How To Apply DevSecOps Shift-Left Security with OWASP ZAP

The talk starts from the problem that security testing usually arrives late in a traditional delivery pipeline, after software has already reached a test or production environment. The speaker frames shift-left security as a way to move checks closer to developers so they receive findings sooner, and argues this also improves collaboration among development, QA, operations and security staff. He briefly surveys tool categories along the pipeline, including static and composition analysis, dynamic testing, runtime protection, web application firewalls and cloud posture management.

The core of the presentation places ZAP as a proxy between QA testers and the application under test. Traffic produced by routine QA sessions passes through ZAP, which builds a vulnerability report that can go to developers instead of waiting for a separate penetration test. In a demonstration against OWASP Juice Shop, a deliberately vulnerable application, scripts drove a browser through the site while alerts populated in real time. The generated report mapped findings to CWE entries with remediation guidance.

The closing section argues that shift-left reduces remediation cost, speeds deployment, supports cross-functional collaboration and helps with compliance. During questions, the speaker explained that the demo scripts came from a public repository and needed only the target address changed. For practitioners, the takeaway is that existing functional tests can yield security findings when routed through an intercepting proxy.