Evolving Microsoft Security Development Lifecycle (SDL): How continuous SDL can help you build more secure software

Microsoft outlines the evolution of its Security Development Lifecycle into a continuous, data-driven model that embeds security throughout cloud-era CI/CD workflows. The approach automates measurement (e.g., via CodeQL), enhances transparency and traceability (including SBOM requirements and a compliance evidence graph), and modernizes practices with threat modeling improvements, memory-safe languages, open-source supply chain security, and AI-focused assurance (e.g., AI Red Team). The paper frames these changes within the Secure Future Initiative to deliver secure-by-design, secure-by-default products and share best practices with the broader developer community.