The index of our security fundamentals and operations series: what to learn first, how the topics depend on each other, a practice plan with legal labs you can run yourself, and links to every part from the CIA triad to zero trust.
Most DevSecOps advice starts at the pipeline: scanners, gates, signatures. The cheapest security fixes happen earlier, while a feature is still a ticket. How we add security requirements, abuse cases, a lightweight design review and security acceptance criteria to everyday planning without slowing teams down.
We added five scanners to CI and within a week developers were merging with admin override. This is the gate design we rebuilt: block only new, fixable, high-signal findings on PRs, scan everything nightly, and make exceptions expire.