Moving DevOps Security Out of 'the Stone Age'

This piece outlines the expanding DevOps/software supply chain attack surface from development through deployment, citing risks from vulnerable open source components, containers, misconfigurations, and compromised third-party tools (e.g., Codecov), and emphasizes end-to-end visibility and continuous monitoring. Experts recommend securing four domains (write, use, buy, build), logging and verifying identities, maintaining private artifact repositories and tracking vulnerable artifacts, testing build systems and external triggers, and architecting to minimize blast radius; it also notes slow adoption of security automation and highlights AI-related opportunities and new risks such as malicious pickle deserialization in ML workflows.