DevSecOps training on the stack your team actually runs
Hands-on workshops for engineering, platform and DevOps teams, built on your own pipelines, infrastructure code and cloud setup. Security that fits into delivery instead of standing in front of it.
Overview
Why generic DevSecOps courses rarely change a pipeline
Most DevSecOps courses teach a reference pipeline that looks nothing like yours. Engineers nod along, go back to their own repositories and change very little, because translating the lesson to their tooling is left to them on a busy week.
Black Fox trains on your stack. We look at your pipelines, infrastructure code, container images and cloud configuration before the workshop, and build the exercises around them. The material comes from what we find when we test and review systems like yours: leaked secrets in build logs, over-privileged pipeline tokens, permissive cloud defaults, unpinned dependencies and security checks that everyone has learned to ignore.
The aim is practical. Participants leave knowing which checks belong where, how to keep them fast and quiet enough that people read the results, and how to bring threat modelling into planning without a separate meeting nobody attends.
Who it is for
Engineering, platform and DevOps teams that own pipelines, infrastructure code and cloud environments, organisations introducing DevSecOps practices and wanting their teams to carry them, and companies preparing for customer security reviews, penetration tests or frameworks that expect secure development training.
The work, from scoping to evidence.
What we do
Security in CI/CD pipelines
Hardening the pipeline itself and the checks it runs: runner and token permissions, protected branches, signed artefacts, and where static analysis, dependency and image scanning fit, using tools such as the ones you already have.
Infrastructure as code
Common misconfigurations in Terraform, Kubernetes manifests or Helm charts, among others, how policy checks catch them before deployment and how to review infrastructure changes like application code.
Container and cloud configuration
Minimal and patched images, runtime privileges, network exposure, identity and access in the cloud, logging, and the defaults worth changing on day one.
Dependencies and supply chain
Known-vulnerable and abandoned packages, pinning and update routines, software bills of materials, provenance and what to do when an upstream package is compromised.
Secrets handling
Keeping credentials out of code, images and logs, using a secrets manager, short-lived credentials, detecting leaks in history and rotating without an outage.
Gates and threat modelling in the team's rhythm
Deciding which findings block a build and which only report, tuning checks to cut noise, and short threat modelling sessions that fit into refinement or design review.
How the engagement runs
Kickoff
We agree the teams, the topics, the format and the language, and sign an NDA first if you need one.
Stack review
We look at a sample of your pipelines, infrastructure code and cloud setup, under access you control, to choose the examples and exercises that matter for you.
Tailoring
We build the workshop around your tools, your platforms and the issues we found, at a depth that suits the participants.
Workshops
Hands-on sessions online or on site, in English, German or French, with exercises on your own repositories or on a safe copy of them.
Follow-up
A summary of what was covered, the issues that came up and practical next steps, plus time for questions once the team has tried the changes.
What you receive
- Training plan agreed with your engineering leads
- Workshops tailored to your stack and tooling
- Exercises and examples based on your own pipelines and infrastructure
- Training materials and reference checklists for your teams
- Summary of issues observed and recommended next steps
- Attendance records, and a certificate of attendance on request
Questions
How is this different from your DevSecOps consulting?
The consulting service changes your process and tooling with your teams. This training builds the skills your engineers need to run and extend those practices themselves. Many clients combine the two.
Do you need access to our systems?
It helps. A read-only look at a sample of pipelines and infrastructure code lets us build exercises on real examples. If that is not possible, we use realistic examples matched to your tools and platforms.
Which tools do you cover?
The ones your teams use, where we can. We teach the principles with your CI/CD platform, cloud provider and scanners as examples, and suggest open-source or commercial options where something is missing.
Is this a certification course?
No. Black Fox does not issue official certifications. Participants receive the materials, and we can provide a certificate of attendance on request.
Related services
- Advisory and responseDevSecOps and secure developmentDevSecOps from Black Fox Security: secure SDLC, threat modelling, code review, security in CI/CD, dependency and secret scanning, and developer training.
- Advisory and responseSecure coding trainingSecure coding training from Black Fox Security: OWASP Top 10 vulnerability classes, secure design and code review, and security tests, in your team's stack.
- Advisory and responseSecurity awareness trainingTraining from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management.
- Advisory and responseCyber hygiene trainingPractical cyber hygiene training from Black Fox Security: passwords, MFA, phishing, updates, data handling and remote work, tailored to your tools.
Train your engineers on their own pipelines
Tell us how your teams build, deploy and run software today. We will propose workshops that fit your stack and your delivery rhythm.