SECAI Core · phase 9 of 15 · noun
DevSecOps
A combination of software development, security operations, and systems operations, and refers to the practice of integrating each discipline with the others.
The Explain card
- Plain English
- DevSecOps combines software development, security operations and systems operations into one integrated practice, so security is built into every stage rather than bolted on at the end.
- Example
- An AI team's pipeline scans model dependencies for known vulnerabilities, runs prompt-injection tests as part of the test suite, checks infrastructure code for misconfigurations, and blocks deployment on failures, all automatically on every commit.
- Why it matters
- AI systems change fast, with new models, prompts and data arriving constantly. Security checks that only happen at release time will always be late. DevSecOps makes them continuous.
- Hook
- Shift security left, and keep it there.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
On every pull request, the DevSecOps job in GitHub Actions runs a container scan and blocks the merge when Trivy reports a critical CVE.
How it is built
- Dev clipping development
- Sec clipping security
- Ops clipping operations
Where it came from
- Origin
- English camelCase blend formed by inserting Sec, clipped from security (Latin securitas), into DevOps, Patrick Debois's 2009 coinage from development and operations
- Entered the language
- c. 2012
- What changed
- DevOps joined development and operations after Debois's 2009 Ghent conference. Speakers then found security still arriving after release, so they slotted the clip Sec into the middle of that blend. The three capitals now mark the three jobs in pipeline order.
How it is spelled
- Pattern
- Medial capitals mark the join of clipped stems, as in DevOps, GitOps, and MLOps
- Pattern
- Ops is the clipped last syllable of operations, written with a capital when it starts a stem
- Breaks the pattern
- All-lowercase devsecops and all-caps DEVSECOPS both appear; the study spelling keeps Dev, Sec, and Ops capitalised
- Breaks the pattern
- Older writing also uses SecDevOps and DevOpsSec, which reorder the same three clips
Spelled like
- DevOps
- GitOps
- MLOps
- FinOps
Broken into chunks
-
Dev
- develop
- developer
- DevOps
-
Sec
- security
- secure
- SecOps
-
Ops
- DevOps
- GitOps
- MLOps
What it sits beside
Same subject
- MLOps engineer
- continuous integration/continuous deployment
- infrastructure as code
- security operations center
Same shape
- DevOps
- GitOps
- MLOps
- FinOps
Ops blends
- DevOps
- GitOps
- MLOps
- FinOps
Pipeline security labels
Where it sits in the deck
Phase 9: Roles, Teams, and Organisational Accountability
Governance frameworks are executed by people — introduce the human roles and organisational structures responsible for building, operating, and auditing AI systems.
