Topic starter
19/08/2026 3:37 pm
TL;DR: Different priorities, language, and tooling keep DevSecOps friction alive, according to Probely. Bringing security guidance into the developer workflow can cut rework and make fixes easier to apply before release pressure hardens the process.
Editorial analysis by NHI Mgmt Group, based on content published by Probely: “Speaking Different Languages: How to Align Dev and Sec Teams Effectively”.
By the numbers:
- 72% of vulnerabilities in web applications are detectable and preventable.
Key questions
Q: Why do security findings become more expensive when they appear late in the cycle?
A: Late findings force rework across code, testing, release scheduling, and stakeholder coordination.
Q: What breaks when developers and security teams use different terminology?
A: Misunderstood terminology leads to incorrect implementation, repeated clarification, and inconsistent application of controls.
Q: What should teams do first to reduce friction between DevOps and security teams?
A: The first step is to build a shared operating model.
Practitioner guidance
- Define a shared security vocabulary Create a cross-functional glossary for the terms that most often cause misinterpretation in code review, scanning, and remediation.
- Move security checks into the delivery workflow Embed scanning and policy checks into CI/CD so findings appear where developers already work, rather than in a separate security queue.
- Use joint planning to set shared priorities Hold planning sessions before implementation starts so security requirements, release dates, and acceptance criteria are agreed together.
Bottom line: The article frames DevSecOps friction as a coordination failure between delivery and security priorities, language, and timing rather than a simple lack of concern.
Glossary terms: DevSecOps, Shift Left, Developer-First Security, Workflow translation gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:17 pm
Development-security alignment is the real control plane of DevSecOps. The article is right to frame the issue as a mismatch in priorities and language rather than a simple shortage of tools. When teams do not share the same working vocabulary, security controls are translated badly or applied too late. The practitioner conclusion is that governance over the delivery process is itself a security dependency.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations do when security training does not change developer behaviour?
A: Replace abstract training with in-context remediation guidance tied to real findings in the developer workflow. Developers are more likely to absorb and apply a lesson when they see the issue in their own code and get a concrete fix path. That makes the learning immediate, relevant, and repeatable.
👉 Read our full editorial: Development-security alignment is the real DevSecOps bottleneck