What is security as code?
Security as code (SaC) is the practice of defining and enforcing security policies through version-controlled code instead of manual processes. As part of a DevSecOps approach, security rules, access controls, and vulnerability checks run automatically inside the CI/CD pipeline, so issues are identified before code reaches production.
This shift matters because modern development moves too fast for manual review. Wiz’s 2026 State of AI in the Cloud Report found that at least 80% of organizations use AI IDE extensions, showing how quickly code is now written, reviewed, and shipped. SaC turns security into a continuous control that scales with that speed.
The State of Code Security Report [2025]
Security as Code (SaC) integrates security into every stage of development, but misconfigured CI/CD pipelines remain a major risk. The State of Code Security Report 2025 found that 80% of GitHub repository workflows have insecure default permissions, putting entire codebases at risk.
Download report
The evolution of SaC: From final gate to continuous control
Traditional security acted as a final gate in the software development life cycle (SDLC), reviewing code only after development was complete. This approach slowed releases and left teams fixing issues late, when they were harder and more expensive to resolve.
SaC applies a shift-left model, embedding security checks earlier in development. Vulnerability scans, policies, and controls run automatically in CI/CD pipelines, giving developers immediate feedback and reducing the risk of insecure code reaching production.
Security as code principles and methods
SaC combines core principles with practical methods that enforce them across development workflows.
Security as code principles
Security as code principles define how security is applied consistently across the SDLC:
Automation: Remove manual, repeatable tasks so security checks run consistently without human intervention
Continuous integration: Embed security directly into CI/CD pipelines to block insecure changes before deployment
Infrastructure as code (IaC): Define infrastructure in version-controlled templates that can be scanned for misconfigurations
Visibility and reporting: Give teams clear feedback on issues, including what failed and how to fix it
Methods
SaC methods enforce these principles through automated checks across code and runtime environments:
Security rules: Codify governance decisions, such as data residency or coding standards, into enforceable policies
Access policies: Define and enforce permissions for users and service accounts across the development lifecycle
Static application security testing (SAST): Scan source code for vulnerabilities before execution
Dynamic application security testing (DAST): Test running applications for configuration issues and runtime risks
Vulnerability scanning: Identify risks in third-party libraries and known vulnerability patterns
Secrets management: Detect and prevent credentials, API keys, and tokens from being exposed in code
Each method must integrate into the CI/CD pipeline so checks run automatically, without slowing delivery or relying on manual enforcement.
For example, a security rule can block a deployment if a storage bucket is publicly exposed, or prevent a change if a service account has excessive permissions.
Security as code (SaC) and policy as code (PaC) are closely related but serve different roles. SaC embeds security checks into development workflows, while PaC enforces governance decisions as code. Used together, they ensure both security and policy controls are applied consistently across the SDLC.
The Secure Coding Best Practices [Cheat Sheet]
With curated insights and easy-to-follow code snippets, this 11-page cheat sheet simplifies complex security concepts, empowering every developer to build secure, reliable applications.
Download Cheat Sheet
What are the benefits of security as code?
Security as code improves development speed, reduces risk, and strengthens compliance by embedding security directly into how software is built and deployed.
| Benefit | Description |
|---|---|
| Enhanced collaboration | Security checks run in the CI/CD pipeline, so developers and security teams work from the same codebase and fix issues earlier, reducing friction. |
| Increased visibility and control | Codified policies create a clear, auditable view of access, configurations, and changes across environments. |
| Improved efficiency and speed | Automated checks reduce manual reviews, accelerate release cycles, and free security teams to focus on higher-risk issues. |
| Consistency and reduced risk | Policies defined as code apply uniformly across environments, preventing configuration drift and limiting exposure from human error. |
| Simplified compliance | Version-controlled policies create an audit trail, making it easier to meet frameworks like SOC 2, ISO 27001, and GDPR. |
Common SaC challenges
Security as code often fails due to process, not tooling. If checks are unclear or overly restrictive, developers work around them, and the pipeline becomes a blocker.
Adoption also introduces friction. Policy languages like Rego or OPA can be hard to learn, and gaps between security and CI/CD knowledge slow teams down. Without clear ownership of findings, issues go unresolved. Clear accountability and cross-functional training are key to making SaC work.
How is security as code implemented?
Security as code is implemented by embedding automated checks throughout the development lifecycle, from code creation to production deployment. In practice, this falls into two categories: policy-based controls and automated security testing. Together, they ensure security is enforced consistently across both code and infrastructure.
Security rules and access policies
Policy-based controls define what is allowed before anything is deployed. These include governance rules, infrastructure configurations, and access policies enforced through infrastructure as code and application logic.
For example, teams can enforce secure coding best practices, restrict where resources are deployed, or require specific configurations before code is accepted. Access policies also enforce least-privilege permissions through tools like cloud infrastructure entitlement management (CIEM), limiting how users and services interact with systems.
These checks run directly in cloud IDEs, pre-commit hooks, and CI/CD pipelines, preventing non-compliant changes from progressing.
Watch 5-minute demo
Watch the demo to learn how Wiz Code scans infrastructure as code, container images, and CI/CD pipelines to catch risks early—before they reach the cloud.
Watch now
Vulnerability scans and security tests
Automated testing identifies weaknesses in both code and running applications. Static analysis (SAST) scans source code early in the pipeline, while vulnerability management helps detect insecure dependencies, known CVEs, and software risks before deployment.
Misconfigurations are another major risk. Tools like cloud security posture management (CSPM) identify issues in infrastructure as code and cloud environments, such as exposed storage or overly permissive settings.
Dynamic testing (DAST) runs later, once applications are deployed or staged, to identify runtime issues such as exposed endpoints or configuration flaws. Placing each test at the right stage ensures coverage without slowing development.
What are security as code best practices?
Effective security as code depends on consistency, fast feedback, and clear ownership across teams. To put that into practice, focus on the following:
Automate checks early: Use Git hooks to scan before commits and enforce controls in CI/CD pipelines to stop insecure code before deployment.
Scan AI-generated code before it lands: AI coding assistants now produce a meaningful share of committed code. Apply the same SAST, secrets scanning, and policy checks to AI-generated output as you do to human-written code, since shared generation patterns can turn small flaws into systemic ones.
Maintain continuous feedback: Surface vulnerabilities immediately and ensure they are fixed quickly to prevent repeat issues.
Enforce least-privilege access: Regularly review and refine policies to avoid over-permissioned defaults and reduce exposure.
Standardize and validate scripts: Automate complex checks, then review scripts to prevent errors that introduce risk.
Test in production-like environments: Use staging environments that mirror production to catch issues before release.
Enable continuous logging and monitoring: Maintain visibility so threats can be detected, investigated, and resolved quickly.
Invest in team education: Train developers on security findings and security teams on CI/CD workflows to improve collaboration and ownership.
CI/CD Pipeline Security Best Practices [Cheat Sheet]
In this 13 page cheat sheet we'll cover best practices in the following areas of the CI/CD pipeline: Infrastructure security, code security, secrets management, access and authentication, monitoring and response.
Download Cheat Sheet
Wiz's approach to security as code
Wiz extends security as code beyond CI/CD pipelines into runtime by connecting code-level issues to cloud context. This allows teams to prioritize risk based on real attack paths, not isolated findings. By correlating vulnerabilities, misconfigurations, and secrets with deployed resources, Wiz shows which issues are exposed, exploitable, or impact sensitive data.
Wiz Code integrates with version control systems to scan application code, infrastructure as code, and dependencies before merge. The platform includes thousands of built-in security as code policies based on Rego, helping detect misconfigurations earlier as part of a shift-left approach.
The Wiz CLI surfaces issues in tools like VS Code before code is pushed, keeping security aligned with developer workflows.
Agentless scanning maps deployed resources, showing how risks connect across your environment. Wiz also analyzes your software supply chain, identifying risks in third-party libraries and dependencies before they reach production.
As teams adopt AI-driven development, this model extends to securing AI pipelines, training data, and models.
To see how Wiz unifies security across your development lifecycle, schedule a demo.
Secure your SDLC from start to finish
See why Wiz is one of the few cloud security platforms that security and devops teams both love to use.
