Presented by Carahsoft
DevSecOps has evolved from a specialized software-development practice into a critical foundation for government modernization and mission delivery. Recorded at the Carahsoft DevSecOps Conference, this episode of Innovation in Government explores how federal technology leaders are using artificial intelligence, automation, platform engineering, open architectures and continuous security to deliver capabilities faster without losing control of risk. The program examines how agencies are adapting DevSecOps for agentic AI, organizing teams around mission outcomes, modernizing acquisition through digital engineering, strengthening the software supply chain and creating the continuous visibility needed to improve cyber resilience.
Chaudhry points to autonomous safety features in commercial vehicles as an example. Automatic braking, lane controls and collision avoidance can improve everyday safety, but those same safeguards may interfere with police vehicles, ambulances or fire trucks responding to emergencies. First responders may need to cross a median, travel against traffic or make contact with another vehicle. Autonomous systems therefore need trusted mechanisms for shifting into a different operating and risk model under clearly defined circumstances.
The growing use of commercial technology for public safety and national security adds another layer of complexity. Drones designed for inspections or firefighting can provide emergency responders with situational awareness before personnel arrive. Similar technologies can also be adapted for military purposes. Government must encourage innovation while preserving accountability for how increasingly autonomous systems behave.
DevSecOps is central to that effort, but Chaudhry says the discipline must evolve for agentic AI. Traditional DevSecOps is largely deterministic, relying on predefined rules, scripted orchestration and linear security scans. Large language models are probabilistic, and agentic systems can pursue an objective without following a fully prescribed sequence of actions. That makes outputs less predictable and complicates conventional validation.
Agencies may need continuous, looping assessments and new forms of human oversight. The central question is whether people can understand and correct systems whose code and decisions may be too complex to review line by line. In this environment, DevSecOps must connect innovation, security and accountability throughout the lifecycle.
Key Takeaways
If an organization lacks guardrails, deployment templates, documented procedures or reliable development practices, adding AI may magnify those weaknesses. The technology can generate code and speed up workflows, but faster activity does not automatically produce better or safer results. Errors, vulnerabilities and poor decisions can spread more quickly when the underlying process is not sound.
Agencies with mature DevSecOps practices are better positioned to use AI as a force multiplier. Documented procedures, approved templates, security controls and government-specific requirements can ground AI systems in the organization’s actual operating environment. That grounding is important because federal agencies work under policies, restrictions and mission demands that may not apply in the commercial sector.
Responsible adoption also requires human review. AI systems can reflect bias in their training data or generate an answer that appears technically correct but is unsuitable for a particular agency. A recommendation may conflict with government policy, security restrictions or an approved technology environment even when it sounds plausible.
Culture and measurement are equally important. Federal leaders may be understandably cautious about exposing sensitive information, generating unexpected costs or deploying a tool the workforce does not use. Training, clear use cases and organizational preparation help turn that caution into deliberate adoption. Before introducing AI, leaders should also establish a baseline and define the outcome they want to improve, whether that is development speed, defect rates, security findings, user satisfaction or mission time saved.
Whittle’s message is straightforward: successful AI adoption begins before the AI tool arrives. Strong governance, mature DevSecOps, trained people and meaningful metrics create the conditions in which AI can deliver lasting value.
Key Takeaways
The ability to build, secure, deploy and improve software faster than an adversary can make a meaningful difference. Traditional waterfall approaches often separate requirements, acquisition, development, cybersecurity and operations into sequential phases. When security is added near the end, teams can spend years moving from an initial requirement to a production capability. Calling the final development stage “agile” does not change the larger process if users and mission owners were not continually involved.
A genuine DevSecOps model brings development, security and operations together. Teams can build a working capability, secure it, place it into production, collect real user feedback and release improvements quickly. Operation StormBreaker was constructed as a cloud-native capability based on Department of Defense DevSecOps and continuous authorization principles to support that iterative approach.
Technology alone, however, cannot create the needed speed. Raley identifies product ownership as a potentially transformative model for defense organizations. A product owner represents the mission or business need and guides the capability throughout its lifecycle. That sustained accountability differs from a project structure defined by a beginning, an end and predetermined deliverables.
A product should continue to evolve for as long as it provides mission value. Organizing around products encourages teams to focus on outcomes instead of schedules, compliance documents or static requirements. It also changes how developers, operators, security professionals and users collaborate.
For defense organizations, a product-centered approach can shorten feedback loops, keep software aligned with changing operational demands and turn DevSecOps into a sustained mission advantage. The pipeline is important, but the ultimate objective is secure capability in the warfighter’s hands when it matters.
Key Takeaways
Before joining Atlassian, Graviss spent nearly 20 years in federal service and served as Chief Data and AI Officer at the Department of State. That experience gives him insight into both the organizational challenges agencies face and the opportunities available through more integrated technology.
Early AI programs often focused on providing employees with access to a government-approved chatbot. Although useful, that model can force workers to move information between operational tools and a separate AI interface. Embedding AI directly into daily workflows reduces this context switching and makes the capability easier to use at the point of need.
The same principle applies across DevSecOps. AI coding assistants receive significant attention, but writing code is only one part of the software-development lifecycle. Developers also spend substantial time in discovery, meetings, requirements development, design and testing. Graviss says specialized AI agents can support each of those stages, freeing technologists to devote more time to the work that requires their expertise.
Technology will not solve collaboration problems by itself. High-performing teams also connect everyday work to strategic goals. Government strategies may clearly state an agency’s priorities, yet employees often struggle to see how their individual tasks contribute to those objectives. Connecting senior-level strategy to the epics, stories and tasks development teams manage helps employees understand how their work supports a citizen service, mission priority or leadership commitment.
The combination of embedded AI and strategic alignment can improve the entire organization. AI reduces friction across the lifecycle, while visible goals ensure that acceleration is directed toward meaningful outcomes. The objective is not simply to make an individual developer faster, but to improve how the agency turns strategy into working mission capability.
Key Takeaways
The DevSecOps pipeline remains the foundation. Continuous integration, automation and security built into the process allow teams to deliver updates rapidly. Applying that model across acquisition, however, requires a digital engineering ecosystem that can connect data and models throughout the lifecycle and make traditionally separate activities part of a continuous mission-delivery process.
Modular open systems architecture, or MOSA, is another essential element. A mature modular architecture allows the Army to swap individual components in and out rather than replacing or retesting an entire system. That flexibility can accelerate integration, procurement, testing and security assessment while making it easier to introduce new commercial and government capabilities.
Modularity depends on stable interfaces and clearly defined boundaries. When those elements are visible, industry partners understand what they need to build toward. Army teams can isolate the component that changed, test and validate it, and avoid recertifying the complete enterprise following every upgrade. This narrows the scope of authorization work and reduces the distance between procurement and operational use.
Digitization makes continuous delivery possible across acquisition processes that have historically relied on documents and organizational silos. Requirements, architectures and test artifacts created as static files are difficult to integrate into an automated pipeline. Converting them into machine-readable data and code allows information to flow through a digital engineering environment where teams can automate processes, integrate continuously and embed security earlier.
Operation Jailbreak demonstrated the potential of exposed interfaces and API-driven integration by allowing multiple vendors and solutions to connect in a compressed timeframe. The broader lesson is that digital data, modular architectures and stable interfaces can help the Army move emerging technology into soldiers’ hands with greater speed, security and adaptability.
Key Takeaways
Virtually every organization that builds modern software relies on open source. Small teams or individual maintainers often create and support important packages, sometimes prioritizing new features while lacking the resources to address every emerging vulnerability. When government programs incorporate those components into production systems, they inherit responsibility for understanding and managing the risk.
That responsibility can complicate an authority to operate or a FedRAMP authorization, particularly when teams cannot clearly identify what is inside their software. Stemmer says effective transparency has three dimensions. Agencies need an accurate software bill of materials, visibility into known vulnerabilities and provenance showing where components originated and who owns identified security risks.
Artificial intelligence is increasing the urgency. Advanced models can automate the discovery of weaknesses and help cyber threat actors find opportunities across widely available code. Open-source repositories are attractive targets because adversaries can inspect or manipulate packages that unsuspecting developers may later download.
If agencies do not establish a strong security posture at the start of development, vulnerable dependencies or malicious code may become embedded deep within applications before security teams become involved. Security professionals should therefore participate from the beginning rather than appearing only when a product is ready for authorization.
Developers also need access to modern, trusted tools that allow them to work efficiently. The answer is not to eliminate oversight or abandon open source, but to provide secure options that preserve appropriate developer choice without creating unnecessary burdens.
Open source is now an unavoidable part of government software delivery. Agencies must surround it with transparency, provenance, continuous assessment and early security collaboration to gain its benefits while managing the risks.
Key Takeaways
Designating Orion as the Navy’s primary DevSecOps pipeline gives approximately 25,000 developers a proven starting point while preserving other environments for specialized needs. Teams no longer have to repeatedly select tools, learn different platforms or repair the same integrations. They can direct more energy toward difficult mission problems.
The goal is not consolidation for its own sake. Fanelli says the Navy is measuring whether a streamlined environment produces faster delivery and meaningful results for users. The organization is comparing previous performance with current outcomes, including tasks that once required dozens of hours and are now largely automated. User time saved connects the work of developers to tangible mission improvements.
Enterprise standardization also strengthens cybersecurity. Securing dozens of independent environments requires teams to manage a much larger set of configurations and potential weaknesses. Reducing that footprint allows the Navy to become highly proficient in the controls and practices it uses repeatedly, including zero trust and automated patching.
Orion also includes an incubator where teams can prove a new capability rather than waiting months through a conventional onboarding process. That lowers barriers to experimentation while keeping development within a structured and secure environment.
The workforce benefits as well. A common platform reduces repetitive exploration and allows skilled employees to concentrate on the smaller number of questions that require judgment. Faster feedback can improve engagement because developers see their ideas become operational capabilities more quickly.
The Navy’s evolution demonstrates how enterprise platforms and selective standardization can support both speed and flexibility. A strong default path, combined with justified alternatives, can reduce overhead and help the development enterprise deliver faster, measurable outcomes for users and the mission.
Key Takeaways
Planning, code changes, security testing and deployment evidence often reside in disconnected systems. When teams need to support an audit or authorization decision, they may struggle to reconstruct the history. A strong platform foundation can unify those artifacts and make the lifecycle traceable from initial requirements through development, testing and promotion to production.
Agency leaders should be able to answer fundamental questions: Who performed an action? What changed? When did it happen? Which evidence supports the decision to deploy? That context is valuable beyond formal authorization. Developers and security teams must collaborate to triage and remediate vulnerabilities, but conflicting spreadsheets and disconnected data sets create delays. A unified view allows everyone to operate from the same information.
Security teams can then trace a vulnerability to the specific code and commit where it appeared and examine the chain of events that followed. That visibility improves everyday collaboration, authorization and incident investigation.
Unified data also strengthens artificial intelligence. Models produce more useful output when they can access consistent, relevant context. AI operating across fragmented systems and multiple versions of the same information may consume significant resources without delivering measurable value. Establishing a coherent workflow foundation improves the potential return from AI investments.
Real-time visibility is especially important for cyber defense. Leaders need more than a snapshot of risk taken at a single point in time. Continuous insight into the security posture of applications and systems helps teams identify changing conditions, address vulnerabilities and reduce risk before an issue becomes a breach.
Continuous authorization therefore depends on three connected elements: automation, unified evidence and persistent visibility. Together, they reduce manual error, improve auditability and allow speed and security to reinforce each other throughout the delivery lifecycle.
Key Takeaways