The eight stages
🧭 Stage 1: Plan
Decide what 'secure' means for this feature before writing code.
Stops: Insecure design · Missing authorization rules · Unclassified sensitive data
Tools: OWASP Threat Dragon, Microsoft TMT, whiteboard + STRIDE; Jira/Azure Boards templates with security acceptance criteria; Data classification, privacy impact (DPIA)
⌨️ Stage 2: Code
Catch flaws and secrets while the developer is still typing.
Stops: Hard-coded secrets · Injection flaws · Insecure patterns copied from the internet
Tools: gitleaks, detect-secrets, GitHub push protection; Semgrep, SonarLint, CodeQL; Required reviewers for auth, crypto and infra code
🏗️ Stage 3: Build
Make the pipeline itself trustworthy and its outputs verifiable.
Stops: Compromised third-party action · Stolen CI secrets · Tampered build artifacts
Tools: GitHub/GitLab/Azure DevOps OIDC to AWS, Azure, GCP; Actions pinned to SHA, Dependabot, Renovate; Syft, CycloneDX, SLSA generators, cosign attest
🧪 Stage 4: Test
Automate security testing with gates that block only what matters.
Stops: Vulnerable dependency shipped · Misconfigured infrastructure · Runtime flaw missed by static tools
Tools: CodeQL, Semgrep, OSV-Scanner, Snyk; Checkov, tfsec, Trivy, Grype; OWASP ZAP baseline, Burp Enterprise
📦 Stage 5: Release
Only ship artifacts you can prove are yours and unchanged.
Stops: Unsigned or swapped image deployed · Direct pushes to production · No audit trail
Tools: cosign, Notation, Sigstore; ECR, ACR, Artifact Registry, Harbor; Protected environments, change records
🚀 Stage 6: Deploy
Deploy with policy guardrails so insecure configs can't reach production.
Stops: Privileged container scheduled · Public storage created · Configuration drift
Tools: Kyverno, OPA Gatekeeper, Azure Policy, AWS SCPs; Kyverno verifyImages, Connaisseur; Key Vault CSI, External Secrets, HashiCorp Vault
⚙️ Stage 7: Operate
Keep running systems hardened, patched and least-privileged.
Stops: Unpatched exploited CVE · Over-privileged service accounts · Posture drift
Tools: KEV/EPSS prioritisation, auto-patch base images; Managed identities, IRSA, PIM; Defender for Cloud, Security Hub, Prowler
📡 Stage 8: Monitor
See attacks in progress and feed lessons back into the pipeline.
Stops: Crypto-miner running unnoticed · Attacker using a stolen pipeline token · Same incident repeating
Tools: Falco, Defender for Containers, GuardDuty; Sentinel, Splunk, Wazuh, Sigma; Post-incident reviews → tests, policies, backlog
Who it's for
Developers, DevOps and platform engineers, cloud engineers and security engineers who want to build security into pipelines rather than bolt it on.
What you'll be able to do
- Threat-model features and write security acceptance criteria.
- Stop secrets leaking with pre-commit scanning and push protection.
- Replace stored cloud keys with OIDC federation and pin third-party actions.
- Gate builds on SAST, SCA, IaC and container findings without drowning teams.
- Sign and verify artifacts, enforce policy as code, and detect runtime threats.
Frequently asked questions
Is the DevSecOps course free?
The first three stages are free. Pro unlocks all eight stages, the game, the maturity assessment and the capstone certificate.
Which tools are covered?
gitleaks, Semgrep, CodeQL, Trivy, Checkov, Syft, cosign, Kyverno, OPA Gatekeeper, Falco and more.