Getting Started with DevSecOps
A comprehensive beginner's guide - what DevSecOps is, why it matters, and how to start implementing security into your DevOps process.
What is DevSecOps?
DevSecOps is an approach to software development where security is integrated into every phase of the DevOps process. Instead of security being "bolted on" at the end of a project, it is baked in from the very beginning. DevSecOps automates security checks and makes everyone on the team responsible for security.
Why Learn DevSecOps?
- Growing demand for skills: In the 2025 ISC2 Cybersecurity Workforce Study, 59% of respondents reported critical or significant skills needs on their team and 95% at least one. The most common gaps are AI (41%) and cloud security (36%).
- Fewer vulnerabilities in production: NIST SSDF (SP 800-218) recommends building security practices into every phase of development so released software has fewer vulnerabilities and undetected ones have less impact
- Faster releases: Automated security tests do not slow down development
- Compliance: Easier compliance with regulatory requirements. In the Czech Republic, NIS2 is implemented by Act No. 264/2025 Coll., on Cybersecurity, in force since 1 November 2025. GDPR also applies, and for payment data PCI DSS v4.0.1.
Did You Know?
The current OWASP Top 10:2025 introduced two new categories: A03 Software Supply Chain Failures (expanding the former A06:2021 Vulnerable and Outdated Components) and A10 Mishandling of Exceptional Conditions. Broken Access Control stays at number one and now also covers SSRF.
Prerequisites for DevSecOps
What you should know before you start:
- DevOps basics: CI/CD pipeline, Git, Docker, cloud basics
- Linux command line: Basic terminal usage
- Programming: At least one language (Python, JavaScript, Go)
- Networking basics: TCP/IP, DNS, HTTP/HTTPS
Security prerequisites - not required!
If you do not have a security background, that is perfectly fine. DevSecOps courses typically start with security fundamentals, so you will learn everything you need from the ground up.
DevSecOps Learning Path
Recommended Learning Path
1. Security Essentials
Security fundamentals
- Types of security attacks
- OWASP Top 10:2025
- Security in Layers (Defense in Depth)
- Common vulnerabilities (SQL injection, XSS, etc.)
2. DevSecOps Fundamentals
Introduction to DevSecOps
- What is DevSecOps and why it matters
- Shift Left Security
- Security automation
- The role of a DevSecOps engineer
3. Application Security
Securing applications
- SAST - static code analysis
- SCA - dependency analysis
- DAST - dynamic testing
- Container security
4. Infrastructure Security
Securing infrastructure
- Cloud security (AWS/Azure/GCP)
- IAM and access management
- IaC security (Terraform)
- Network security
5. Platform Security
Securing platforms
- Kubernetes security
- Service mesh (Istio)
- Secrets management
- Policy as Code
Key DevSecOps Tools
Semgrep / SonarQube
Static analysis of source code to detect vulnerabilities. The open source engine is Semgrep Community Edition.
- Detection of security flaws in code
- Custom rules
- CI/CD integration
Snyk / Dependabot
Analysis of third-party dependencies and their vulnerabilities.
- CVE detection
- Automated fix PRs
- License compliance
Trivy
Scanning container images, filesystems, Git repositories and Kubernetes.
- Image vulnerability scanning
- IaC scanning
- Secret detection
Gitleaks / TruffleHog
Detection of secrets and credentials in code. According to its author, Gitleaks is feature complete and now receives security fixes only.
- Pre-commit hooks
- CI/CD scanning
- Git history scan
How to Implement DevSecOps - Step by Step
- Start simple: Add secret detection to your CI/CD (Gitleaks or TruffleHog)
- Add SAST: Semgrep or a similar tool
- Add SCA: Dependabot or Snyk for dependency scanning
- Container scanning: Trivy for Docker images
- Centralize findings: DefectDojo or a similar platform
- Define policies: What blocks the pipeline versus what is just a warning
- Measure and improve: Track metrics, reduce the number of findings
Tip for Getting Started
Do not try to do everything at once. Add one tool, let the team get used to it, then add the next. Gradual implementation is more successful than a big bang approach.
Pin Actions to a Commit SHA
Security tools are part of your supply chain too. In March 2026 attackers rewrote the version tags of the aquasecurity/trivy-action action and published a malicious Trivy v0.69.4 (GHSA-69fq-xp46-6x23). GitHub recommends referencing actions by full commit SHA instead of a mutable tag.
Next Steps
After reading this guide, we recommend:
- Learn the OWASP Top 10: Our article on OWASP Top 10
- Understand Defense in Depth: Security Best Practices
- Set up your first scan: SAST - Static Analysis
- Secure your pipeline: CI/CD Security
- Need help with implementation? Consulting for companies - new projects, existing infrastructure, and startups
Sources
- ISC2: ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow (2025 Cybersecurity Workforce Study) (December 2025)
- NIST: SP 800-218, Secure Software Development Framework (SSDF) Version 1.1 (February 2022)
- NÚKIB: Regulace a kontrola (zákon č. 264/2025 Sb., o kybernetické bezpečnosti) (October 2026)
- PCI Security Standards Council: Request for Comments: PCI Data Security Standard (PCI DSS) v4.0.1 (June 2026)
- OWASP: Introduction - OWASP Top 10:2025 (October 2026)
- Aqua Security / GitHub: GHSA-69fq-xp46-6x23, Trivy ecosystem supply chain temporarily compromised (CVE-2026-33634) (March 2026)
- GitHub Docs: Secure use reference (GitHub Actions) (October 2026)
- Aqua Security: Trivy (GitHub repository) (October 2026)
- Gitleaks (GitHub repository) (October 2026)
- Semgrep: Semgrep Community Edition (GitHub repository) (October 2026)
- DefectDojo (GitHub repository) (October 2026)