Technology leaders across the public sector are facing a familiar but intensifying challenge: delivering new digital services faster while the threat landscape, compliance requirements, and public scrutiny continue to grow. AI-assisted software development is cutting timelines that took quarters into weeks. This speed is a double-edged sword: research has shown that most security leaders are concerned about the risks introduced by AI-generated code, and vulnerability disclosures directly related to AI-assisted development has increased dramatically month over month in 2026. Cloud modernization efforts are pushing agencies to rearchitect legacy systems while keeping them operational. Meanwhile, adversaries are using AI to accelerate attacks against government networks and software supply chains. For CIOs, CISOs, and application development leaders, the tradeoff between speed and security is no longer acceptable. Mission success depends on doing both at once.
This is the exact problem DevSecOps was designed to solve, and why it has evolved into a strategic operating model for IT modernization. DevSecOps integrates security into every stage of the software lifecycle rather than treating it as a final step before deployment. In practice, this includes embedding software supply chain security throughout the development lifecycle. Agencies generate software bill of materials (SBOMs) throughout the development and verify provenance against frameworks like Supply-chain Levels for Software Artifacts, allowing agencies to prove not only what is in their software, but also how and by whom built it. It also means adopting platform engineering that gives developers secure, self-service infrastructure, and automated security testing within continuous integration and continuous delivery pipelines. As AI coding assistants become standard tooling throughout development teams, agencies are extending these same supply chain testing processes to AI-generated code itself, treating it as another asset that must be scanned, attributed, and verified.
It also requires continuous monitoring, collaboration across development, operations, and security teams, and governance models that keep pace with delivery rather than relying on static, years-long accreditation cycles. A key component to this evolution is Continuous Authorization to Operate (cATO). Through continuous monitoring, active cyber defense, and mature DevSecOps practices, cATO keeps authorization current as opposed to a point-in-time approval that can lock a system’s security posture in place for years. The Department of War has formalized many of these practices in its DevSecOps Strategy Guide, solidifying how software factories and continuous authorization processes can function at scale within a highly regulated environment. But these principles are not only applicable to defense. They are just as applicable to a federal agency rebuilding a benefits system or a state agency modernizing its citizen-facing services.
The question is no longer whether agencies should adopt DevSecOps, but how to implement it in a way that balances innovation, security, and governance as AI accelerates software development and modernization efforts across government.
The Carahsoft DevSecOps Conference on July 28, 2026, will bring together government and industry leaders to explore the strategic importance of DevSecOps in modern government IT. The agenda dives into where DevSecOps is headed and how agencies are putting these principles into practice, including sessions on AI coding assistants, AI-enabled software development, streamlining the Authority to Operate (ATO) process, and the future of DevSecOps across government. Attendees will hear directly from leaders representing the National Institute of Standards and Technology, the Department of the Navy, and the Government Accountability Office, among others, each offering a unique perspective on what is working and what challenges remain.
DevSecOps itself has evolved dramatically: AI touches every stage of the pipeline, development, security, and operation teams are merging into unified platforms, and authorization models are shifting from static cycles to continuous risk-informed approval. This evolution is quickly becoming the foundation for creating resilient, secure, mission-ready digital services. The Carahsoft conference offers technology leaders an opportunity to hear directly from those who are already implementing these principles.
Register for the Carahsoft DevSecOps Conference to explore DevSecOps further.