DevSecOps Days Washington, D.C. 2026

Your intelligent application is your castle, and your security practices are the moat that protects it. Inside your castle, you must aim for full visibility into what you’re running and why, with freedom to iterate. Your moat creates your security perimeter, ensuring no proprietary data leaves your castle and enforcing best practices including data provenance, cryptographically signed models, evaluation tools, build pipelines and reproducible environments.

Build on your infrastructure, answer to your requirements, scale on your terms.

Container orchestration in air-gapped environments has been a technical barrier slowing its adoption in highly regulated industries. In this talk we'll discuss a basic solution to achieve moving resources (like Helm Charts, OCI Images, etc.) to show the "old school" method, then transition to discussion of two open-source projects that vastly improve the experience of managing platforms in the disconnected network. We'll discuss the differences
between the two and use cases for each.

1. Software supply chain risk is no longer a periodic audit exercise—it is a primary driver of rework, schedule slips, and degraded mission readiness. As government organizations and their industry partners strive to deliver software faster while navigating increasingly complex threats and software ecosystems, teams need practical controls that improve delivery predictability without slowing development.

In this session, Thomas Tapley, Product Manager at Sonatype, explains how leading organizations are moving from disconnected point solutions to an integrated software supply chain management approach that spans the full software development lifecycle.

Attendees will learn a practical operating model to:
Prevent malicious or high-risk components from entering development environments through controlled intake and pre-use protections.
Govern component selection with automated, policy-driven enforcement across developer workflows, CI/CD pipelines, and release processes.
Prove software readiness through continuously updated SBOMs and real-time visibility into software supply chain risk.

Using real-world examples and lessons learned, this session demonstrates how organizations can reduce costly rework, respond more quickly to newly disclosed vulnerabilities, and deliver mission software on time and on budget—without sacrificing security, developer productivity, or operational resilience.

Coming soon!