DevSecOps Maturity Score Quiz

This short quiz helps your DevSecOps team understand where you are in your DevSecOps maturity journey.

Informal and reactive security training

Regular training and a basic knowledge base

Advanced security training with hands-on learning

Mature training program that's fully integrated with the SDLC

Tasks performed manually based on tickets/requests

Testing is included throughout the SDLC and application environments are standardized

Security tools offered as a services, and Infrastructure as Code automates application environment creation

Security and app environments are reusable in the IDP; engineering handles issue triage

Secure design reviews are ad hoc, and informal threat monitoring is conducted

Cybersecurity teams conduct threat modeling and output security requirements

Threat modeling is shared across the SDLC and secure-by-design principles are regularly upheld

Security requirements are continuously and automatically monitored; engineering oversees design and threat review

Application security testing (AST) is used but completed post-application build

AST is automated and integrated into tooling but results are reviewed outside the SDLC tools

Automation is integrated throughout the SDLC; insights are presented with developer tooling

AST tools are the default and continuously report potential issues to management systems

Source control management (SCM) is used

Reduced risk through the introduction of software composition analysis (SCA)

Automated processes for build and delivery; SDLC tools are advanced

Security is prioritized throughout the entire SDLC with multiple checks