DevSecOps Days Washington, D.C. 2026

Zero Trust is the de-facto standard for modern cybersecurity that helps organizations secure the ‘hybrid of everything’ technical estate spanning IT, OT, IoT, cloud, Artificial Intelligence (AI), data, and more. Come and learn the “what” and “why” of Zero Trust, a quick overview of capabilities, and particularly a holistic view of the SCRM/DevSecOps Capability in the upcoming Zero Trust Reference Model Standard. Numerous SCRM related breaches and the complexities of the diversity of platforms and dependencies make this a very complex and critical topic to maintain an organization’s security posture. Nikhil is a practitioner and thought leader who has taken multiple organizations on this journey, co-chairs the Zero Trust Working Group, and is co-author of the Zero Trust Playbook series. This presentation is recommended for leaders and practitioners to understand this rapidly evolving space and its implications.

Open Source Program Offices (OSPOs) are being increasingly adopted as approach to establishing and cultivating a culture of contribution at private and public sector organizations. The Digital Service at CMS.gov will share the programs, policies, and projects they’re building to identify and mitigate continuity and security risks in the software supply chain across the Federal Ecosystem. For more information visit: https://go.cms.gov/ospo

Sonatype's VP of Product Innovation Dr. Stephen Magill will discuss achieving regulatory compliance and security through effective SBOM (Software Bill of Materials) management. Learn which industry segments now require SBOM production and how to maintain compliance with relevant regulations. Discover best practices for retaining SBOMs throughout the software lifecycle, how to monitor them for vulnerabilities, and the importance of applying these same standards to third-party SBOMs. This talk goes beyond SBOM production to answer the critical question "I have an SBOM, now what?"

Software Bills of Materials, or SBOMs, are a hot topic when it comes to our so-called software supply chains. The promise of SBOMs is huge: know what you're running across all of your infrastructure and assess your exposure to a vulnerability in seconds. But without careful work by the community, we risk SBOMs become just another compliance gate that gives a false sense of security without commensurate value.

It’s no secret that running a DevSecOps pipeline typically requires significant resource investment, both time and money. This is especially problematic for open source projects and projects that simply do not have deep pockets. The good news is that DevSecOps doesn’t have to cost a lot! During this talk, we will demonstrate how to bootstrap a project with a full DSO pipeline, using only containers and free/open source tools. We will also demonstrate the excellent properties our approach has for security, scalability, and reproducibility across environments as the project grows in size.