Home / Knowledge hub / Shift left
Knowledge hub
Shift left
Doing security work while code is written, not as a check at the end.
What it means
Shift left means doing security work earlier, while people write the code, rather than as a check at the end. The name comes from drawing a project left to right and moving the work towards the start.
In practice it looks small. A check on a pull request, a dependency alert in the editor, a review question while the author still remembers the change.
Why it matters
The argument is cost, and it holds. A flaw caught in a pull request costs the author a few minutes. The same flaw in production costs a fix, a release, possibly a note to customers, and a meeting about how it got there.
A softer benefit follows. Feedback that arrives while somebody is still in the code teaches them something. Four months later it is just a chore. None of this removes the need for testing afterwards. Code that is safe on its own still combines into something unsafe, and only the assembled application shows that.
How it shows up
Shifting left goes wrong when it turns into shifting blame. If every build fails on a hundred low quality warnings, developers learn to skip the step, and the earlier check has made things worse.
It works when what appears in a pull request is small, specific and believable: this line, this input, this is what it does. Earlier only helps when it is also true. Start with one check developers agree is worth it, then add more once the first has earned trust. Turning everything on at once is how a team switches the whole idea back off. See gating a build.
Questions people ask
Shift left, answered
Does shifting left actually reduce vulnerabilities?
It reduces the cost of the ones it catches, which is a real saving. Whether it reduces the total depends entirely on whether developers act on the output.
Teams running it report that the volume of findings often becomes the problem in its own right.
Why do developers dislike shift left security?
Because it usually arrives as more work measured against the same delivery targets, and because a good deal of what it reports is not real.
A hundred low quality warnings on a pull request teaches people to skip the step entirely.
If we shift left, can we stop testing later?
No. Safe components combine into unsafe behaviour, and only the assembled, running application shows that.
Earlier checks reduce what reaches the later ones. They do not replace them.
What should we shift left first?
One check your developers agree is worth it. Secret detection and dependency alerts usually qualify, because both are specific and hard to argue with.
Add more once people trust the first one.
Is shift left the same as DevSecOps?
Related, not identical. Shift left describes when the work happens. DevSecOps describes how security, development and operations share it.
OWASP publishes a guideline on the second, which is the harder half.
Related
Terms that sit next to this one
Earlier checks, but are they true?
Cyberlop tests a running build and compares each run against the last, so a change that quietly reintroduces a flaw comes back marked as a regression. Talk to us about your pipeline.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.