Static analysis of your source for injection, unsafe deserialisation and weak crypto, shown inline on the pull request.
Pull requestXcellOps|DevSecOps
Security in every commit, not a gate at the end.
XcellHost DevSecOps puts code, dependency, secrets, infrastructure and container checks into the pipelines your developers already use — then signs what you ship, proves how it was built and watches it in production. Findings are triaged by our engineers, so developers see the few that matter.
SAST, SCA & secrets in every PR
IaC & container image scanning
SBOM in CycloneDX or SPDX
Signed builds with provenance
Kubernetes policy-as-code
Runtime protection & DORA metrics
✦Ask AI about DevSecOpsChatGPTClaudePerplexityGoogle AICopilot
Merge blocked2 must-fix findings
sample-app · pull request #482
PIPELINE
01Pull request scanned
Sample data
Checks run0
Findings0
Must-fix—
XcellHost DevSecOps · MumbaiFindings triaged by the 24×7 SOC
Since 1999ISO 27001 & 20000-1SOC 2 Type I & IIMeitY empanelledTier IV data centre, Mumbai24×7 NOC + SOC
Overview
Shift left to catch it early. Shift everywhere to keep it caught.
Most security problems are cheapest to fix in the editor and most expensive in production. Shift-left moves checks to where code is written: the pull request, the dependency update, the Terraform plan. But a clean build can still be tampered with, misconfigured at deploy or attacked at runtime — so shift-everywhere adds controls to the build system, the artifact, the cluster and the running workload.
XcellHost DevSecOps runs both as a service. We wire the scanners into GitLab™, GitHub™, Jenkins™ or Azure DevOps™, tune the rules so developers are not buried in noise, generate an SBOM for every release, sign artifacts and enforce the result in Kubernetes. Our application-security engineers triage findings and our 24×7 SOC in Mumbai watches what runs.
Where the checks sit
- IDE & pre-commitsecrets, lint rules
- Pull requestSAST · SCA · IaC
- Buildimage scan · SBOM
- TestDAST · API tests
- Releasesign · provenance
- Deployadmission policy
- Runruntime detection
Checks at every stage, each one small, fast and owned.
The DevSecOps loop
Eight stages, each with its own security control.
Click a stage on the loop. Each one shows the control we add, what it catches, and the NIST SSDF practice group it supports.
01PlanSSDF · PO
—
Control—
Catches—
Typical tools—
Capabilities
Twelve controls. One pipeline, one report.
Filter by where the control runs. Every control is configured, tuned and triaged by XcellHost — you do not get a scanner and a login.
Keys, tokens and passwords caught at pre-commit and push, with history scans for what already leaked.
Commit & pushOpen-source dependencies checked against vulnerability advisories and licence policy, with reachability where supported.
Pull requestTerraform, CloudFormation, Bicep, Helm and Kubernetes manifests checked for open storage, public ports and missing encryption.
Plan & PRBase images and layers scanned at build and again in the registry, so new advisories reach images already shipped.
Build & registryA software bill of materials for every release in CycloneDX or SPDX, stored with the artifact and searchable.
BuildImages and binaries signed, with build provenance in the SLSA format, so you can prove what was built and how.
ReleaseProtected branches, short-lived OIDC credentials, pinned actions and isolated runners in our Mumbai data centre.
PipelineRunning applications and APIs tested on staging for auth flaws, injection and misconfiguration before release.
StagingRules written as code and enforced at admission: signed images only, no root containers, resource limits set.
AdmissionCluster configuration checked against CIS-style benchmarks, RBAC reviewed and drift reported every day.
ClusterUnexpected processes, shells and network calls in containers detected and sent to our 24×7 SOC.
ProductionSoftware supply chain
Know what is inside. Prove where it came from.
Software supply-chain failures sit at number three in the OWASP Top 10:2025. Three controls answer the questions a customer, auditor or regulator will ask.
01 · SBOM
What is inside?
An SBOM lists every component, version, supplier, licence and hash in a release. We generate one per build and keep it beside the artifact.
CycloneDXOWASP standard, also ECMA-424SPDXLinux Foundation, ISO/IEC 5962:2021
- Search all releases for one vulnerable package
- Share with customers and auditors on request
- Fields aligned to CERT-In's SBOM guidelines
02 · SLSA build levels
How was it built?
SLSA (version 1.2, November 2025) grades build integrity. Most teams start at L0; our managed runners take you to L2, and hardened, isolated builds to L3.
- L0No guarantees
- L1Provenance exists
- L2Hosted build, signed provenance
- L3Hardened, isolated builds
03 · Signing
Has it been changed?
Signatures prove an artifact has not changed since your pipeline built it. Two routes, often used together:
Keyless signingSigstore-style: short-lived certificate from your CI identity, entry in a public transparency log, verified at deploy.Code-signing certificateFor installers and binaries users download. DigiCert code signing from ₹36,699*/year →
Frameworks we map to
Built on public standards, so the evidence travels.
Every control on this page maps to at least one of these. Your monthly report shows the mapping.
NIST SP 800-218, the Secure Software Development Framework. Version 1.1 (February 2022) is current; a draft of version 1.2 (SP 800-218 Rev. 1) was published for comment in December 2025. It groups practices into four families:
POPrepare the organisationRoles, policy, toolchain, secure environments
PSProtect the softwareCode integrity, signing, archived releases
PWProduce well-secured softwareDesign review, secure coding, testing
RVRespond to vulnerabilitiesFind, triage, fix and learn from root causes
OWASP Software Assurance Maturity Model version 2: five business functions, three security practices each — fifteen practices scored on maturity levels 1 to 3. Our self-assessment below uses a simplified version.
GovernanceStrategy & metrics · Policy & compliance · Education & guidance
DesignThreat assessment · Security requirements · Security architecture
ImplementationSecure build · Secure deployment · Defect management
VerificationArchitecture assessment · Requirements-driven testing · Security testing
OperationsIncident management · Environment management · Operational management
The OWASP Top 10:2025, released in November 2025. Mishandling of exceptional conditions is a new category, and software supply-chain failures widens the old vulnerable-components category. The coverage map below checks your controls against each one.
Maturity model
Five levels. Most teams are between 1 and 2.
The XcellHost DevSecOps maturity model, drawn from SSDF, SAMM and SLSA. Each step is something a team can reach in one or two quarters.
1Ad hoc
Security testing is a yearly pen test. Secrets live in repos. No one owns findings.
2Scanned
SAST and SCA run in CI, but results land in a dashboard nobody reads.
3Gated
Tuned rules block critical issues on the PR. Secrets blocked on push. Findings have owners and SLAs.
4Governed
SBOM per release, signed artifacts, policy-as-code at admission, CI/CD hardened.
5Proven
SLSA L3 builds, runtime signals feed back to code, DORA and fix-time metrics reviewed quarterly.
Tool · DevSecOps maturity self-assessment
Eight practices, two minutes. Get a score and a roadmap.
Pick the statement closest to how your team works today. The score, radar and next steps update as you go.
Your result
0/ 100Level 1 · Ad hoc
Your next three moves
Suggested package · —
A self-assessment for orientation, not an audit. Scoring: each practice 0–4, total scaled to 100. Level bands: below 20 = 1, 20–39 = 2, 40–59 = 3, 60–79 = 4, 80+ = 5.
Tool · pipeline security coverage map
Tick what you run today. See the gaps.
The map shows which pipeline stages your controls cover and how they line up against the OWASP Top 10:2025. The mapping is XcellHost's own guidance, not an OWASP rating.
Controls you have
Stage coverage0%
Top 10 categories covered0 / 10
Gaps10
OWASP Top 10:2025covered partial gap
Close the biggest gaps first
DORA metrics
Security should not slow delivery. We measure both.
DORA's research programme now uses five software delivery metrics in two groups. We report them monthly from your own pipeline data, beside fix times for security findings.
Throughputhow fast changes reach users
Change lead time
Time from a commit to that change running in production.
Deployment frequency
How often application changes are deployed to production.
Failed deployment recovery time
Time to recover when a deployment fails and needs immediate attention.
Instabilityhow often changes go wrong
Change fail rate
Share of deployments that need immediate intervention, such as a rollback or hotfix.
Deployment rework rate 5th · added 2024
Share of deployments that are unplanned, made to fix a user-facing bug.
Plus: security fix time
XcellHost adds median days to fix critical and high findings, per repository.
Metric definitions from dora.dev, checked November 2026. We do not promise benchmark values; your baseline is measured during onboarding.
India regulations
SBOMs and secure SDLC are now asked for by Indian regulators.
DevSecOps does not make you compliant by itself. It produces the SBOMs, scan records and change evidence these rules expect.
CERT-InTechnical Guidelines on SBOM
Version 1.0 issued 3 October 2024; version 2.0 on 9 July 2025 extended it to cryptographic (CBOM), AI (AIBOM), hardware (HBOM) and quantum (QBOM) bills of materials. Aimed at government, essential-services and software-export organisations, and their suppliers.
SEBICSCRF, 20 August 2024
The Cybersecurity and Cyber Resilience Framework asks regulated entities to obtain and maintain SBOMs for critical systems and new core software, updated with every software change, and to cover supply-chain risk in contracts.
RBIIT Governance Master Direction
RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, in force from 1 April 2024) expects security across the software development life cycle and vendor risk management. RBI advisories have also pointed regulated entities to CERT-In's SBOM guidelines.
6 hCERT-In incident reporting
CERT-In's April 2022 directions require reportable incidents — including compromise of software supply chains — to be reported within 6 hours of noticing them. Runtime detection and signed-artifact records shorten that investigation.
Regulatory summaries checked November 2026 from CERT-In, SEBI and RBI publications and law-firm and audit-firm summaries (Khaitan & Co, July 2025; KPMG India, December 2025). For orientation only — not legal advice. Confirm current requirements with the regulator.
How XcellHost delivers
Scanners find things. People decide what matters.
A scanner without triage is a backlog. Every package includes the engineers who tune, triage and report.
24×7 SOC & NOC, Mumbai
Runtime alerts and blocked deploys worked around the clock by the team that runs our security operations.
01Triage before developers
False positives suppressed, duplicates merged, real issues ticketed with a fix suggestion.
02Runners in a Tier IV DC
Isolated build runners and scanners hosted in our Mumbai data centre; code stays in India.
03ISO 27001 & 20000-1
Delivered under certified security and service-management systems, with SOC 2 Type I & II.
04Monthly report
Findings, fix times, SBOM coverage, DORA metrics and the SSDF mapping, with next month's priorities.
05One INR invoice
Service, scanners we supply and add-ons on one GST invoice from an Indian company.
06Toolchain integrationsWe work with what you have and fill gaps with open-source or commercial tools.
Source & CIGitLab™GitHub™ & ActionsAzure DevOps™Jenkins™Bitbucket™
ScanningSemgrep™Trivy™GitleaksCheckov™ZAPQualys™
Supply chainCycloneDXSPDXSigstore cosignin-toto / SLSA provenance
Deploy & runKubernetesOpenShift™Argo CDOPA Gatekeeper / KyvernoFalco
Tickets & chatJira™ServiceNow™Microsoft Teams™Slack™
Packages
Priced per month, sized by repositories.
A repository is one source repo with its own pipeline. Commercial scanner licences, where you choose them, are billed at actuals.
01 · Pipeline Guard
Shift left
₹34,999†/month
up to 25 repositories
- SAST on every pull request
- Secrets detection, push blocking
- SCA & licence policy
- IaC scanning
- Finding triage by XcellHost engineers
- Monthly findings & fix-time report
Recommended
02 · Supply-Chain Secure
Shift everywhere
₹79,999†/month
up to 75 repositories
- Everything in Pipeline Guard
- Container image & registry scanning
- SBOM per release (CycloneDX / SPDX)
- Signing & SLSA provenance
- CI/CD hardening, runners in Mumbai
- Kubernetes policy-as-code
- Monthly DAST on 2 applications
- DORA metrics & quarterly review
03 · Enterprise
Prove it
On quote
75+ repositories, regulated, multi-team
- Everything in Supply-Chain Secure
- Runtime protection with 24×7 SOC
- SLSA L3 hardened build platform
- SEBI CSCRF / RBI evidence packs
- Named AppSec lead
- Custom SLAs
† Placeholder price for a new service — to be confirmed by XcellHost. * Indicative price reused from an existing XcellHost page. All prices INR, excluding 18% GST. Extra repositories ₹999† each per month. One-time onboarding and pipeline integration ₹24,999*, the same fee as Cloud Operations onboarding.
Configure
Build your DevSecOps plan. See the rupee total.
Pick a package, your repository count and any add-ons. Fixed-price items go to the cart; Enterprise comes with a quotation.
1 · Package
3 · Add-ons
Your estimate · indicative
Supply-Chain Secure · 75 repositories
Monthly₹0
One-time & annual₹0
Subtotal₹0
GST (18%)₹0
First invoice incl. GST₹0
Enterprise packagePrice on quote
† Placeholder, to be confirmed. * Indicative, from existing XcellHost pages. INR excl. 18% GST. Commercial scanner licences billed at actuals.
FAQ
DevSecOps, answered.
DevSecOps builds security into every stage of software delivery — planning, code, build, test, release, deploy and run — instead of testing once at the end. Developers, operations and security share the same pipeline, the same findings and the same metrics.
Shift-left moves checks earlier, to the pull request and build, where fixes are cheapest. Shift-everywhere keeps controls at later stages too — signing, admission policy and runtime detection — because a clean build can still be tampered with or misconfigured after it leaves CI.
Fast checks such as secrets and incremental SAST run on the pull request; slower ones such as DAST run on a schedule or on staging. We tune rules and triage findings before developers see them, and we track DORA lead time and deployment frequency so any slowdown is visible.
No. We integrate with GitLab™, GitHub™, Azure DevOps™, Jenkins™ and Bitbucket™. If you want us to run the platform as well, see our GitLab and GitHub services pages.
A software bill of materials lists every component in a release with its version, supplier, licence and hash. We produce CycloneDX or SPDX, both of which CERT-In's guidelines accept, and keep one SBOM per release beside the artifact.
It produces the evidence those rules ask for — SBOMs, scan records, signed artifacts and change history — and maps it in the monthly report. Compliance remains your organisation's responsibility; confirm current requirements with the regulator.
SLSA grades build integrity from L0 (no guarantees) to L3 (hardened, isolated builds with protected provenance signing). Supply-Chain Secure uses hosted runners with signed provenance, which is the L2 pattern; Enterprise adds the hardened L3 build platform.
Scanners and build runners run in your environment or in isolated runners in our Mumbai Tier IV data centre, so source code stays in India. We do not use your code to train models.
One source repository with its own pipeline. Pipeline Guard covers 25 and Supply-Chain Secure 75; extra repositories are ₹999† each per month. Enterprise is sized after an assessment.
Typically four to six weeks for 25–75 repositories: connect the platform, enable scanners in report-only mode, tune rules against your code, then switch on blocking for critical issues. Onboarding is ₹24,999* one-time, excl. GST.
Send us one repository. We'll show you what ships with it.
We run SAST, SCA, secrets and IaC scans on one repo you choose, generate its SBOM and send a triaged findings report with an INR quotation.*
DEVSECOPSBY XCELLHOST
ISO 27001 · ISO 20000-1SOC 2 Type I & II24×7 NOC & SOCMumbai, IndiaSince 1999