Build a pipeline that catches vulnerabilities before they ship. This two-day course covers SAST (Semgrep, CodeQL), DAST, dependency scanning (Snyk, Trivy, Grype), container scanning, secret detection, SBOM generation, automated ASVS verification and security gate policies. You build a complete DevSecOps pipeline from scratch.
Hands-on pipeline construction. You leave with a working DevSecOps pipeline template. (Times are approximate.)
Understand the economics and practicality of finding vulnerabilities earlier in the development lifecycle. Map security activities to each phase: design (threat modeling), coding (SAST, linting), build (dependency scanning), test (DAST), deploy (infrastructure scanning), and runtime (monitoring). This module sets the framework for everything that follows.
Integrate Semgrep into your CI/CD pipeline. Write custom rules that match your application's vulnerability patterns. Cover rule syntax, metavariables, pattern operators, and autofix. Build a rule that catches your organization's most common security mistake and deploy it to the pipeline.
CodeQL treats code as data and vulnerabilities as queries. Write CodeQL queries that trace tainted input from sources to sinks. Cover the CodeQL data model, taint tracking, and how to add custom sources and sinks for your application's frameworks.
Integrate dynamic application security testing into your pipeline. Cover OWASP ZAP automation, authenticated scanning, API scanning, and how to configure scan policies that balance coverage with pipeline speed. Handle false positives without disabling the scanner.
Integrate dependency scanning to catch known vulnerabilities in your third-party libraries. Compare Snyk, Trivy and Grype on detection rate, false positives, and developer experience. Set up automated PR checks that block merges with high-severity vulnerabilities. Handle the operational reality of unfixable transitive dependencies.
Scan container images for OS-level and application-level vulnerabilities. Integrate Trivy, Grype or Snyk Container into your Docker build pipeline. Cover base image selection, multi-stage builds for minimal attack surface, and runtime scanning of deployed images.
Prevent secrets from reaching the repository. Deploy git-secrets as a pre-commit hook and TruffleHog as a CI scanner. Cover entropy-based detection, regex patterns for API keys and tokens, and how to handle secrets that have already been committed (rotation, not just deletion).
Scan Terraform, CloudFormation, Kubernetes manifests and Dockerfiles for security misconfigurations. Cover Checkov, tfsec, and KICS. Write custom policies for your organization's infrastructure standards. Integrate into the pipeline so misconfigurations are caught before they reach production.
Generate Software Bills of Materials in CycloneDX and SPDX formats. Understand why SBOMs matter for vulnerability management, license compliance, and incident response. Integrate SBOM generation into your build pipeline and store SBOMs alongside artifacts.
Map ASVS requirements to automated checks that run in CI/CD. Cover which requirements can be verified automatically (header checks, TLS configuration, dependency versions) and which require manual review. Build a pipeline stage that runs ASVS L1 checks and reports results.
Define security gates that block or warn on security findings. Cover severity thresholds, exception processes, SLA-based policies, and how to avoid gate fatigue. Implement a multi-stage gate: warn on medium, block on high, and require security review for critical.
Secure the pipeline itself. Cover secret management in CI/CD (never hardcode, use native secret stores), runner isolation, artifact signing, and supply chain attacks targeting the build system. Harden GitHub Actions, GitLab CI, and Jenkins configurations.
Given a repository with no security tooling, build a complete DevSecOps pipeline from scratch: SAST, dependency scanning, container scanning, secret detection, SBOM generation, and security gates. Verify the pipeline catches planted vulnerabilities and blocks the merge.
Review the pipeline template you take away (GitHub Actions and GitLab CI versions). Cover ongoing tuning, false positive management, and how to evolve your pipeline as your security maturity grows.
Two days building a DevSecOps pipeline from scratch. SAST, DAST, dependency scanning, container scanning, secret detection, SBOM and security gates. Pipeline template included.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.