---
title: "A7: Security Testing in Agile Teams and CI"
canonical: https://openvapt.com/academy/a7.html
html: https://openvapt.com/academy/a7.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A7: Security Testing in Agile Teams and CI

How short development cycles change security testing, and how scan baselines, exit codes and SARIF output let a pipeline catch regressions.

- Level: Applied
- Time: about 25 minutes
- Read first: A2

## You Will Be Able To

- Explain why security checks move earlier and run more often in agile teams.
- Use a baseline and exit codes to fail a build only on new problems.
- Read SARIF output in a code review tool.

## Small Changes, Often

Agile teams ship small changes every week or every day. A security review once a year cannot keep up, so checks run with every change instead.

Testing earlier is often called shifting left. A weakness found in a pull request costs minutes; the same weakness found in production costs an incident.

## Regression Testing

A regression is something that worked and broke again. Keeping each report and comparing it with the next shows new findings at once.

With openvapt scan --baseline old.json, or openvapt diff, the team sees what is new, what was fixed and what is still open.

## Gates in a Pipeline

A pipeline needs a clear yes or no. OpenVAPT returns exit code 3 when a finding reaches the --fail-on severity, and 4 when coverage is incomplete; an incomplete scan takes precedence over findings.

Accepted risks go in a suppression file with a reason and an expiry date, so they stop blocking builds without disappearing silently.

## Where OpenVAPT Fits

OpenVAPT assesses the machine it runs on. In a pipeline, that means a test server or a container image built from the same configuration as production.

SARIF output lets code review tools show findings next to the change that caused them.

## In Summary

Run checks with every change, compare each report with a baseline, fail builds only on new serious findings, and record accepted risks with an expiry.

## Apply It

- [WEB-CVE-001 Vulnerable Web Application Libraries](https://openvapt.com/checks/WEB-CVE-001.md) (high)

## Lab

1. `Run: openvapt demo vulnerable --out a7a and openvapt demo hardened --out a7b, then openvapt diff a7a/report.json a7b/report.json.`
2. `Run: openvapt demo vulnerable --fail-on critical --out a7c; echo $? and explain the exit code.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. What does shifting left mean?
   - A. Moving servers to another data centre
   - B. Testing earlier in development, close to each change
   - C. Running tests only before release
   - D. Writing code from left to right
   - Answer: B. Earlier tests find problems while they are cheap to fix.

2. What is a regression?
   - A. A new feature
   - B. Something that worked and broke again
   - C. A slow test
   - D. An old report
   - Answer: B. Comparing reports over time catches regressions.

3. Which exit code means findings reached the --fail-on severity?
   - A. 0
   - B. 2
   - C. 3
   - D. 6
   - Answer: C. Exit code 3 signals unsuppressed findings at or above the chosen severity.

4. How should an accepted risk be handled in a pipeline?
   - A. Delete the check
   - B. Record it in a suppression file with a reason and an expiry
   - C. Turn off the pipeline
   - D. Lower every severity
   - Answer: B. Suppressions keep the decision visible and make it expire.

5. What is SARIF used for?
   - A. Encrypting reports
   - B. Showing findings in code review and analysis tools
   - C. Compressing logs
   - D. Signing releases
   - Answer: B. SARIF is a standard format that review tools can display.

## Key Terms

- Shift Left: Moving testing earlier in development, so problems are found close to the change that caused them.
- Regression Testing: Re-running tests after a change to catch things that used to work and broke again.
- Baseline: A previous report or known-good state used for comparison, so changes and regressions can be seen.
- SARIF: Static Analysis Results Interchange Format: an OASIS standard JSON format for tool findings.

## References

- [OASIS, Static Analysis Results Interchange Format (SARIF) Version 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html)
- [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)

Offline: `openvapt learn A7`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a7.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.