DevSecOps: securing the development chain with AI agents

Objectives

• Map one's development chain (repository, integration, artefacts, deployment) and build its threat model, with attack points ranked by severity
• Integrate into the pipeline static code analysis, dependency analysis, secret detection and container image scanning, with automatic blocking beyond a set threshold
• Harden the repository and the pipeline: branch protection, mandatory reviews, least-privilege permissions, secrets stored outside the code and rotated
• Deploy an AI agent that triages security alerts, proposes a fix and prepares the summary for human review, without ever merging on its own
• Set up assisted monitoring of the chain (logs, alerts) and an incident response plan that is written down and tested on a scenario

Audience

Developers, DevOps engineers, application security managers, IT teams that have taken DEV-101 or already run a continuous integration pipeline.

Prerequisites

Have taken DEV-101 or run a continuous integration and deployment pipeline with Git and Docker on a daily basis. Checked by a placement test.

Technical prerequisites

• One laptop per participant, 16 GB of memory recommended, with Git, Docker and a code editor installed before the first day (procedure supplied with the invitation).
• Training Git repository, cloud environment and API keys for the agent supplied by Yolea, credits included.
• For remote attendance, a stable connection of at least 10 Mbit/s, microphone and camera.
• The participant's own pipeline accepted if it can be read.

Skills covered

• Threat modelling
• Automation of security checks
• Hardening of access and secrets
• Supervised AI assistance for security
• Incident response on the development chain

Programme

• 25% input, 75% hands-on workshops.
• A training chain that is deliberately vulnerable, cleaned up check by check.
• Attack and defence exercise on the repository.
• Supervised construction of the alert triage agent, with a written scope and human approval.
• Practical cases inspired by company situations (securing a development chain, a compromised dependency, a secret exposed in a commit history).
• Tools of the current edition: GitHub Actions, code and dependency analysers, image scanning, an agent built on LangGraph or Pydantic AI.
• Materials supplied: reference repository, secure pipeline templates, threat model, incident response plan, glossary.
• Personal action plan.
• Follow-up session after three weeks.

Format

21 hours, 3 consecutive days of 7 hours, or 2 + 1 days a week apart with coaching between the modules. In person recommended, hybrid possible; in-company on your own chain or open enrolment; 8 to 12 participants.

Assessment

Beforehand, a placement test. During the course, check quizzes and a pipeline review. At the end, a practical challenge (secure a set chain and handle a simulated incident, assessed against a grid: active checks, hardened access, supervised agent, incident traced), an immediate feedback evaluation and a named certificate of completion. After three weeks, a follow-up session.

The last exercise is an action plan: three real tasks that you leave ready to equip with tools.