Shift-left security
The practice is part of the DevSecOps movement: the integration of security (Sec) into the DevOps flow, so that security, development, and operations share responsibility for the security of the system.
Why it matters in agile contexts
The cost of detecting and fixing a security vulnerability grows exponentially as the development cycle progresses. A vulnerability detected during the coding phase can be resolved in hours; the same vulnerability detected in production may require days of work, affect real users, and create legal or reputational risk.
In agile teams with short sprints, the time window for detecting vulnerabilities before deployment is narrow. Without shift-left security, the team deploys frequently, but it also deploys vulnerabilities frequently.
Practices that implement shift-left security
- Threat modeling during design: identifying potential attack vectors before writing code, during solution design sessions.
- Static application security testing (SAST): integrating static analysis tools into the CI pipeline that detect insecure code patterns in every commit.
- Security-focused code review: including explicit security criteria in code review.
- Automated security tests: including basic security tests (injections, authentication handling, data exposure) in the automated test suite.
- DoD with security criteria: no story is considered "done" unless it has passed the minimum security criteria defined by the team.
Shift-left security with AI
The adoption of vibe coding and coding agents has increased the urgency of shift-left security:
- AI-generated code may include known vulnerabilities that the agent reproduced from examples in its training data.
- AI agents tend to prioritize functionality over security unless it is explicitly specified in the spec or in the guardrails.
- The speed of AI generation amplifies the risk: more code generated in less time means more potential attack surface if there is no early verification.
The reinforced DoD for teams working with AI includes static security analysis as a mandatory component, which is a direct application of shift-left security.
Common mistake
Treating security as a "final audit" phase before deployment. In agile teams with two-week sprints, a security audit at the end of the sprint either blocks deployment or forces findings to be overlooked under time pressure. Shift-left security only works if it is integrated into the daily workflow, not if it is a separate activity that disrupts the team's pace.
See also
Want to advance in agility? You can search for course and exam calls or go at your own pace by becoming a member of the Agile Club. This membership includes exclusive resources, e-learning classrooms, and access to Skill Arena: a space to practice and measure your agile skills at your own pace.