DevSecOps Principles Can Be Adapted to Secure AI and GenAI Pipelines

Generative AI and large language model systems introduce new security threats — including prompt injection, data poisoning, and model extraction — that go beyond traditional application vulnerabilities. Security practitioners argue that DevSecOps principles, already proven in CI/CD pipeline security, can be adapted to address these AI-specific risks. Key practices include shifting security checks left into data collection and model training stages, applying automated vulnerability scanning to AI frameworks and datasets, and enforcing strict access controls over model querying and deployment. Threat modeling, a standard DevSecOps discipline, should also be applied to AI systems before adversarial risks are exploited in production. The core argument is that securing AI requires embedding security across the entire model lifecycle — from data ingestion through deployment and ongoing monitoring.