Most teams already agree that security matters. What they lack is a Monday-morning answer: which checks to install, in what order, and who decides when a change is blocked. That gap is where DevSecOps earns its keep — controls placed inside the delivery pipeline, each with a defined position and purpose, so risky work stops before it ships. This walkthrough compresses the setup into five short working sessions. No budget approval, no new headcount, just a pipeline, a shared document, and a few evenings.
Session zero: write down what you already run
Spend the first hour listing what exists rather than adding anything. Setup efforts fail quietly when nobody can say where a check would even attach. Put five things on the page:
- Every repository that produces something deployable, and which job builds it.
- Where credentials live right now — CI variables, config files, a laptop.
- Who can approve a deploy, and what proof that approval leaves behind.
- Which dependencies get pulled in, and whether any record of them exists.
- The last three incidents, however minor, and the hole each one walked through.
This inventory is your baseline, and one rule attaches to it: old problems on this list never trigger the gate. That distinction comes back in session one.
Session one: put the DevSecOps gate policy on a single page
Write the rule before touching a single tool. A workable policy permits a hard stop in exactly three situations: the defect arrived with this change, the tool is confident about it, and the fix is small enough to land same-day. Everything else converts into tracked work — a named owner, a short note, an expiry date, ninety days at most. Baseline debt sits outside enforcement completely. Teams that skip this page tend to block anything rated medium or worse, and within a month the engineers have memorised the bypass button instead of the bug. The page is the product; the scanners just execute it.
Session two: shut the secret tap
Credentials remain the shortest path from a keyboard to a breach, so they come before any code scanning. Two placements work as a pair: a pre-commit scanner on each developer machine, and push protection on the server, which refuses commits carrying live keys before they enter shared history. Read the defaults while you are in there — on GitHub, the bypass switch for push protection is available to any writer unless an administrator closes it. When something does leak despite the guardrails, sequence matters: rotate the credential first, rewrite the git history second. A revoked key sitting in an old commit is trivia. A live one is an incident.
Session three: run static analysis in report-only mode
Switch code scanning on with blocking disabled, then watch for a month while it only comments. The discipline here comes from Google’s Tricorder programme, and the thresholds are specific: a rule earns enforcement only when its effective false-positive rate is roughly zero; tool-generated review comments should stay under ten percent; results should be limited to changed lines rather than the whole repository; and a thirty-finding sample per rule tells you quickly whether the rule deserves its place. Rules that flunk the sample get retired, not endured. Noise is not a feature of a scanner — it is the reason people mute them. Report-only mode also exposes overlap, because two tools often flag the same class of defect in different words, and one of them can simply be switched off.
Session four: make every build carry evidence
A build with no paperwork cannot be verified later, so start producing three things per build: a software bill of materials naming the components inside, a signature over the artifact, and provenance describing how it was produced. The SLSA framework grades build integrity from level zero up to level three; GitHub’s artifact attestations reach level two, and level three once you pin reusable workflows. Then close the loop people forget: verification happens at deploy time. A signature that nobody checks is stationery. The check is where the guarantee actually forms.
Session five: switch the DevSecOps gates on, narrowly
Enforcement now replaces reporting, but only for the narrow class your policy named: new, high-confidence, fixable findings. Expect friction, and measure it rather than arguing about it. In one documented example, 1,240 pull requests drew 96 blocks and 22 overrides — a 22.9 percent override rate, which correctly signalled that the gate was not yet trusted and sent the team back to tune its rules. Every override is a conversation with a ruling, and rules that get overridden repeatedly are demoted. Keep the exception ledger with owners and expiry dates, then review it monthly next to two other numbers: how fast new findings get fixed, and how many defects still reached production that a placed check should have caught.
Keeping the gates honest afterwards
Month two onward, the routine shrinks to three questions at a short monthly review: is the override rate still under five percent, are new findings closing faster than last month, and did anything escape that a positioned control should have intercepted? If the answer to any of them sours, the fix is usually a rule adjustment or a placement change — not a new purchase. Tools arrive with dashboards; they do not arrive with judgement, and judgement is what these reviews preserve. For the wider map of control families, standards, and where the field’s edges sit, the DevSecOps reference in The Ops Atlas repays a slow read.
Clinicians will recognise the shape of all this. A procedure only counts when the follow-up happens, which is why the same logic recurs across cardiac rehabilitation after surgery, telehealth-based follow-up care, and the structured plans behind adult CABG recovery. Install the check, then prove it worked — in medicine and in delivery pipelines alike.