DevSecOps Days Washington, D.C. 2026

Modern systems are no longer just software and hardware, instead, a wide variety of artifacts—including AI models, data sets, and services—participate in the supply chain, opening many new vectors for exploits. Obtaining and maintaining accurate metadata is going to be key to efficiently managing the intelligence and processes required to keep modern systems safe and secure. This talk will review some of the best practices identified so far, and discuss how ISO/IEC DIS 5962 and future versions of SPDX will help facilitate the collection and analysis of key metadata for systems with safety elements to be managed.

DevSecOps transformed how we build software. Security entered the development pipeline, controls moved closer to engineers, and organizations became better at discovering defects before deployment. But while security moved left, production kept moving—becoming faster, more automated, more interconnected, and increasingly difficult for any individual or team to fully understand.

Many of the most consequential hazards emerge after deployment, where real traffic, hidden dependencies, operational tooling, human judgment, automation, and customer demand collide. Architecture diagrams describe work as imagined, while engineers and operators continually adapt to work as done. The rise of AI agents further expands this runtime gap as agents begin participating in diagnosis, decision-making, and operational action. When humans and agents hold different assumptions about system state, scope, evidence, or recovery, ordinary work can create customer harm at machine speed.

This session introduces Operational Safety Engineering, a discipline focused on preventing customer harm whether the cause is malicious, accidental, or the result of system complexity. Drawing on safety science, resilience engineering, human factors, chaos engineering, AI safety, and experience operating hyperscale cloud services, Aaron Rinehart will show how teams can investigate complex systems in production, surface hidden hazards through novel instrumentation, develop deeper learning from high-severity incidents, and establish safe operating expectations for human–AI workflows.

Attendees will learn how to extend DevSecOps into the live system, identify complexity-shaped hazards that traditional security and reliability practices may miss, and design cloud services—and the AI agents operating within them—to fail safely while limiting customer harm. Security moved left. Now our learning must move into production.