe what we work in. Not a claim of partnership, endorsement or certification.
Questions
- What is DevSecOps?
- DevSecOps is the practice of building security into DevOps: security checks run automatically in the delivery pipeline on every change, policies are enforced as code, and production is monitored for new vulnerabilities and misconfiguration, so security keeps pace with how often software changes.
- How is DevSecOps different from Secure SDLC?
- Secure SDLC concentrates on development: finding flaws while code is written and reviewed, and extending that discipline to AI features. DevSecOps covers the whole path to production and what runs there: the pipeline itself, signed releases, policy enforcement, secrets and continuous vulnerability management. Most teams need both, and we deliver them together.
- Will security checks slow down our releases?
- They should not. Checks run in parallel in the pipeline, thresholds are set so that only findings worth stopping a release block it, and the rest are tracked with an owner. A gate that blocks constantly gets switched off, so tuning the thresholds is part of the work.
Standards and references
Talk to an engineer about DevSecOps: Security from Commit to Production
A live engineer calls you back within 1 hour.