Question

A development team wants to accelerate releases by adopting a fully automated CI/CD pipeline that deploys code to production the moment unit tests pass. The security team is concerned that this removes the manual security review that previously caught misconfigurations. As the SOC lead advising on SecDevOps practices, which recommendation BEST balances deployment speed with security assurance without reintroducing a slow manual bottleneck?

Accepted Answer

Integrate automated security gates (SAST, dependency scanning, and policy-as-code checks) into the pipeline that fail the build when critical findings are detected

Answer

Require a security engineer to manually sign off on every commit before it can be merged to the main branch

Answer

Allow all deployments to proceed automatically and perform a security review of production quarterly

Answer

Disable the automated pipeline and revert to scheduled monthly releases with full manual testing