Every working discipline eventually meets the year when its outside signals stop agreeing with each other. For DevSecOps — the practice of running security checks inside the delivery pipeline, owned by the delivery team, so every change is examined and traceable — that year is the current one. The mandates that pushed teams toward pipeline security have loosened. The attacks the checks exist for have widened. The standards have kept moving regardless. Programme owners who read only the headlines will draw opposite conclusions from the same twelve months, so this piece lays the currents side by side and asks what, underneath both, has not moved at all.
Two currents, one DevSecOps pipeline
Name the discipline’s position precisely before reading the news through it. DevSecOps is an established term without any one normative definition. SP 800-204C, from NIST, frames the whole approach as something that facilitates CI/CD, and the term appears across the SSDF, OWASP projects, and Department of Defense guidance. Because the field defines itself by practices rather than by certification, external signals — mandates, threat categories, standard revisions — change its urgency without ever changing its content. That is the lens for everything below. A practice built on placed controls does not care much whether a memorandum survived the year.
The retreat of the federal stick
The headline fact: January 2026 is when OMB pulled M-22-18 back. That memorandum had been the lever behind much of the US government’s push for attestation forms and software security provenance from vendors, and its withdrawal changes procurement conversations immediately. Vendors who built programmes solely to answer federal questionnaires now face a choice between maintaining those programmes on their own merits or quietly sunsetting them. The evidence favors the first course, and not sentimentally: the same controls that satisfied the form also shortened incident response and cut escape defects. But the honest reading of 2026 is that the compliance burn faded a little, and programmes justified only by the burn should expect scrutiny from their own finance departments.
The threats DevSecOps watches widened anyway
The second current runs the other way. OWASP’s Top 10:2025 broadened A03 — historically injection — to cover supply-chain failures generally, a categorical admission that the boundary between “flaw in my code” and “flaw in what my code consumes” has stopped being useful. Meanwhile the year supplied its own object lesson: the trivy-action and setup-trivy GitHub Actions lost control of their tags on 19 March 2026, force-pushed to serve a poisoned Trivy v0.69.4 build. Containment came the same evening, but the detail that should unsettle every reader is the badge: the repositories displayed an “Immutable” label that did nothing to prevent tag force-pushing. And the newest frontier barely has incident history yet — package hallucination by coding assistants, which runs to 5.2 percent and beyond on commercial models and reaches 21.7 percent on the open-source side, hands attackers a supply of phantom dependencies to pre-register. Wider, indeed.
Where the standards moved
Standards work neither notices moratoria nor waits for breaches; it ships on its own calendar. The 2026 ledger:
- CISA and seventeen partner organisations issued revised SBOM minimum elements in July 2026 — the second look at what a component list must contain to be useful.
- SLSA now stands at v1.2, whose new Source track grades protections on the source repository itself, alongside the familiar Build levels.
- NIST’s SSDF sits at v1.1 in production with a v1.2 draft circulating since December 2025.
- The EU Cyber Resilience Act has applied since the final month of 2024, while its substantive obligations wait until the last month of 2027 — the one item on this page with legal teeth.
- The US Department of Defense refreshed its Enterprise DevSecOps Fundamentals to v2.5 in October 2024, keeping the term inside formal doctrine.
Read together, the pattern is consolidation: the artefacts teams were already asked to produce — component lists, provenance, hardened builds — are getting sharper specifications, not fewer.
What a DevSecOps programme holds constant
Against the noise, the durable core. Controls are placed deliberately: each claims a spot in the flow and carries three tags — its confidence, its cost, its action, where action means block, warn, or record — and the seven control families map cleanly onto SSDF practices. Gates refuse merges only over severe, fixable, high-confidence findings new to the change under review; everything else becomes scheduled work with a named owner and a ninety-day clock, and baseline debt never blocks. Static analysis rules earn blocking only when effective false-positive rates sit near zero, review comments stay under ten percent, and sampled findings have been read. Secrets rotate first and get scrubbed from history second. Builds emit an SBOM, a signature, and provenance — verified at deploy time, not merely signed. The CI machinery pins third-party actions to full SHAs, runs least-privilege, borrows identity through OIDC rather than stored keys, and never hands secrets to fork pull requests. Champions get ten to twenty percent protected time, because DORA’s 2022 data measured odds of high burnout running 1.4 times where security practice was weakest, and found culture a stronger adoption predictor than tooling. A programme built on those lines was worthwhile in 2024, remains worthwhile in 2026, and will not need rebuilding when the next memorandum changes.
The only binding deadline on the wall
Strip away the voluntary layer and one date remains legally real: December 2027, when the Act’s core duties arrive for products with digital elements placed on the EU market. Organisations selling into Europe should treat the interval as construction time for exactly the evidence the Act cares about — secure development documentation, vulnerability handling, and the ability to demonstrate both. The pleasant surprise is that this to-do list overlaps almost entirely with mature DevSecOps practice: the placed controls, the receipts, the gating discipline. Compliance teams and pipeline teams have spent a decade talking past each other; a binding deadline with shared requirements is as good an occasion as any to merge the roadmaps. Readers who want the discipline itself mapped — definitions, control families, metrics, and the standards’ revision history — will find the DevSecOps entry at xOps School the most compact honest summary this writer has located.
What buyers of software should ask for now
The mixed signals change procurement more than engineering, so buyers deserve their own paragraph. With the federal attestation push retired, the questions worth asking a vendor are the ones that cost them effort to fake: Does every build produce a component list and provenance, and can you show verification happening at deploy time rather than a signature sitting in storage? What does your gate policy refuse, and what is your monthly override rate? Which CI/CD risks from OWASP’s catalogue have you addressed — pinned actions, short-lived credentials, fork isolation? How many exceptions are open past their expiry dates? A vendor with real practice answers these from existing artifacts; a vendor with theatre answers them with logos. The questions outlive the memorandum that made them fashionable, which is exactly what makes them useful.
Reading the year without vertigo
So: softer mandates, sharper threats, steadier standards. The mistake to avoid is letting any single current set strategy. Teams that relaxed because the memorandum died will meet the next trivy-action incident without their guardrails; teams that panic-buy because A03 widened will rediscover what the override-rate data has always shown about gates nobody believes. Between the headline currents sits the same quiet craft this discipline has owned since Rugged Software surfaced in 2010: check the changes, keep the receipts, trust the measurements, and rehearse the bad day. That sentence outlived several mandates before this one. Plan on it outliving the next. And when the technical programme needs a breather — Bangalore’s theatres, music venues, and event calendars reward attention too; a sensible tour of the city’s theatre scene or a weekend shortlisted from the Kerala events and travel roundup resets the analysts as well as anything. The live music listings are the writer’s own post-mortem venue of choice.
