A friend of mine runs a small software shop, and last year he landed the deal his accountant had been dreaming about — a big enterprise customer, multi-year contract, the works. Then the customer’s procurement department sent over a security questionnaire, ninety-three questions long, and the deal quietly began to die. Not because his software was insecure. Because he could not show anything. Every answer was a variant of “yes, we’re careful”, and procurement departments do not accept careful as evidence. His story is the cleanest introduction to DevSecOps I know — the practice of running security checks inside delivery, with the delivery team owning them — because it shows exactly what the discipline produces: not vibes, receipts.
The symptom: a deal stuck on question forty
Watch what actually happened, because the pattern repeats in a thousand conference rooms. Questions one through ten went fine — company details, headcount, insurance. By question forty, the form wanted specifics. Show how your builds are protected. Show what a component list for your product looks like. Show that the artifact you deployed last week is the artifact your pipeline produced. Show who approves exceptions and when they expire. My friend had good answers to all of these in his head and zero of them on paper. Six weeks later the customer went with a competitor whose evidence folder was fatter. The product was probably worse. Nobody will ever know, because the comparison was between documentation and documentation.
What the diagnosis found
Sitting down with him afterwards, the gaps sorted themselves into three piles, and I would bet most teams would find the same ones.
- Claims without artifacts. Every security statement existed as a sentence in someone’s memory. Nothing existed as a file a stranger could read. Procurement was not asking for perfection; it was asking for anything that was not a promise.
- Trust placed at signing, never at deploy. He had heard of signing builds. What he could not show was a moment where anybody verified a signature, a component list, or a provenance record at the point where the software actually runs. A signature nobody checks is a claim with no audience.
- No history. Findings from past scans lived in an old engineer’s laptop, in formats nobody could query. There was no way to say “here is our track record of finding and fixing things”, because there was no track record anyone could see.
Notice what was not on the list: a lack of tools. He owned scanners. He had bought them after a conference, run them twice, and filed the results. Tools were never the missing ingredient — which matches what the field itself keeps saying about buying DevSecOps in a box: the purchase is the least of it. The unglamorous truth is that evidence is a by-product of routine, and he had plenty of tools and no routine. Everything the prescription below asks for is routine-shaped: things done on every build, reviewed every month, owned by name. That is also why the fix cannot be bought in an afternoon. Routines take a quarter to become boring, and boring is the goal — the questionnaire rewards teams whose evidence production is as unremarkable as their payroll.
The DevSecOps prescription, in order
The fix was unglamorous and it took about a quarter. If your own questionnaire day is approaching, here is the sequence, drawn from the discipline’s standard playbook.
- Three documents before any new software. A one-page gate policy stating what refuses a merge, a place to store scan findings in a queryable format (SARIF is the standard one), and an identity model for the pipeline machinery itself. These are day-zero artifacts across the field, and they answer roughly a third of any questionnaire on their own.
- Receipts on every build. Each artifact that comes off the pipeline now carries three things: a component list (the SBOM), a signature, and provenance records saying how it came together. Generating them is automated; the cost per build is minutes.
- Verification at the door. When an artifact deploys, the deploy step checks the receipts. This is the act that turns paperwork into practice — the proof that someone looked.
- Exceptions with owners and fuses. Every waiver carries a name and an expiry — ninety days is the common ceiling — and the register is reviewed monthly, because “how do you handle exceptions” is question forty-one in every form ever written.
- A few numbers, kept honestly. Provenance coverage: what share of deploys arrived with verifiable receipts. In one documented audit, 412 deploys went out and 398 arrived verified — a number that took minutes to produce and instantly answered the questionnaire’s hardest question.
What the next questionnaire looked like
The renewal conversation, a year later, ran differently. Ninety-three questions became an afternoon, because most answers pointed at artifacts: here is the policy, dated; here is the exception register, current; here is the coverage number, trending up. The buyer’s security team stopped asking whether the vendor was careful and started asking the better question — whether the vendor’s system was — and the system answered for itself. There is a second benefit nobody markets: the same receipts that satisfy procurement shorten the bad days. When the next component with a hole in it makes headlines, the team with the ledger knows in minutes whether it ships the thing. The team without one gets to enjoy the headline.
Three DevSecOps objections, answered honestly
My friend raised the three objections every reader is already drafting, so they may as well get answers.
“We’re too small for this.” The entry cost is three documents and a per-build habit, which is a smaller commitment than most teams’ lunch budget line. Nobody is asking a five-person shop for a governance board. The requirements scale down cleanly: one policy page, one findings store, receipts on builds, a verification step. Mid-size teams grow it without hiring by ring-fencing a slice of somebody’s week — a tenth, at most a fifth — for the champion role.
“Our customers never ask for any of this.” Yours is the last generation of customers that will be able to say that. The bar for what a component list must contain got revised upward in July 2026, when CISA and seventeen partner organisations reissued the minimum elements, and Europe’s Cyber Resilience Act — in force since late 2024 — makes its core duties binding from December 2027. Questionnaires trend one way only: longer. Building the evidence trail now, at leisure, beats building it during a deal that has already stalled.
“Isn’t this the security team’s job?” It is a shared job with a split that actually works: specialists set policy, tune the rules, and take the deep incidents; the teams building the software run the checks inside their own delivery flow. The research warning runs the other way — when security belongs entirely to someone else, builders experience it as weather, and DORA’s 2022 data connected that weak-practice state with burnout odds 1.4 times higher, while culture beat tooling as the predictor of adoption. Shared ownership is not a nicety. It is the configuration the numbers favor.
If you are still early, start smaller than you think
The whole journey above began with three documents and a per-build habit, none of which required a budget line or a reorg. The field’s definition is deliberately roomy — security carried inside delivery and owned by the people doing the delivering, with no late stage where the worry gets concentrated — and its own literature is candid that no standard or certificate blesses any particular version of it. What procurement departments reward is the evidence trail, and the evidence trail rewards you first. A compact map of the discipline, with the models and metrics behind this prescription, lives at xOps School’s DevSecOps page. And if your head needs clearing after a quarter of paperwork, Chennai is kind to the overworked: start with this rundown of the best of Chennai for a fun, memorable trip, go deeper with the full travel guide to attractions and heritage, and when someone asks how long the beach and the temples really need, the honest answer to how many days Chennai deserves is on this site too. Answer your questionnaire once, properly, and next year it will answer itself.
