Security as a key non-functional requirement of software development is often ignored and devalued in DevOps programs, with security seen as an inhibitor to high velocity required in DevOps implementation. Hence, the DevSecOps approach as a security-orientated expansion to DevOps, has aimed to integrate security into DevOps implementation by promoting collaboration among development, operation and security teams. DevSecOps is a topical concept and rapidly emerging area of practice in both academic and industrial settings. We reviewed both the white and grey literature to identify recent researches and practical trends of DevSecOps, aiming to: (a) review, document and analyze the current state of DevSecOps in the existing literature; (b) investigate the application of DevSecOps in Global Software Engineering (GSE) contexts. A Multi-vocal Literature Review on DevSecOps and its global application was conducted, by executing a dual-track strategy including white (104 studies) and grey (43 studies) literature from 2012 to 2021. A Thematic Analysis was performed to identify, synthesize and analyze the themes within data for reporting the MLR results. Through the Multi-vocal Literature Review and Thematic Analysis, this paper identifies five major aspects of DevSecOps (Definitions, Challenges, Practices, Tools/Technologies, and Metrics/Measurement); collects related themes of each aspect; and generates a Challenge-Practice-Tool-Metric (CPTM) model by integrating the themes of the latter four aspects within a lifecycle model. Moreover, an unexplored area relating to the global application of DevSecOps has been identified. Based on MLR results, a CPTM (Challenge-Practice-Tool-Metric) model is built to reveal the current status of DevSecOps. The model provides a breakdown and a broad landscape of DevSecOps, from which researchers and practitioners may select an area of focus to improve their knowledge or practice. With DevSecOps spanning the many stages of the lifecycle, we believe the model will enable emphases and absences such as global aspects to be investigated. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Driven by the need to coordinate activities of multiple agile development teams cooperating to produce a large software product, software-intensive organizations are turning to scaling agile software development frameworks. Despite the growing adoption of various scaling agile frameworks, there is little empirical evidence of how effective their practices are in mitigating risk, especially in global software development (GSD), where project failure is a known problem. In this study, we develop a GSD Risk Catalog of 63 risks to assess the degree to which two scaling agile frameworks–Disciplined Agile Delivery (DAD) and the Scaled Agile Framework (SAFe)–address software project risks in GSD. We examined data from two longitudinal case studies implementing each framework to identify the extent to which the framework practices address GSD risks. Scaling agile frameworks appear to help companies eliminate or mitigate many traditional risks in GSD, especially relating to users and customers. However, several important risks were not eliminated or mitigated. These persistent risks in the main belonged to the Environment quadrant highlighting the inherent risk in developing software across geographic boundaries. Perhaps these frameworks (and arguably any framework), would have difficulty alleviating, issues that appear to be outside the immediate control of the organization.

Agile software development has become increasingly common in software vendor organisations, and their impact on practices and roles is now extending beyond the project level across the entire organisation. In this study, we investigate how a major Australia-based multi-site global software vendor transitioned from a structured to a Scaled Agile approach.