Innovate Faster Than the Threat: A Practical Introduction to DevSecOps
Asher Best • June 25, 2026
A Brief Introduction of DevSecOps
Imagine you receive a call at 3am to learn that an unknown vulnerability has been exploited in one of your public facing web applications. You learn that this web application was primarily developed using AI-assisted code generation tools. This wasn’t a zero-day—a software vulnerability that is unknown to both the vendor and the public—but rather a publicly known and catalogued vulnerability that could have easily been caught through code review and automated tooling. After you and your team implement and deploy a patch to eradicate the vulnerability, a postmortem leads you to research ways in which you could have prevented this occurrence in the future. You discover a methodology known as DevSecOps (Development, Security, Operations).
What DevSecOps Is, Why It Matters, and What This Article Covers
It’s no secret that artificial intelligence (AI) has encroached into almost every business function. One of the main areas that AI particularly excels at is code generation for developers. “GitHub reports that Copilot improves developer productivity by approximately 55% and increases developer confidence by up to 85%.1 However, does increased productivity and developer confidence mean less security vulnerabilities overall? Schreiber and Tippe published a study in October 2025 where they analyzed AI-generated code from public GitHub repositories to identify the prevalence of CWE (Common Weakness Enumeration) and CVE (Common Vulnerabilities and Exposures) known security flaws produced by several AI tools such as ChatGPT, GitHub Copilot, Amazon CodeWhisperer, and Tabnine. What they found was that out of the 7,117 files they analyzed, 861 (12.1%) files contained at least one CWE-mapped vulnerability, 4,241 distinct CWE occurrences, and 77 distinct CWE types. Four of these CWEs appear in MITRE’s 2024 Top 25 Most Dangerous Software Weaknesses list.1 These findings illuminate the necessity of innovative approaches to combat against the risks that these AI tools pose. One such innovative approach, known as DevSecOps, aims to ensure code—whether created by people, AI, or a combination of the two—is properly secured without impeding the software development lifecycle (SDLC).
DevSecOps is a paradigm shift that “integrates security into the DevOps (Development, Operations) process and software development lifecycle (SDLC) from the outset.”2 According to conflicting sources, the term DevSecOps is most commonly credited to Shannon Lietz, but some attribute its emergence to Andrew Clay Shafer and Patrick Debois in 2009. Despite its origins, DevSecOps has fundamentally changed the way we approach incorporating security into each phase of the SDLC from planning to release, especially as software demands continue to change with AI-accelerated software engineering. With the corporate cultural shift demanding decreased time-to-market for Software-as-a-Service (SaaS) solutions coupled with the emergence of AI-generated code, integrating security early and often into the DevOps pipeline is now more critical than ever for organizations in order to mitigate risks of reputational damage and costly remediation efforts.
The purpose of this post is twofold. I argue the necessity of every organization to appoint one or more DevSecOps champions to incorporate DevSecOps practices and tooling into their DevOps pipelines to combat the potential increase of security flaws brought forward by AI-generated code and the shortened time-to-exploit (TTE) window for threat actors using AI-accelerated reconnaissance. Additionally, it serves as a practical introduction to common DevSecOps practices and tools that organizations should consider factoring into their technology budget. This post covers the DevSecOps mindset, culture, processes and tools as well as ways in which AI can be leveraged to supplement the DevSecOps pipeline.
The DevSecOps Mindset and Culture
Security as a Shared Responsibility
One of the core tenets of DevSecOps is that security is a shared responsibility by all members of the organization and not only technology personnel. The DevSecOps mindset means treating security as a first-class organizational concern and not as an optional add-on. For security to be successful, it is vital to identify and encourage security champions within all different departments to be advocates for security best practices. This is achieved through transparency, security awareness training, and promoting a culture of continuous improvement. Ultimately, DevSecOps seeks to not only master the tools and processes but also promote security awareness and build a culture of security in every action the organization takes.
Shifting Left and Right
The shift-left approach seeks to incorporate security early and often into the SDLC from the beginning. By embedding security early, organizations can proactively address vulnerabilities while fostering a culture of shared responsibility between development, operations, and security teams.3 As result, teams can resolve vulnerabilities prior to production deployments, effectively reducing the cost and effort of late-stage, post-production fixes. The shift-right approach supplements (rather than replaces) shift-left through continuously monitoring and managing live production environments for vulnerabilities and key performance metrics. Shift-left and shift-right can be achieved through threat modeling, vulnerability management, least-privilege principles, and automated security testing.
Automation at its Core
Automation can make the hassle of vulnerability management, code review, testing, and reporting more efficient by building security directly into workflows through automated security toolchains. Automated security workflows prevent security from becoming a bottleneck to the DevOps pipeline. According to a study by Shafin et al. on how faster release cycles impact security flaws, artifacts with faster release speeds tend to have fewer CVEs in their dependencies and frequent updates allow projects to adopt secure versions, reducing vulnerability exposure.4 The last thing you want is security processes slowing down this effort. Security automation allows teams to focus on core development while automated tools identify security weaknesses in the technology stack that can be prioritized for further review, and in certain cases especially with AI-assisted security tools, be proactively remediated.
DevSecOps Processes and Technologies
Pre-Commit Hooks
Pre-commit hooks are vital for preventing hardcoded secrets and keys from being committed to remote code repositories. This is especially critical for public and open-source repositories as exposed keys and secrets mean that bad actors can access your information systems via APIs (Application Programming Interfaces), SDKs (Software Development Kits), and/or other methods. Tools such as Pre-Commit and Detect-Secrets can help support this effort. They work by scanning codebases when a developer attempts to commit code to a remote repository and stopping the commit if the criterion for failure is flagged.
Vulnerability Scanning
Static Application Security Testing (SAST)
Static Application Security Testing, or SAST for short, analyzes code for security vulnerabilities without actually running the code during code review. The risks associated with lack of SAST implementation in your pipelines means that insecure coding practices, software vulnerabilities, and personally identifiable information (PII) can slip by code reviews and make their way into production applications, potentially exposing these vulnerabilities and information to public infrastructure. Tools include, but are not limited to, SonarQube, CodeQL, and Bearer.
Dynamic Application Security Testing (DAST)
Dynamic Application Security Testing, or DAST for short, attempts to find security vulnerabilities and weaknesses in running applications by injecting malicious payloads to identify potential flaws that allow for attacks such as SQL injection and cross-site scripting (XSS).5 DAST allows you catch vulnerabilities that a bad actor might try to exploit at runtime before the application is available in production. Tools include, but are not limited to, OWASP Zed Attack Proxy (ZAP) and Burp Suite.
Software Composition Analysis (SCA)
Software Composition Analysis, or SCA for short, analyzes third-party dependencies, modules, and packages within codebases against vulnerability databases. This can aid in preventing risks such as supply chain attacks. Developers know firsthand that third party modules can quickly become outdated and become a burden if not managed and updated properly. SCA enables teams to catalogue a list of these known third party vulnerabilities and decide which are the highest severity risks to their specific technology stacks. Tools include, but are not limited to, Snyk and OWASP DependencyCheck.
Infrastructure Vulnerability Scanning
Infrastructure vulnerability scanning assesses computers, networks, and applications for known weaknesses. The scanners are typically deployed as agents to assets such as endpoints, servers, firewalls, routers, web applications, and cloud infrastructure. The findings are sent back to a unified vulnerability management solution for further review, prioritization, and reporting. By collecting and aggregating vulnerabilities into a single observability solution, teams can deduplicate repeat findings from multiple systems and apply filters to reduce the noise that these systems quickly generate. Tools include, but are not limited to, Nessus, Nikto, and CrowdStrike.
Container Vulnerability Scanning
Containers, such as Docker, are widespread throughout the technological landscape today and have become an increasingly important technology for DevOps Engineers and Security Engineers to implement and secure. Containers are a means to ship applications and microservices that enable compatibility and reproducibility across different operating systems and environments. As containers continue to proliferate throughout cloud and Kubernetes deployments, it becomes increasingly important for security teams to scan their containers for outdated container images, vulnerable libraries, and insecure configurations such as root user access.5 Tools include, but are not limited to, Trivy and Clair.
Privacy and Compliance
Privacy ensures that personally identifiable information (PII) such as names, emails, IP address, biometrics, and much more, are protected by whoever is handling this sensitive information and that organizations are in compliance laws and regulations such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act).5 Industry standards such as SOC2 (System and Organization Controls 2), NIST (National Institute of Standards and Technology), and CIS (Center for Internet Security) can aid in assessing and improving the security posture of an organization. Proper privacy and compliance practices increase the probability that your organization will protect itself from the reputational and financial damage that is incurred from data breaches.
The Role of AI in DevSecOps
A Brief Note on AI Risks and Ethics
As mentioned at the beginning of this article, AI-optimized DevOps workflows are improving and accelerating software delivery yet can introduce new vulnerabilities. There are also ethical and security considerations for AI in the DevOps lifecycle such as data privacy, consent/data usage (GDPR, CCPA), and humans-in-the-loop (HITL). It goes without saying that a human should always be validating and tuning the actions and outputs of AI systems. Therefore, it is increasingly important to consider these risks not only when incorporating AI tooling into these workflows but also when implementing AI as a combatant to these AI-produced security risks.
Ways AI Can Be Supplemented into DevSecOps Workflows
With that caveat out of the way, AI can be a useful tool in the security toolchain and further enhance DevSecOps workflows. Since there are numerous ways to incorporate AI into DevSecOps workflows and could stand as a blog post all on its own, I will provide a specific use case and example for intelligent code review then list out the various ways AI can be integrated to give you a foundation for further research.
For AI-assisted intelligent code review, Atlassian has an AI agent called Rovo Dev that can be activated in your Bitbucket repositories to automatically review code and provide suggestions when pull requests are created. Additionally, you can incorporate AI agents that allow API access (such as ChatGPT, Claude, etc.) directly into your CI/CD pipelines to achieve the same effect. Just be sure to review privacy guidelines from your AI provider as you don’t want to risk sensitive data exposure to the third parties.
Beyond intelligent code review, AI can be incorporated to supplement the DevSecOps workflow in a myriad of ways: predictive analytics, automated test case generation, intelligent test prioritization (risk management), anomaly detection, automated configuration management (configuration drift), monitoring/observability (availability), and predictive maintenance. Additionally, AI can be used within the DevSecOps lifecycle through development monitoring (Git, Jira, SonarQube, Ansible), secure application delivery (prohibited code, backdoors, copyright violations), triage analytics/troubleshooting (risk prioritization, heuristics, automatic incident response ticket creation), an anomaly detection.6
In short, AI as a security enhancer can help reduce noise in findings, detect anomalies, analyze logs, conduct forensics, gather threat intelligence, and automate remediation workflows. This is especially prevalent today for cloud security and software-as-a-service (SaaS) solutions.
Final Thoughts on DevSecOps and AI
AI is accelerating software delivery but comes with certain risks that need to be addressed as soon as possible to identify and remediate risk before they permanently damage company reputation and incur significant costs as a result. DevSecOps is not only a set of procedures and tools but also a cultural shift and state-of-mind that can mitigate security vulnerabilities proliferated by AI and other sources before they become a bigger problem.
As AI continues to scale throughout technology and business sectors alike, it becomes increasingly important to apply more innovative approaches to combat the negative consequences brought forth by preceding innovations and to do so with greater speed and urgency. As Geoffrey West argues in his book Scale: The Universal Laws of Life, Growth, and Death in Organisms, Cities, and Companies, we must not only remain inventive to stay abreast of impending threats through more ingenious innovations but we also must innovate at a faster and faster rate—meaning the time between successive innovations has to get shorter and shorter.7
I urge every individual contributor and leader, whether working in a technology role or otherwise, to adopt the DevSecOps methodology and become a security champion within your organization as an antidote to combating inevitable threats that every organization experiences. It is important to remember that security is a process—not a one time solution—and the overarching goal is to continuously improve upon your organization’s security posture incrementally over time to reduce as much risk as your organization is willing to tolerate (risk appetite). DevSecOps paired with AI is a means to ensure your systems are not only secured from end-to-end but also to decrease the time-to-remediation of risks your organization faces so that you can beat the bad actors before they beat you.
Footnotes
1Schreiber, M., Tippe, P. (2026). Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories. In: Han, J., Xiang, Y., Cheng, G., Susilo, W., Chen, L. (eds) Information and Communications Security . ICICS 2025. Lecture Notes in Computer Science, vol 16219. Springer, Singapore. https://doi.org/10.1007/978-981-95-3537-8_9
2Gonzalez, C. (2023, November 21). DevSecOps best practices: how to secure your pipeline. DevSecOps best practices: how to secure your pipeline. https://www.intruder.io/blog/devsecops-best-practices
3Maayan, G. D. (2024, February 27). Securing the DevOps Pipeline: Tools and Best Practices. Securing the DevOps Pipeline: Tools and Best Practices - DevOps.com. https://devops.com/securing-the-devops-pipeline-tools-and-best-practices/
4Shafin, M. S., Rabbi, M. F., Hasan, S. M., & Zibran, M. F. (2025, April). Faster releases, fewer risks: A study on maven artifact vulnerabilities and lifecycle management. In 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR) (pp. 275-279). IEEE. https://arxiv.org/abs/2503.24349
5The OWASP Foundation. (n.d.). OWASP DevSecOps Guideline. OWASP DevSecOps Guideline | OWASP Foundation. https://owasp.org/www-project-devsecops-guideline/
6Aseem Mankotia, Rohith Chinnaswamy, Sara Venkatachalam, "Securing DevOps Pipelines in the Age of AI: Comparative Insights and Best Practices," International Journal of Computer Trends and Technology (IJCTT), vol. 73, no. 7, pp. 98-100, 2025. Crossref, https://doi.org/10.14445/22312803/IJCTT-V73I7P112
7West, G. (2017). Scale: The Universal Laws of Life, Growth, and Death in Organisms, Cities, and Companies (pp. 417-418). : Penguin Books.