Making security part of the delivery path.

The situation

A government digital platform in the UAE needed security within its delivery process. The work covered security gates at merge and deployment, a threat-modelling methodology, and developer training. The challenge was to connect technical checks with the decisions teams make while building and releasing software.

The decision

I focused on the points where code moves forward. A merge or deployment gate gives a check a concrete place in the workflow. Threat modelling adds a different perspective: it asks what could go wrong in the design, including risks that a static check or vulnerability scan cannot establish on its own.

Making it work

The programme combined SonarQube, ESLint and OpenVAS with a threat-modelling methodology and developer training. Automated checks supported the delivery gates. The methodology and training addressed the judgement needed to understand findings and make security decisions in context.

The result

Security gates became part of merge and deployment, with threat modelling and training alongside them. Together, those capabilities connected automated findings with the design context and developer understanding needed to act on them.

What I took forward

A gate needs a clear purpose and a team that understands it. Automated checks are most useful when developers can interpret the result and know how to proceed. Design review, tooling and training work together when they all support that same decision.