DevSecOps Days Washington, D.C. 2026

DevSecOps transformed how we build software. Security entered the development pipeline, controls moved closer to engineers, and organizations became better at discovering defects before deployment. But while security moved left, production kept moving—becoming faster, more automated, more interconnected, and increasingly difficult for any individual or team to fully understand.

Many of the most consequential hazards emerge after deployment, where real traffic, hidden dependencies, operational tooling, human judgment, automation, and customer demand collide. Architecture diagrams describe work as imagined, while engineers and operators continually adapt to work as done. The rise of AI agents further expands this runtime gap as agents begin participating in diagnosis, decision-making, and operational action. When humans and agents hold different assumptions about system state, scope, evidence, or recovery, ordinary work can create customer harm at machine speed.

This session introduces Operational Safety Engineering, a discipline focused on preventing customer harm whether the cause is malicious, accidental, or the result of system complexity. Drawing on safety science, resilience engineering, human factors, chaos engineering, AI safety, and experience operating hyperscale cloud services, Aaron Rinehart will show how teams can investigate complex systems in production, surface hidden hazards through novel instrumentation, develop deeper learning from high-severity incidents, and establish safe operating expectations for human–AI workflows.

Attendees will learn how to extend DevSecOps into the live system, identify complexity-shaped hazards that traditional security and reliability practices may miss, and design cloud services—and the AI agents operating within them—to fail safely while limiting customer harm. Security moved left. Now our learning must move into production.