Did you know that nearly 1 in 3 breaches comes from software vulnerability exploitation? Surpassing stolen credentials as the leading initial access vector. [1]

Software vulnerabilities can be exploited across multiple layers, including source code, software supply chains, and runtime environments. Securing individual components is no longer sufficient. Security must span the entire software lifecycle, from development and build processes to deployment and production operations.

This talk presents an open-source DevSecOps demonstrator built on GitLab CI/CD that integrates security controls from code commit to production runtime. The demonstrator combines:

• Development Security tools: SAST, DAST, Secret Detection,...
• Software Supply Chain Security: cryptographic signing, verification
• Runtime Security: Web Application Firewall (WAF) protection, and Runtime Application Self-Protection (RASP), binary hardening.

Through practical demonstrations and real pipeline executions, attendees will see how development security, software supply chain security, and runtime protection can be automated using widely available open-source technologies. The session also shows how these controls map to industry-recognized frameworks such as NIST SSDF, OWASP SAMM, and OWASP Secure Product Design Principles.

Whether you are a developer, DevOps engineer, security practitioner, or architect, this talk provides a practical and reproducible blueprint for building lifecycle-wide DevSecOps pipelines and strengthening software supply chain resilience without relying on proprietary security platforms.

Demonstrator URL : https://gitlab.seanergys.fz-juelich.de/pochelu1/devsecops_demonstrator

This work was supported by EuroHPC JU SEANERGYS (g.a. 101177590).

[1] https://www.verizon.com/business/resources/reports/dbir/