Definition
What DevSecOps actually is
DevSecOps is the culture, practices and automation that integrate security into every stage of the application lifecycle — from ideation to production operation — with shared responsibility between development, security and operations.
It is not "SAST inside GitHub Actions". That is a tactic. DevSecOps is the operating model that makes the tactic sustainable.
Operating model
Shift-left AND shift-right
Shift-Left
Move security to the earliest possible moment: IDE, pre-commit, pull request. Cost of correction grows 10× per phase, so the earlier, the cheaper.
- Threat Modeling on the story
- SAST + secret scanning pre-commit
- SCA on every new dependency
- IaC Security (Checkov, tfsec)
- Security tests in unit/integration suite
Shift-Right
Security does not stop at deploy. Production behaves differently: real traffic, misconfiguration, drift, third-party risk. You need runtime observability.
- Runtime Application Self-Protection (RASP)
- CSPM + CWPP + CNAPP
- Continuous external DAST
- Continuous attack surface management (ASM)
- Security chaos engineering
Measurement
7 KPIs executives understand
- 1. MTTR por severidade — time to fix Critical / High / Medium / Low. Target: Critical < 7 days.
- 2. Escape rate — % of vulnerabilities found in production that should have been caught earlier. Target: < 10%.
- 3. Pipeline coverage — % of repositories with SAST + SCA + secret scanning. Target: > 90%.
- 4. Vulnerability age — average age of open critical findings. Target: < 30 days.
- 5. Deploy frequency — DORA metric: how often we deploy safely. DevSecOps should not slow delivery.
- 6. Change failure rate — deploys that cause incidents. DORA + security.
- 7. Dependency freshness — % of dependencies within 6 months of latest. Target: > 80%.
