Somewhere along the way, DevOps became a tooling conversation. Ask someone how mature their DevOps practice is and the answer will often involve CI/CD pipelines, automated testing, infrastructure as code, observability, deployment frequency, or some combination of the above. All valuable tools, but that is often where the conversation ends. They compartmentalize DevOps principles to a niche scenario and ignore those same principles when it comes to team dynamics, organizational design, strategy, product development, and so on. This becomes more obvious when we return to the Three Ways, commonly summarized as Flow, Feedback, and Continual Learning. These ideas are often explained through software delivery because that is where DevOps emerged, but nothing about them inherently limits their application to software tooling. They describe how information moves through a system, how the system learns what happened, and how that learning changes what happens next. It is essentially PDSA in ...
Security tooling has a familiar adoption problem. The organizations that need it most — the ones scaling fast enough that their attack surface is outgrowing their process — are often the same ones that can’t justify a sales call and a signed contract just to see whether a product fits. They want to turn it on, run it against real repositories, and see what it actually finds before anyone talks pricing. GitHub just made that path available to a lot more of them. The company raised the eligibility ceiling for self-serve GitHub Advanced Security (GHAS) trials, moving the cap from enterprises with up to 100 licenses to those with up to 300. Any GitHub Enterprise Cloud organization under that new threshold can start a 30-day trial directly from the “Billing and licensing” page in their enterprise settings, no sales conversation required. During the trial, an organization can add any number of committers and turn on both GitHub Secret Protection and GitHub Code Security acr...