If you have an important implementation date, early identification of the minimum viable product is a vital risk-management step that helps focus your team’s attention on what's important. Rather than apologizing for intelligent phasing of functionality to manage risk, explain it to stakeholders and take credit.

For many organizations, traditional testing groups are separated from the IT security group. But having traditional testers perform some security testing efforts is a great way of achieving a balanced approach to shifting left while being mindful of staffing and budgetary challenges. It also has some great advantages.

"Continuous" gets mentioned a lot in agile and DevOps, but one area that often doesn’t get enough attention is how to continuously build, test, and deliver secure applications. Just like for quality, you can’t test security in, so you need to have a plan for how to build it in. Here are some tips on how to do that.