Topic starter
19/08/2026 3:37 pm
TL;DR: Security issues in software delivery often persist because development and security teams operate with different priorities, language, and tooling, making late-stage fixes expensive and demoralising, according to Probely. The practical challenge is not awareness but shared governance, because secure delivery fails when controls are bolted on after release pressure has already shaped the workflow.
Editorial analysis by NHI Mgmt Group, based on content published by Probely: “Speaking Different Languages: How to Align Dev and Sec Teams Effectively”.
By the numbers:
- 72% of vulnerabilities in web applications are detectable and preventable.
Key questions
Q: What should teams do first to reduce friction between DevOps and security teams?
A: The first step is to build a shared operating model.
Q: Why do security findings become more expensive when they appear late in the cycle?
A: Late findings force rework across code, testing, release scheduling, and stakeholder coordination.
Q: What breaks when developers and security teams use different terminology?
A: Misunderstood terminology leads to incorrect implementation, repeated clarification, and inconsistent application of controls.
Practitioner guidance
- Define a shared security vocabulary Create a cross-functional glossary for the terms that most often cause misinterpretation in code review, scanning, and remediation.
- Move security checks into the delivery workflow Embed scanning and policy checks into CI/CD so findings appear where developers already work, rather than in a separate security queue.
- Use joint planning to set shared priorities Hold planning sessions before implementation starts so security requirements, release dates, and acceptance criteria are agreed together.
Bottom line: The article frames DevSecOps friction as a coordination failure between delivery and security priorities, language, and timing rather than a simple lack of concern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
Development-security alignment is the real control plane of DevSecOps. The article is right to frame the issue as a mismatch in priorities and language rather than a simple shortage of tools. When teams do not share the same working vocabulary, security controls are translated badly or applied too late. The practitioner conclusion is that governance over the delivery process is itself a security dependency.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations do when security training does not change developer behaviour?
A: Replace abstract training with in-context remediation guidance tied to real findings in the developer workflow. Developers are more likely to absorb and apply a lesson when they see the issue in their own code and get a concrete fix path. That makes the learning immediate, relevant, and repeatable.
👉 Read our full editorial: Development-security alignment is the real DevSecOps bottleneck