Security Testing in Agile Teams and CI

Small Changes, Often

Agile teams ship small changes every week or every day. A security review once a year cannot keep up, so checks run with every change instead.

Testing earlier is often called shifting left. A weakness found in a pull request costs minutes; the same weakness found in production costs an incident.

Regression Testing

A regression is something that worked and broke again. Keeping each report and comparing it with the next shows new findings at once.

With openvapt scan --baseline old.json, or openvapt diff, the team sees what is new, what was fixed and what is still open.

Gates in a Pipeline

A pipeline needs a clear yes or no. OpenVAPT returns exit code 3 when a finding reaches the --fail-on severity, and 4 when coverage is incomplete; an incomplete scan takes precedence over findings.

Accepted risks go in a suppression file with a reason and an expiry date, so they stop blocking builds without disappearing silently.

Where OpenVAPT Fits

OpenVAPT assesses the machine it runs on. In a pipeline, that means a test server or a container image built from the same configuration as production.

SARIF output lets code review tools show findings next to the change that caused them.

In Summary

Run checks with every change, compare each report with a baseline, fail builds only on new serious findings, and record accepted risks with an expiry.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo vulnerable --out a7a and openvapt demo hardened --out a7b, then openvapt diff a7a/report.json a7b/report.json.
2. Run: openvapt demo vulnerable --fail-on critical --out a7c; echo $? and explain the exit code.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OASIS, Static Analysis Results Interchange Format (SARIF) Version 2.1.0
• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). A7: Security Testing in Agile Teams and CI (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a7.html

@misc{openvapt_a7,
  author       = {{OpenVAPT}},
  title        = {{A7: Security Testing in Agile Teams and CI}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/a7.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}