The DevOps.com stories enterprise IT leaders actually read.
Volume 342, Issue 3 · 8 articles from 2 issues
AI agents with legitimate credentials pose data risks requiring independent, immutable backups.
As developers delegate permissions to AI agents and copilots, these tools can unintentionally damage repositories and DevOps platforms through accelerated, autonomous actions that appear legitimate.
Modern DevOps systems now contain infrastructure-as-code, deployment configs, and operational instructions beyond source code, making data loss more consequential.
Organizations must reassess backup strategies with shorter recovery windows and implement independent, immutable protection layers that isolate critical data from authorized but potentially destructive AI activities.
Strategic outsourcing decisions should prioritize capability and velocity over cost, with hybrid models offering optimal balance.
The article argues that framing in-house versus outsourcing as a cost problem misses the real issue: capability and velocity.
Extended hiring cycles (4-6 months) and specialist skill gaps create hidden costs that outweigh labor savings.
High-performing teams treat vendors as product partners with clear requirements, retain internal ownership of strategy and architecture, and increasingly adopt hybrid models combining core in-house teams with specialized external capacity for DevOps, security, and surge development, enabling faster product delivery without permanent overhead.
CI/CD pipelines represent critical security vulnerabilities due to privileged access and automated code execution.
CI/CD pipelines combine automated code execution with access to sensitive credentials, cloud accounts, and production environments, making them attractive targets for supply chain attacks.
Organizations commonly face weaknesses including permanent credentials, unpatched infrastructure, and third-party actions pinned to mutable tags.
Security experts recommend adopting hardened practices: scoping credentials to individual stages, pinning actions to specific commits, isolating build environments, restricting network access, and implementing signed provenance attestations for each build.
Risk-based testing prioritizes critical failures over exhaustive coverage for better release quality.
Organizations should abandon the pursuit of complete test coverage in favor of strategic risk-based testing that focuses on areas with the greatest business impact.
Authentication, payment processing, security features, and critical workflows deserve deeper scrutiny, while lower-risk functionality can rely on automation.
Frameworks like PRisMA, RRA, and QFD provide structured approaches for prioritizing testing efforts.
AI can identify code changes and suggest coverage gaps, but human judgment remains essential for determining which failures truly matter to the business.
System outages can occur when healthy components interact unsafely, not just from individual failures.
A provisioning service outage occurred when a policy library designed for serial use was reused for concurrent operations, causing memory exhaustion despite all components functioning as intended.
The problem emerged from interactions between healthy components rather than individual failures. The solution requires making resource constraints explicit and using signals like memory pressure and concurrency levels to control accepted workload.
Systems-safety approaches help identify how individually safe actions can combine into unsafe system states.
Framework for balancing AI automation with human oversight in incident response through three trust levels.
A tiered autonomy model for AI-driven incident response avoids the false choice between full automation and read-only tools.
Tier 1 handles proven, reversible incidents autonomously; Tier 2 requires human approval for moderate-risk cases; Tier 3 keeps humans leading complex investigations while AI accelerates evidence gathering.
The approach emphasizes deterministic policy controls over LLM decisions, bounded permissions, and clear escalation rules to ensure safety and accountability in production environments.
SecMLOps applies DevSecOps controls to ML pipelines for auditable security evidence.
Machine learning pipelines should inherit DevSecOps discipline by implementing secrets management, input validation, and artifact integrity checks.
A practical Apache Airflow experiment demonstrates how to add encrypted runtime variables, external API boundary controls, empty dataset protection, SHA-256 model hashing, and metadata recording.
The approach embeds a final security audit task within the pipeline DAG itself, ensuring workflows only complete after verifying all expected outputs and producing audit reports, transforming successful runs into trustworthy, verifiable operations.
Drew Thompson argues measuring AI coding tools by token consumption is as flawed as counting lines of code.
Thompson argues that judging developer AI productivity by token usage repeats the old mistake of measuring lines of code as a proxy for value.
He proposes measuring outcomes relative to cost instead, such as vulnerabilities found per query or secure features shipped, rather than raw activity volume.
He warns that overly restrictive token budgets push developers to bypass governance using personal accounts, undermining oversight. The piece concludes mature AI programs should shift the core question from 'are we using it?' to 'is it actually working?'
More from DevOps.com · All IT section newsletters · This week