DevSecOps (Development, Security, and Operations) extends the DevOps model by integrating security practices, testing, and governance into every stage of the software development lifecycle — rather than treating security as a final gate before deployment. The core principle is "shifting security left": moving security checks earlier in the development process, where they are cheaper and faster to fix.
The problem DevSecOps addresses
In a traditional software development model, security is assessed at the end: a penetration test before a major release, a code audit before a compliance audit. This creates a fundamental economic problem: the later in the development process a security vulnerability is found, the more expensive it is to fix. A vulnerability found in a code review takes minutes to fix. The same vulnerability found in a penetration test three months later requires weeks of rework, regression testing, and re-release cycles.
DevSecOps in practice
In code: Static Application Security Testing (SAST) tools scan code for known vulnerability patterns as developers write. Secrets scanning prevents credentials from being committed to Git. Dependency scanning identifies known-vulnerable library versions.
In the pipeline: Container image scanning checks base images and application dependencies for CVEs before deployment. Infrastructure-as-Code security scanning identifies misconfigured policies before they reach production. Compliance-as-code checks validate that deployments meet regulatory requirements.
In production: Runtime security monitoring detects anomalous behaviour (a container attempting a syscall it has never made before; a process establishing an unexpected outbound connection). Admission controllers enforce security policies before any workload is allowed to run.