This article is based on reporting originally published by devopsonline.co.uk, citing Computer Weekly.
From DevOps to DevSecOps: Why the Shift Is Happening
DevOps transformed how engineering teams build and ship software — but it also introduced a new problem. By automating infrastructure provisioning, deployment pipelines, and configuration management, teams gained speed. However, security and compliance often struggled to keep pace. The answer the industry has been converging on is DevSecOps: embedding security controls directly into the DevOps workflow rather than bolting them on after the fact.
As Computer Weekly noted, this evolution demands a new category of tooling — specifically, tools capable of automating IT policy management at scale. Manual policy enforcement cannot keep up with the velocity of modern CI/CD pipelines, and human review alone is no longer sufficient to catch every misconfiguration or compliance violation before it reaches production.
The Risk of Automating Bad Processes
One of the most important warnings for teams adopting DevSecOps comes from the nature of automation itself. Zubin Irani, CEO of cPrime, put it plainly in an interview with Computer Weekly:
“With automation, you can codify the same mistakes that people make in manual processes — you need a tool that can make sure the automation you build is doing the right things.”
Zubin Irani, CEO, cPrime
This is a critical insight. Automating a flawed or insecure process at scale doesn’t solve the problem — it amplifies it. DevSecOps tooling must therefore go beyond mere automation and actively validate that what is being automated conforms to policy.
HashiCorp’s Approach: Policy as Code with Sentinel
HashiCorp, best known for its open-source DevOps toolchain, introduced Sentinel as a policy-as-code framework integrated into the enterprise editions of its products. Rather than relying on documentation or manual checklists to enforce governance, Sentinel allows teams to write policies in code — policies that are evaluated automatically as part of the infrastructure or deployment workflow.
Sentinel takes an active enforcement approach: it does not simply report on policy violations after the fact but can block operations that violate policy from proceeding at all. This shifts compliance left, catching issues at the point of automation rather than in a post-deployment audit.
HashiCorp Tools That Integrate with Sentinel
Sentinel is available in the enterprise tiers of the following HashiCorp tools:
- Consul — Service discovery and service mesh, enabling secure service-to-service communication across dynamic infrastructure.
- Vault — Secrets management, controlling access to tokens, passwords, certificates, and encryption keys.
- Nomad — Workload orchestration and container scheduling across on-premises and cloud environments.
- Terraform — Infrastructure as code, provisioning and managing cloud and on-premises resources through declarative configuration files.
By embedding Sentinel across this toolchain, HashiCorp enables organisations to enforce consistent security and compliance policies regardless of which part of the infrastructure lifecycle is being automated.
What Policy as Code Means in Practice
Policy as code means writing governance rules in a machine-readable format that can be version-controlled, tested, and applied automatically — just like application code. In a Terraform workflow, for example, a Sentinel policy might:
- Prevent provisioning of publicly accessible storage buckets.
- Require that all virtual machines use approved machine image types.
- Enforce resource tagging standards for cost allocation.
- Block deployment to a production environment without an approved change ticket reference.
When a Terraform plan violates one of these policies, Sentinel can block the apply operation entirely, returning a clear policy failure message. This makes compliance a guardrail built into the pipeline, not an afterthought reviewed by a separate team weeks later.
Industry Adoption: Healthcare, Finance, and Retail
The sectors with the most pressing need for DevSecOps capabilities tend to be those operating under the heaviest regulatory requirements. According to the original reporting, HashiCorp was targeting verticals including data analytics, financial services, US healthcare payers, and retailers — industries where misconfigured infrastructure or leaked secrets carry significant legal and financial consequences.
In these environments, automated policy enforcement is not simply a developer convenience — it is a compliance requirement. The ability to demonstrate that every infrastructure change passed a codified policy check before being applied provides an auditable record that manual review processes cannot easily replicate.
Key Takeaways for DevOps Teams Considering DevSecOps
- Security must shift left. Catching policy violations at the pipeline stage is far cheaper and safer than remediating them in production.
- Automating a bad process makes it worse. Review your existing security and compliance processes before encoding them into automation.
- Policy as code is version-controllable and testable. Treat governance rules with the same engineering rigour as application code.
- Active enforcement matters. Reporting tools tell you what went wrong. Enforcement tools prevent it from happening in the first place.
- Toolchain integration is essential. Policy enforcement that covers only one part of your stack leaves gaps — aim for consistent governance across provisioning, secrets, scheduling, and networking.
DevSecOps is not a rebranding exercise. It represents a genuine architectural shift in how security and compliance are operationalised — moving from periodic, manual gates to continuous, automated enforcement embedded in every layer of the delivery pipeline.