Measuring DevSecOps
summary
Argues that DevSecOps needs measurable KPIs tied to outcomes not artifacts, recommends starting with about 5–6 metrics that combine DevOps measures (change lead time, deployment frequency, MTTR, change-failure rate, test coverage) and security measures (number of security findings, time to fix, recurring vuln types, failed builds from security checks). Shows proof: pipelines (GitHub/Azure DevOps) plus scanners (WhiteSource/Snyk/Black Duck) feed a Power BI dashboard she built — Azure DevOps + WhiteSource -> Power BI — which works and helped drop outdated packages 60→40 in 6 months. Emphasizes measure outcomes not output.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:55Question
- 2:08What is DevSecOp
- 5:41Why do DevSecOps
- 11:20Measuring DevSecOps
- 17:57DevSecOps Definition
- 18:47Maturity Models
- 19:18End State
- 23:09Define
- 23:57Metrics
- 27:19How many KPIs
- 29:47The Cobra Effect
- 30:52Supporting Metrics
- 32:48Common KPIs
- 37:52Tools
- 39:12Challenges
- 41:27Power BI
- 42:09Summary
- 42:30Proper KPIs
- 45:35Conclusion
related talks
51mMeasuring DevSecOps: building metrics to understand effectiveness and success
46mMeasuring DevSecOps: Building Metrics to Understand Effectiveness and Success
01h 00mTop 10 Metrics for Successful DevSecOps Projects
59mDevSecOps Productivity Metrics and Tools
39mDevOps: The Return of Security
33mMeasuring Developer Efficiency in DevOps: Key Questions, Metrics, Best Practices
30mDevSecOps: More Than Just Pipelines
27mMulti Security Checkpoints on DevOps Platform