Carahsoft’s Fourth annual DevSecOps Conference wrapped up last week in Reston, Virginia, bringing together federal CIOs, CISOs, and program leaders from the Army, Air Force, Navy, General Services Administration (GSA), Government Accountability Office (GAO), the Department of Agriculture, and the National Institute of Standards and Technology for a day of discussions about the future of government software development. A recurring theme throughout the conference was that agencies are no longer debating how to modernize software development processes. Instead, they are fully committed to building software development pipelines without sacrificing speed or security. While speakers represented different agencies and missions, three key takeaways emerged throughout the day.
Shifting Toward Industry Standards
Gabe Chiulli, the Acting CIO of the United States Army, set the tone for the day during the opening keynote, “CIO Perspective: Army’s Vision for DevSecOps.” His goal is to bridge the gap between commercial speed and government software delivery, and engage with industry more, and build an environment that’s attuned to the needs of the next generation of workers. This means making it easier for vendors, especially smaller, more agile companies, to work with the Army instead of getting slowed down by paperwork, while creating real pathways for “digital natives” who expect to move quickly. As Chiulli put it, “I’m trying to set industry up for success to actually engage with us. We’re setting the framework in place to move out rapidly.”
This intent on aligning with industry extends to civilian agencies as well. Ed McLaughlin, Director of Platform and Product Security for GSA’s Login.gov platform, described his agency as waterfall in compliance but agile in delivery during the “Snapshots and Use Cases in DevSecOps” keynote. To shorten assessment timelines from three to five months to just three to five weeks, he described Login.gov’s ongoing risk assessments as a “significant game changer.” He noted that the current pace is simply not “market speed.” His remarks reaffirmed the conference’s broader theme: agencies are embedding security and compliance earlier in the software development lifecycle so that governance can keep pace with delivery rather than slow it down.
AI as a Mission Partner, Not a Replacement
AI was one of the conference’s most discussed topics, but the speakers focused more on who is ultimately accountable for the outcomes rather than on what AI can do. The message was the same for both civilian and defense agencies: AI is a tool to accelerate software development, not a substitute for human judgement and expertise.
Kurt Jarvis, CTO of the Air Force Sustainment Center Software Directorate, compared AI to a new intern, explaining that while AI can boost productivity, it still requires oversight. “When I look at AI, I don’t see it very much different than the new intern that we brought in,” he said. He connected this to a familiar practice on his team: “We’ve been doing paired programming in development for a while. Instead of paired programming with another person, I’m a pairing programmer programming with an AI agent.” Jarvis explained that this approach holds AI accountable to the same standards as any new hire, ensuring “the right engineering rigor inside of our process” while using it [AI] to speed up tasks that would normally be done manually. Jarvis emphasized that AI has not changed his team’s engineering standards or DevSecOps requirements. Instead, it allows teams to execute established processes faster. “I’m not changing my [DevSecOps] pipeline. I’m just making the pipeline run more often, and I’m running it faster.”
This human-in-the-loop approach extends across agencies. Leroy Mrozowski, Software Modernization Lead at the Naval Surface Warfare Center Dahlgren Division, said developers keep the final authority over AI-generated recommendations, with teams rejecting roughly 70 percent of AI generated code before it reaches production. GAO’s Director of IT and Cybersecurity, Kevin Walsh, said that developers shouldn’t hesitate to reject AI recommendations. “If you have a 100% acceptance rate, that’s going to be some ugly code,” he said.
Building a Shift-Left Culture
The conference reinforced a “shift-left” as a cultural approach to DevSecOps, not just a procedural one, where security is integrated throughout the software lifecycle rather than a bottleneck at the end of development. Agencies discussed generating a software bill of materials (SBOMs) during development, verifying code provenance, and applying the same supply chain scrutiny to AI-generated code that they do to code written by humans.
That same philosophy extends beyond technology to the workforce. Jarvis emphasized that secure software delivery depends as much on disciplined processes and culture as it does on tools, arguing that engineers, developers, and AI systems all need to operate under the same engineering standards and mission objectives. In other words, shifting security to the left isn’t just changing the pipeline – it’s a change in how teams think about security from the start.
Moving DevSecOps Forward
One thing that became clear from the discussions at the fourth annual DevSecOps Conference was that federal agencies are moving toward a software development model that prioritizes commercial agility without compromising security. Speakers agreed that the future of DevSecOps relies on balancing speed and discipline, whether that means embracing industry practices, adopting AI with humans in the loop, or embedding security throughout the development lifecycle.