# What is DevSecOps?

> DevSecOps is an operating practice that integrates security work into software development and operations instead of assigning it to a final review or a separate team.

- Canonical URL: https://yellowcube.eu/glossary/devsecops/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Developers, security specialists, platform engineers, and operators share responsibility for making risk-informed decisions throughout planning, coding, building, testing, release, deployment, and production support.

Automation is useful, but it is not the definition. A mature approach combines automated checks with secure design, threat modeling, code review, protected build systems, controlled releases, runtime visibility, incident learning, and clear ownership. Fast feedback helps teams correct defects near their source, while production evidence informs future engineering decisions.

### Key points

- **Operating model:** Define who owns each security decision, what evidence is required, how exceptions are approved, and how findings return to the team that can fix the underlying cause.
- **Common practices:** Security requirements, peer review, automated testing, dependency governance, artifact integrity, infrastructure as code review, deployment safeguards, and operational monitoring.
- **Useful measures:** Time to remediate, recurring defect classes, control coverage, exception age, release integrity, and whether incident lessons produce verified changes.
- **Important limitation:** A pipeline full of scanners can still release insecure software. Automation only evaluates what it is configured and able to observe, and poorly designed gates can create delay or false confidence.

### Related terms

[Continuous integration and continuous delivery or deployment (CI/CD) pipeline security](<https://yellowcube.eu/glossary/continuous-integration-and-continuous-delivery-or-deployment-pipeline-security/>) · [Threat modeling](<https://yellowcube.eu/glossary/threat-modeling/>) · [Secure by design](<https://yellowcube.eu/glossary/secure-by-design/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>) · [Machine learning security operations (MLSecOps)](<https://yellowcube.eu/glossary/machine-learning-security-operations/>) · [Shift-left security](<https://yellowcube.eu/glossary/shift-left-security/>)

### Sources

[NIST SP 800-218, Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final) · [NIST SP 800-204C, Implementation of DevSecOps](https://csrc.nist.gov/pubs/sp/800/204/c/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.