DevSecOps (shift left)
DevSecOps · shift left · secure by design · secure SDLC · SSDLC · SSDF · sécurité dès la conception
An approach that builds security into every stage of developing and running software, instead of checking it only at the end, just before release.
In practice
“Shift left” means moving checks towards the start of the project: threat modelling at design time, static and dependency analysis on every change, secret detection, infrastructure-as-code checks, dynamic testing in pre-production. These automated checks run in the CI/CD pipeline and block serious issues, while developers receive alerts in the tools they already use. The most widely cited reference framework is NIST’s Secure Software Development Framework (SP 800-218). The goal is not to add hurdles but to make the safe path easier than the risky one.
Fictional case: a start-up used to discover its flaws during an annual penetration test, followed by a month of fixes. After adding SAST, SCA and secret detection to its merge requests, the next test found only two medium-severity issues, fixed within a week.
