A Unified Framework for Automating Software Security Analysis in DevSecOps
Abstract
The Development and Operations (DevOps) methodology is a set of practices and cultural values. Its main objectives are to shorten the software development lifecycle, produce quality software, and eliminate software evolution barriers. The increased demand for secure software applications has led to a new field version of DevOps called Development, Security, and Operations (DevSecOps), which attempts to integrate security practices into the DevOps process. In this paper, we outline the current challenges in securing DevOps applications, such as the lack of automated software security testing tools, insufficient integration of security tools, a lack of security knowledge between developers, and false-positive results produced by many vulnerability scanner tools. Therefore, we introduce a unified framework for automating software security analysis in the DevSecOps paradigm that serves as a middle development process between software applications' Continuous Integration (CI) and Continuous Delivery (CD) pipelines and application security services. We have shown the framework's high-level architecture, and one case study is presented to illustrate the applicability of our proposed approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Limitations remain due to the heterogeneity and variable quality of included studies, potential publication bias, and the ongoing evolution of technologies, which may render some insights rapidly outdated.
“However, limitations remain due to the heterogeneity and variable quality of included studies, potential publication bias, and the ongoing evolution of technologies, which may render some insights rapidly outdated and highlight the need for continued empirical research and validation in diverse organisational contexts [26,27].”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [26]
Cites
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2021.106700 · Cited by 235 · see citing works
DevSecOps: A Multivocal Literature Review
Myrbakken, H., & Colomo-Palacios, R. (2017) · Communications in Computer and Information Science · doi:10.1007/978-3-319-67383-7_2 · Cited by 205 · see citing works
Adopting DevOps in the real world: A theory, a model, and a case study
Luz, W., Pinto, G., & Bonifácio, R. (2019) · Journal of Systems and Software · doi:10.1016/j.jss.2019.07.083 · Cited by 164 · see citing works
Toward successful DevSecOps in software development organizations: A decision-making framework
Akbar, M. A., Smolander, K., Mahmood, S., & Alsanad, A. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2022.106894 · Cited by 128 · see citing works
Rangnau, T., Buijtenen, R. V., Fransen, F., & Türkmen, F. (2020) · IEEE International Enterprise Distributed Object Computing Conference (EDOC) · doi:10.1109/edoc49727.2020.00026 · Cited by 99 · see citing works
Kumar, R., & Goyal, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101967 · Cited by 97 · see citing works
An Empirical Taxonomy of DevOps in Practice
Macarthy, R. W., & Bass, J. M. (2020) · Euromicro Conference on Software Engineering and Advanced Applications (SEAA) · doi:10.1109/seaa51224.2020.00046 · Cited by 74 · see citing works
An Empirical Study on Culture, Automation, Measurement, and Sharing of DevSecOps
Tomas, N., Li, J., & Huang, H. (2019) · 2019 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecpods.2019.8884935 · Cited by 66 · see citing works
Prioritization based taxonomy of DevOps security challenges using PROMETHEE
Rafi, S., Yu, W., Akbar, M. A., Alsanad, A., & Gumaei, A. (2020) · IEEE Access · doi:10.1109/access.2020.2998819 · Cited by 50 · see citing works
Preliminary Findings about DevSecOps from Grey Literature
Mao, R., Zhang, H., Dai, Q., Huang, H., Rong, G., Shen, H., Chen, L., & Lu, K. (2020) · 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs51102.2020.00064 · Cited by 49 · see citing works
Colavita, F. (2016) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-27896-4_17 · Cited by 14 · see citing works
Implementation of DevSecOps using Open-Source tools
Rahul, B., Kharvi, P., & Manu, M. N. (2019) · International journal of advance research, ideas and innovations in technology · Cited by 11 · see citing works
Davis, A. (2019) · Apress eBooks · doi:10.1007/978-1-4842-5473-8_3 · Cited by 4 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Prates, L., & Pereira, R. (2025) · International Journal of Information Security · doi:10.1007/s10207-024-00914-z · Cited by 49 · see citing works
Boisrond, K., Tardif, P.-M., & Jaafar, F. (2024) · IEEE Access · doi:10.1109/access.2024.3434618 · Cited by 27 · see citing works
Integrating security controls in DevSecOps: Challenges, solutions, and future research directions
Sinan, M., Shahin, M., & Gondal, I. (2025) · Journal of Software: Evolution and Process · doi:10.1002/smr.70029 · Cited by 13 · see citing works
Extensive Review of Threat Models for DevSecOps
Nagasundari, S., Manja, P., Mathur, P., & Honnavalli, P. B. (2025) · IEEE Access · doi:10.1109/access.2025.3547932 · Cited by 12 · see citing works
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8 · see citing works
Towards a DevSecOps-Enabled Framework for Risk Management of Critical Infrastructures
Ramaj, X., Colomo‐Palacios, R., Sánchez‐Gordón, M., & Gkioulos, V. (2023) · Communications in computer and information science · doi:10.1007/978-3-031-42307-9_4 · Cited by 7 · see citing works
Cybersecurity in DevOps Environments: A Systematic Literature Review
Ramos, R. C. B., & Yoo, S. G. (2025) · IEEE Access · doi:10.1109/access.2025.3582892 · Cited by 6 · see citing works
Toward a Robust and Enhanced DevSecOps Framework
Ramos, R. C. B., & Yoo, S. G. (2025) · Communications in computer and information science · doi:10.1007/978-3-032-08366-1_28 · Cited by 3 · see citing works
Ababneh, J., Al-Nsour, E., Al-Shaikh, A., Al-Mousa, M. R., Al-Zabin, A., Asassfeh, M., & Abualese, H. (2026) · IEEE Access · doi:10.1109/access.2026.3650793 · Cited by 3 · see citing works
Implementing “DevSecOps as a Culture”—The Concept, Benefits, Execution Strategies, and Challenges
Lumpatki, S. S., Patwardhan, S., & Kulkarni, M. (2024) · Lecture notes in networks and systems · doi:10.1007/978-981-97-1326-4_16 · Cited by 3 · see citing works
Mooduto, A., Rijanto, E., & Pamuji, G. C. (2023) · International Conference on Informatics Engineering, Science & Technology (INCITEST) · doi:10.1109/incitest59455.2023.10397047 · Cited by 3 · see citing works
Automatic Rule Checking for Microservices: Supporting Security Analysis with Explainability
Schneider, S., Quéval, P.-J., Milánkovich, Á., Ferreyra, N. E. D., Zdun, U., & Scandariato, R. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3771275 · Cited by 2 · see citing works
Firizqi, J. D., & Indrajit, R. E. (2025) · International Conference on Informatics and Computing (ICIC) · doi:10.1109/icic68054.2025.11309501 · Cited by 1 · see citing works
(2023) · International Conference on Smart Computing and Application (ICSCA) · doi:10.1109/icsca57840.2023.10087855
Tecnologias e Ferramentas Utilizadas em DevSecOps: Uma revisão sistemática da literatura
Pimentel, F. C. S., Fonseca, L. C. C., & Cortes, O. A. C. (2026) · iSys - Brazilian Journal of Information Systems · doi:10.5753/isys.2025.6207
Six Open Challenges for Production-Ready Cloud-Native Security Orchestration
Elmoussaoui, M., Marzouk, A., Said, M. A., & Belouaddane, L. (2026) · International Conference on Intelligent Systems and Digital Applications (ISDA) · doi:10.1109/isda70544.2026.11606146
DevSecOps: A Comprehensive Survey of Secure Software Development and Deployment Practices
Shrivastava, D. P. K. (2026) · International Journal of Advanced Research in Science Communication and Technology · doi:10.48175/ijarsct-38515
- Authors
- Aljohani, M. A., & Alqahtani, S. S.
- Affiliations
- Imam Mohammad ibn Saud Islamic University (SA)
- ORCID
- Alqahtani, Sultan S.
- Venue
- 2023 International Conference on Smart Computing and Application (ICSCA)
- Publisher
- IEEE
- Published
- 2023-02-05
- Pages
- 1-6
- OpenAlex
- W4362647473
- Cited by
- 17
- References
- 13
- Citations by year
- 2026: 4 · 2025: 7 · 2024: 3 · 2023: 3
- FWCI
- 4.37
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Smart Computing and Application (ICSCA) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Software › Software Testing and Debugging Techniques
- Keywords
- DevSecOps, software security analysis, automated security testing, vulnerability scanners, false positives, continuous integration, continuous delivery, security tool integration, secure software development, unified framework
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
