Planning and design in DevSecOps

Planning and design in DevSecOps determine whether security is built into products from the start or added later in response to risk. Strong early decisions help teams make secure-by-design the default, using data and modern architecture to guide what gets built.

This capability area describes how security is built into the earliest phases of work through secure-by-design practices, the data and insights that inform decisions, and the technical architecture and design choices that shape a product.

As organizations mature, planning and design move from reactive, legacy-driven activity toward a more differentiated position. Threat modeling evolves from individual effort to a business-level discipline, data grows from default reporting to predictive analytics, and architecture advances from ad hoc designs to modern, resilient, and even quantum-resistant patterns.

Core capability areas

Planning and design in DevSecOps focuses on three sub-capabilities:

  • Secure by design: How threat modeling and protective design practices are applied during planning.

  • Data and insights: How product, team, and customer data inform decisions and strategy.

  • Technical architecture and design: How architecture patterns evolve toward modern, secure, and resilient approaches.

Stages

Planning and design progresses through five stages of maturity. These stages show how DevSecOps principles appear in the earliest phases of development, from reactive planning shaped by legacy investment to planning and design practices that create a differentiated position in the industry.

Overall stage Stage name What it looks like
Ad-hoc Reactive Legacy investment drives activity, missing opportunities to leverage innovation.
Initiating Intentional Organizing and informing planning allows collaboration and more aligned outcomes.
Orchestrating Coordinated Human and technical alignment emerges across products and services.
Streamlining Integrated Prioritized investments in planning and design demonstrate clear value.
Pioneering Differentiated Planning and design excellence results in a differentiated position in the industry.

Reactive (Ad-hoc)

Before teams begin planning with intention, legacy investment can drive activity and limit opportunities to use newer approaches.

  • Secure by design: Security in the design phase is handled only by individual security-minded contributors. For most teams, it's an afterthought, if it's considered at all.

  • Data and insights: Data collection and reporting stay at the default level. Teams review them only periodically, and they rarely use them to drive action.

  • Technical architecture and design: Design and architecture are ad hoc and lack standards or guidelines. Development costs stay high, with little code sharing or use of open source.

Intentional (Initiating)

Organizing and informing planning and design allows collaboration to emerge and creates more aligned outcomes.

  • Secure by design: Threat modeling happens at a technical level and addresses high-severity issues, though often late in the process. Teams use data encryption and secure communication protocols.

  • Data and insights: Teams use existing product signals to improve. Customer insight is limited, and mismatched data makes analysis difficult.

  • Technical architecture and design: Teams begin moving toward modern patterns such as cloud and microservices, or use hardware security modules (HSMs) in embedded systems.

Coordinated (Orchestrating)

As planning and design become more intentional, human and technical alignment starts to emerge across products and services.

  • Secure by design: Threat modeling operates at the product level with defined processes and standards. Intelligent apps include guardrails and protections against threats such as prompt injection. Strong identity and secrets architectures are in place.

  • Data and insights: Product data collection, curation, and sharing make decisions faster and more confident. Real-time product monitoring increases transparency, team insights improve workflows and processes, and customer insights are gathered routinely and influence the roadmap.

  • Technical architecture and design: Modern patterns such as cloud and microservices see broader adoption. Embedded architectures include hardware-accelerated security and secure firmware updates.

Integrated (Streamlining)

With prioritized investments in planning and design, the benefits become visible and demonstrate value.

  • Secure by design: Threat modeling expands to the business level, including efforts to mitigate AI threats such as memory poisoning, knowledge corruption, and manipulation of agent reasoning. Multi-agent communication and trust chains are considered carefully and secured appropriately.

  • Data and insights: Cross-system product data unification and real-time processing deliver comprehensive visibility and connect product improvements to key business metrics. Rigorous team insight collection supports continuous improvement, and customer insights help drive strategy.

  • Technical architecture and design: Teams adopt advanced approaches such as serverless architecture, broader container use, and selective moves into multicloud environments. Designs also support over-the-air updates and microsegmentation.

Differentiated (Pioneering)

Planning and design excellence helps the organization establish a differentiated position in the industry.

  • Secure by design: Teams create advanced abuse stories and run collaborative security checks with developers and system administrators. Red teaming and similar strategies help validate designs and concepts.

  • Data and insights: Exploration across product, team, and customer data reveals deeper relationships between customer needs, process improvements, and business impact. Forecasting and game planning become possible through predictive analytics.

  • Technical architecture and design: The organization develops cryptographic algorithms that can resist attacks from quantum computers.

Related content

  • Last updated on