// INTRODUCING THE HEALTHCHECK

Security needs to be built into how you deliver software.

Security problems typically enter long before production (e.g. an unpatched dependency, a misconfigured infrastructure template or a build step nobody checks). Assuming a penetration test before go-live will catch them is a false assumption. DevSecOps (development, security and operations) addresses this by building security checks into the delivery pipeline itself.

In the healthcheck we baseline your secure engineering maturity and demonstrate an effective DevSecOps pipeline in practice, using sample code or even yours.

You leave with an actionable roadmap for lower-risk, more secure delivery. The healthcheck is part of our engineering excellence service. As such, we can help you deliver the improvements as well as identify them.

// WHY IT MATTERS

Embedding security into software delivery is no longer optional.

Cyber threats are rising and software complexity is growing. Industry figures measure the problem in different ways; however, they all point in the same direction. Most organisations struggle to secure their development processes and the majority already have exploitable vulnerabilities in production.

70%

Of organisations struggle to secure their software development processes.

60%

Of data breaches involve unpatched vulnerabilities that could have been caught earlier.

87%

Of organisations have at least one significant exploitable vulnerability in production right now.

SOURCES: FORRESTER · PONEMON INSTITUTE · DATADOG STATE OF DEVSECOPS

// TOPICS WE'LL EXPLORE

Seven areas of your delivery pipeline

We review each stage of the path your code takes to production, in particular where the security gaps and automation opportunities sit.

01

End-to-end CI/CD pipeline design

We review your build, test and deploy stages (i.e. your continuous integration and continuous delivery pipeline) for security gaps and automation opportunities.

02

Infrastructure as Code (IaC)

We assess how your infrastructure is defined, versioned and scanned for misconfigurations before deployment.

03

Software supply chain security

Third-party dependencies and open source components should be checked continuously for known vulnerabilities. We evaluate how well yours are managed.

04

Policy as Code and compliance automation

Security and compliance policies should be codified so they are enforced and audited automatically. We explore where this is achievable for you.

05

Provenance and build integrity (SLSA)

We verify the origin and integrity of your software artefacts against SLSA (Supply-chain Levels for Software Artifacts) to guard against tampering and supply chain attacks.

06

Test automation strategies

We review how security testing is integrated into your pipeline, including static and dynamic application security testing (SAST and DAST) and dependency scanning.

07

DevOps toolchain evaluation

We assess your current tooling landscape and identify the gaps you need to close to support a mature DevSecOps practice.

// THE FORMAT

Free, expert-led and half a day

The workshop typically runs in three parts. Your engineers and ours work through it together.

PART 1

DevSecOps maturity assessment

We evaluate your current practices across pipeline security, tooling, culture and compliance and score them across multiple dimensions. This gives you a clear picture of where you stand.

PART 2

Live pipeline and codebase analysis

We run real code (sample or even yours) through a live DevSecOps pipeline to identify issues with quality, security and third-party dependencies in real time.

PART 3

Risk and roadmap review

We summarise the most important risks in your secure engineering approach and prioritise what matters most. You leave with an actionable roadmap.

// WHAT YOU GET

A clear view of your risks and where to go next

// WHO SHOULD ATTEND

Secure delivery cannot be owned by the security team alone. As such, the workshop works best with a mix of engineering, security and product roles.

Engineering managers and directorsPlatform and DevOps leadsSecurity and compliance officersArchitects and senior engineersProduct managers who own delivery

01