Security

Security is not one product or one scan. It is a pile of habits that make mistakes less likely and incidents easier to contain.

For infrastructure and DevOps work, that often means small practical things: least-privilege access, short-lived credentials, private state files, patching, dependency checks, certificate expiry checks, and logging that is useful when something goes wrong.

Security also has a people problem. If the secure path is painful, people will route around it. The best controls fit into the workflow early enough that they stop bad changes before they become production clean-up.