Why DevSecOps matters more than ever for DoD & IC
DoD (Department of War, formerly Department of Defense) and Intelligence Community (IC) agencies face an unprecedented challenge: delivering secure, high-performing software in a world of evolving cyber threats, mission-critical timelines, and compliance-heavy environments.
Accelerating DevSecOps for the DoD and Intelligence Community is a four-part webinar series co-hosted by Merito and MFGS, Inc. that showcases how modernizing the SDLC with AI-driven automation, continuous security, performance engineering, and governance can dramatically improve mission readiness. (Click here to watch the 4-part webinar series)
Here’s a session-by-session breakdown with practical, tool-enabled strategies for engineers, architects, testers, and DevSecOps teams:
Session 1: Embedding AI in Application Security Testing
Theme: Strengthening the software supply chain with early, automated security
Modern federal software ecosystems are larger, more distributed, and more vulnerable than ever. This session demonstrates how OpenText Application Security Testing (formally Fortify) brings AI-driven application security testing to improve traditional AppSec methods by automating detection across code, open-source dependencies, and runtime risk.
Technical takeaways:
- Integrate AI-based SAST/DAST early in the pipeline
- Automate triage to reduce false positives
- Use ML-assisted correlation for root cause analysis
- Apply continuous scanning for software supply chain security
Key insights:
- AI reduces manual review workload, improving speed and accuracy
- Auto-detection of vulnerabilities supports shift-left security
- Ensures compliance across hybrid and legacy environments
- Improves risk posture and reduces late-stage remediation cost
Session 2: Accelerating Test Automation with AI-Driven Functional Testing
Theme: Speeding up releases without compromising quality
Functional testing is often a bottleneck for DoD/IC program teams. This session explores how OpenText Functional Testing (formally UFT One) leverages AI-powered functional test automation, enabling rapid regression and functional testing across complex applications to shorten delivery cycles.
See how OpenText Functional Testing can automate end-to-end business process tests across U.S. DoD ERPs such as SAP ECC/S/4HANA, Oracle E-Business, and PeopleSoft.
Technical best practices:
- Use AI to auto-generate tests from UIs, APIs, and workflows
- Implement self-healing locators to fix brittle scripts
- Use model-based and CI-triggered tests for continuous coverage
- Integrate test execution into CI/CD pipelines to eliminate manual gates
Executive insights:
- Eliminate repetitive manual tests
- Improve test coverage while maintaining consistency
- Detect defects earlier for faster releases
- Reduce costs associated with long QA cycles
Session 3: Ensuring Performance Readiness at Scale
Theme: Mission reliability requires mission-grade performance
This is where most agencies struggle and face bottlenecks. Where critical government systems must operate reliably, i.e. under load, under stress, and under real-world conditions, performance testing is often done too late or not at all.
In this session, learn how OpenText Performance Engineering (formally LoadRunner) has been used by the U.S. DoD to integrate performance engineering directly into CI/CD pipelines.
Technical learnings:
- Shift performance testing left alongside functional tests
- Use realistic workloads aligned with mission usage patterns
- Automate baseline drift detection
- Include performance thresholds as automated release blockers
Insights for Leaders:
- Performance is a security and readiness issue
- Automated load testing reduces deployment risk
- Proactive performance analysis avoids outages
- Helps maintain user trust across mission scenarios
Session 4: Continuously Improve Secure Software Delivery
Theme: Governance + security + automation = sustainable DevSecOps maturity
The final session ties all the components togethe: security, automation, testing, and governance, to show how federal agencies can build continuous, compliant, and secure delivery pipelines with OpenText Software Delivery Manager (SDM, formally ALM Octane).
Explore how SDM serves as an Agile/SAFe hub, enabling efficient management of backlogs, Program Increment (PI) planning, requirements, and test/defect lifecycles with complete traceability.
Technical patterns:
- Combine SAST, DAST, SCA, SBOM, functional tests, and performance tests into a single automated pipeline
- Use dashboards for audit logs, traceability, and real-time risk scoring
- Implement “compliance as code” for NIST/DoD frameworks
- Apply automated policy enforcement before deployment
Leadership insights:
- End-to-end visibility reduces risk across the SDLC
- Compliance and audit-readiness are built in, not bolted on
- Continuous delivery accelerates mission outcomes
- Integrated toolchains reduce fragmentation and operational cost
Why DoD & IC Leaders Should Watch the On-Demand Series
Whether you're driving modernization, overseeing software programs, or improving mission readiness, this series offers insights that can immediately impact your software delivery outcomes.
Watch all 4 on-demand sessions of “Accelerating DevSecOps for the DoD and Intelligence Community” for an actionable blueprint on:
- Modernizing legacy government SDLCs
- Improving compliance and audit readiness
- Accelerating capability delivery to the mission
- Reducing cost and risk through automation
- Strengthening cybersecurity through proactive, continuous testing
Click here to watch the 4-part webinar series
Webinar Q&A Highlights
Session I: Embedding AI in Application Security Testing
- Q: How do you connect Fortify SAST and DAST into Octane? Do security items show up as work items?
A: Start by configuring OpenText Application Security as the central hub for vulnerability management. Use API integration with SDM and AST to pull security data and create vulnerability work items in Octane. Avoid bulk uploads; instead, use scoped API tokens and webhooks for controlled sync. - Q: Is Fortify a static code analyzer? How does it handle app-level authorization?
A: Yes, Fortify SAST is a static analyzer, paired with DAST for dynamic testing. Scans use pipeline flags and variables to identify technologies and apply relevant rule packs. Configure GitHub Actions or CI/CD pipelines for tailored scans. - Q: In locked-down environments, how do you keep scans fast while enforcing security?
A: Use pipeline variables to limit scans to critical components and adjust depth based on deployment environment. This ensures fast CI/CD pipelines while maintaining DoD-compliant security.
Session II: Accelerating Test Automation with AI-Driven Functional Testing
- Q: Can we capture screen load timing?
A: Yes, transaction times can be captured in Functional Testing. For full application performance testing, explore Enterprise Performance Engineering solutions. - Q: Ramp-up time for technical users?
A: Tools are easy to adopt. For faster onboarding, Merito offers mentoring and training packages: classroom or hands-on. - Q: Licensing and Role-Based Access Control?
A: Licensed by seat or concurrent. No RBAC needed, governed by Active Directory. You can still test RBAC in client/server apps.
Session III: Ensuring Performance Readiness at Scale
- Q: How do you load test mainframe or middleware integrations?
A: LoadRunner supports 3270, MQ, Oracle, Siebel natively. For older middleware, use protocol-level correlation or custom DLLs approved under code-signing policies, something competitors can’t match. - Q: How to mimic production load in lower environments?
A: Use staging environments with similar infra and data subsets. Apply extrapolation models in Enterprise Performance Engineering to predict full-scale capacity. - Q: Can LoadRunner work in air-gapped environments?
A: Yes. All components run offline, licensed on-prem, with results shared via signed exports or PDFs through approved channels.
Session IV: Continuously Improve Secure Software Delivery
- Q: How can SDM and Octane reduce automation debt when adding security and performance tests?
A: Integration is plug-and-play or via CI/CD tools. Connect, follow best practices, select enterprise metrics, and accelerate adoption. We can help with planning. - Q: How does SDM filter “noise” vulnerabilities from Fortify?
A: Fortify filters low-impact issues, and SDM offers service packages to fine-tune prioritization for critical user journeys. - Q: Can SDM version test assets?
A: Yes. SDM supports versioning, comparison, promotion, and integrates with Git/SCM for asset storage.
