How DevSecOps Transformed the Dana Foundation’s Development Pipeline

This article is based on a case study originally reported by cioinsight.com, featuring Dana Foundation CIO James Rutt.

The Challenge: Waterfall Development and a Weak Security Posture

There is growing recognition that DevOps is critical for digital transformation. Yet, as many CIOs have learned, building a business and IT framework around agility and flexibility is genuinely difficult. Incorporating security into that framework—DevSecOps—raises the complexity further still.

The Dana Foundation, an endowment-based organization that funds neuroscience research and operates a publishing arm, faced exactly this challenge. CIO James Rutt identified three core problems with the foundation’s waterfall-based approach:

• High rework costs: Applications frequently required expensive, time-consuming fixes after the fact.
• No early-stage security: Security was not integrated into the development lifecycle, leaving vulnerabilities undiscovered until late in the process.
• Outdated tooling: The team was not using modern software development tools available at the time.

“It was very costly to rework applications that we were developing. There was no solid security posture early on in the development lifecycle, and we were not utilizing some of the most up-to-date software development tools available.”

— James Rutt, CIO, Dana Foundation

Two Critical Development Areas

The foundation’s web development workload falls into two main categories, both of which carry real operational and reputational risk:

1. Grant management systems: Applications used to oversee grantees and consultants who approve grants. These systems handle sensitive financial and operational data, making security a priority.
2. Publications and outreach: Rutt estimates that roughly 70% of the foundation’s web development supports its publications program, including its annual Brain Awareness Week campaign.

Adopting a DevSecOps Framework

After surveying the market and running a multi-month technology evaluation, the Dana Foundation selected a DevSecOps platform from CYBRIC and went live in early 2017. The platform takes a security-as-a-service approach: it creates exact replicas of application environments and scans them aggressively for vulnerabilities before code reaches production.

Rutt highlighted two primary goals for the initiative:

• Code quality: Reducing defects and the rework burden on developers.
• Code security: Specifically targeting well-known vulnerability classes catalogued in the OWASP Top 10, including cross-site scripting (XSS) and cross-site request forgery (CSRF).

Because the platform is cloud-based, integration into the existing development pipeline was straightforward and caused minimal disruption to ongoing work.

“We simply integrated the approach into our development pipeline. We are much better prepared to deal with today’s business and cyber-security environment.”

— James Rutt, CIO, Dana Foundation

Results: Fewer Vulnerabilities, More Productive Developers

According to Rutt, the DevSecOps initiative delivered measurable improvements across both of its stated goals:

• 40–50% reduction in code vulnerabilities compared to the previous development approach.
• Increased developer productivity through less time spent on rework and remediation.
• Improved security posture across grant management and public-facing web properties.

The Biggest Challenge: Developer Buy-In

Technology adoption was not the hardest part of the transformation. The most significant challenge was cultural: helping the development team understand why a DevSecOps model was worth the change in their daily workflow.

“Some of them didn’t know how a continuous delivery model works and how security could be integrated into the development lifecycle. Once we communicated the benefits of DevSecOps, the team became very excited about it. They realized their daily tasks and work would change, but that it was ultimately going to make their jobs easier and produce better and more secure code for the organization.”

— James Rutt, CIO, Dana Foundation

This experience is consistent with broader patterns in DevSecOps adoption: the tooling is often the simpler problem. Shifting the mental model of developers—from treating security as a late-stage gate to treating it as an integral part of every sprint—requires clear communication about concrete benefits rather than mandates from leadership.

Key Takeaways for DevOps and Security Teams

The Dana Foundation’s experience illustrates several principles that apply broadly to organizations considering a DevSecOps shift:

• Shift security left. Detecting vulnerabilities early in the development lifecycle is significantly cheaper and faster than remediating them post-deployment.
• Use concrete threat frameworks. Anchoring security requirements to a recognized standard like the OWASP Top 10 gives developers a tangible target and makes progress measurable.
• Prioritize pipeline integration. A DevSecOps tool that integrates cleanly into an existing CI/CD pipeline reduces adoption friction and speeds time-to-value.
• Invest in developer education. Teams that understand the “why” behind a security initiative are more likely to embrace it and sustain it over time.
• Cloud-based platforms lower the operational barrier. For organizations without large infrastructure teams, SaaS-based security scanning can accelerate adoption without heavy on-premises overhead.

For non-profit and mission-driven organizations in particular, DevSecOps offers a way to protect sensitive stakeholder data and maintain public trust without requiring the security headcount of a large enterprise.