Path 22: DevSecOps & AppSec Program — KashSec Academy

Move from finding individual bugs to building the program that prevents them at scale — SAST/DAST/SCA, CI/CD security, secrets & supply chain, threat modeling, and the metrics that earn leadership buy-in. 15 free lessons, advanced level, starting with "What is DevSecOps?"

Level: Advanced · 15 lessons · Free, no account needed.

Lessons in this path

  1. What is DevSecOps? — Security folded into every stage of delivery, not bolted on at the end.
  2. Shift Left vs. Shift Right — The two directions security folds into delivery, and why mature programs need both.
  3. SAST, DAST & SCA — The Core Scanning Trio — Static analysis, dynamic testing, and dependency scanning — how they fit together.
  4. Infrastructure as Code (IaC) Security Scanning — Catching cloud misconfiguration in the Terraform file, before it's ever deployed.
  5. Securing the CI/CD Pipeline — The pipeline itself is a target: secrets, permissions, and supply-chain trust.
  6. Container Image & Registry Security — Base images, scanning, signing, and registry access control.
  7. Secrets Management & Software Supply Chain — Where credentials leak, and how typosquatting and dependency confusion work.
  8. SBOM & Software Bill of Materials — Making the deep, invisible dependency tree visible and queryable.
  9. Threat Modeling in the SDLC — Finding design flaws before you write the code that has them.
  10. Security Champions Programs — Scaling a five-person AppSec team's reach across a whole engineering org.
  11. Metrics That Matter — Coverage, backlog health, and the numbers that actually earn budget.
  12. Vulnerability Management & Prioritization — Reachability, exploit maturity, SLAs, and formal risk acceptance.
  13. Building an AppSec Program from Scratch — The maturity ladder from ad hoc to optimising, and a concrete first 90 days.
  14. AppSec Tooling & Orchestration — Taming tool sprawl once a program has outgrown manual tracking.
  15. AppSec Program Capstone Lab — Design a lightweight AppSec program for a real-shaped organisation.