# What is Shift-Left Security?

> Shift-left security is an industry practice of moving suitable security decisions, evidence, and feedback earlier in the software or system lifecycle, closer to requirements, design, and implementation.

- Canonical URL: https://yellowcube.eu/glossary/shift-left-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The aim is to prevent avoidable defects and help the people creating a change understand and correct problems before those problems become embedded in an architecture, release, or operational dependency.

Typical examples include security requirements, threat modeling, secure design review, developer guidance, peer review, automated code and dependency checks, and fast testing in development workflows. What moves left should be selected by usefulness and fidelity, not by whether a tool can run early.

### Key points

- **Early decisions:** Identify assets, misuse cases, trust boundaries, privacy needs, dependencies, and security requirements while designs and implementation choices are still inexpensive to change.
- **Developer feedback:** Provide actionable standards, examples, review, and automated checks near the code or configuration change, with clear ownership and routes for exceptions.
- **Learning loop:** Use production findings, incidents, penetration tests, and recurring defect data to improve earlier requirements, design patterns, tests, and training.
- **Important limitation:** Shift-left security does not make late-stage validation, independent review, runtime protection, monitoring, response, or recovery unnecessary. Some behavior and risk appear only in integrated or operational environments, and early checks can be incomplete or wrong.

### Related terms

[DevSecOps](<https://yellowcube.eu/glossary/devsecops/>) · [Threat modeling](<https://yellowcube.eu/glossary/threat-modeling/>) · [Static application security testing (SAST)](<https://yellowcube.eu/glossary/static-application-security-testing/>) · [Dynamic application security testing (DAST)](<https://yellowcube.eu/glossary/dynamic-application-security-testing/>) · [Software composition analysis (SCA)](<https://yellowcube.eu/glossary/software-composition-analysis/>)

### Sources

[NIST SP 800-218: Secure Software Development Framework 1.1](https://csrc.nist.gov/pubs/sp/800/218/final) · [OWASP Software Assurance Maturity Model](https://owaspsamm.org/model/) · [OWASP SAMM: Secure Build](https://owaspsamm.org/model/implementation/secure-build/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.