SECAI Core · phase 9 of 15
DevSecOps
A combination of software development, security operations, and systems operations, and refers to the practice of integrating each discipline with the others.
The Explain card
- Plain English
- DevSecOps combines software development, security operations and systems operations into one integrated practice, so security is built into every stage rather than bolted on at the end.
- Example
- An AI team's pipeline scans model dependencies for known vulnerabilities, runs prompt-injection tests as part of the test suite, checks infrastructure code for misconfigurations, and blocks deployment on failures, all automatically on every commit.
- Why it matters
- AI systems change fast, with new models, prompts and data arriving constantly. Security checks that only happen at release time will always be late. DevSecOps makes them continuous.
- Hook
- Shift security left, and keep it there.
Where it sits in the deck
Phase 9: Roles, Teams, and Organisational Accountability
Governance frameworks are executed by people — introduce the human roles and organisational structures responsible for building, operating, and auditing AI systems.
