DevSecOps Days Washington, D.C. 2026

Join us for breakfast and start networking with your fellow attendees!

Welcome to DevSecOps Days Washington, D.C. 2026!

Modern systems are no longer just software and hardware, instead, a wide variety of artifacts—including AI models, data sets, and services—participate in the supply chain, opening many new vectors for exploits. Obtaining and maintaining accurate metadata is going to be key to efficiently managing the intelligence and processes required to keep modern systems safe and secure. This talk will review some of the best practices identified so far, and discuss how ISO/IEC DIS 5962 and future versions of SPDX will help facilitate the collection and analysis of key metadata for systems with safety elements to be managed.

Your intelligent application is your castle, and your security practices are the moat that protects it. Inside your castle, you must aim for full visibility into what you’re running and why, with freedom to iterate. Your moat creates your security perimeter, ensuring no proprietary data leaves your castle and enforcing best practices including data provenance, cryptographically signed models, evaluation tools, build pipelines and reproducible environments.

Build on your infrastructure, answer to your requirements, scale on your terms.

Get a refresher on your coffee and rejoin the session!

The presentation will cover the evolving posture of DevSecOps in the context of Zero Trust as a core capability of the upcoming update to the Zero Trust Reference Model. It will also cover the evolving role of DevSecOps in the context of ecosystem architectures and touch on the SCRM implications. It will also cover the role of Zero Trust and DevSecOps in the context AI, especially focusing on LLMs, Agentic, Machine Learning and embodied intelligence.

Container orchestration in air-gapped environments has been a technical barrier slowing its adoption in highly regulated industries. In this talk we'll discuss a basic solution to achieve moving resources (like Helm Charts, OCI Images, etc.) to show the "old school" method, then transition to discussion of two open-source projects that vastly improve the experience of managing platforms in the disconnected network. We'll discuss the differences
between the two and use cases for each.

Lunch for all attendees

DevSecOps transformed how we build software. Security entered the development pipeline, controls moved closer to engineers, and organizations became better at discovering defects before deployment. But while security moved left, production kept moving—becoming faster, more automated, more interconnected, and increasingly difficult for any individual or team to fully understand.

Many of the most consequential hazards emerge after deployment, where real traffic, hidden dependencies, operational tooling, human judgment, automation, and customer demand collide. Architecture diagrams describe work as imagined, while engineers and operators continually adapt to work as done. The rise of AI agents further expands this runtime gap as agents begin participating in diagnosis, decision-making, and operational action. When humans and agents hold different assumptions about system state, scope, evidence, or recovery, ordinary work can create customer harm at machine speed.

This session introduces Operational Safety Engineering, a discipline focused on preventing customer harm whether the cause is malicious, accidental, or the result of system complexity. Drawing on safety science, resilience engineering, human factors, chaos engineering, AI safety, and experience operating hyperscale cloud services, Aaron Rinehart will show how teams can investigate complex systems in production, surface hidden hazards through novel instrumentation, develop deeper learning from high-severity incidents, and establish safe operating expectations for human–AI workflows.

Attendees will learn how to extend DevSecOps into the live system, identify complexity-shaped hazards that traditional security and reliability practices may miss, and design cloud services—and the AI agents operating within them—to fail safely while limiting customer harm. Security moved left. Now our learning must move into production.

1. Software supply chain risk is no longer a periodic audit exercise—it is a primary driver of rework, schedule slips, and degraded mission readiness. As government organizations and their industry partners strive to deliver software faster while navigating increasingly complex threats and software ecosystems, teams need practical controls that improve delivery predictability without slowing development.

In this session, Thomas Tapley, Product Manager at Sonatype, explains how leading organizations are moving from disconnected point solutions to an integrated software supply chain management approach that spans the full software development lifecycle.

Attendees will learn a practical operating model to:
Prevent malicious or high-risk components from entering development environments through controlled intake and pre-use protections.
Govern component selection with automated, policy-driven enforcement across developer workflows, CI/CD pipelines, and release processes.
Prove software readiness through continuously updated SBOMs and real-time visibility into software supply chain risk.

Using real-world examples and lessons learned, this session demonstrates how organizations can reduce costly rework, respond more quickly to newly disclosed vulnerabilities, and deliver mission software on time and on budget—without sacrificing security, developer productivity, or operational resilience.

Take a short break and get ready for the last few sessions

Coming soon!

Wrap-up of the day's sessions