Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
This paper presents the lessons learned, and the observations and insights gained, from observing a software development effort for a large, well-funded, and highly regulated program that adopted Agile and DevSecOps principles during a 12-month period of iterative software development. The program was originally set up to use the waterfall software development approach with a traditional earned value (EV) scheme. It completed several iterations of development using this structure. The program then shifted to using a combination of Agile and DevSecOps.
In this paper, we describe challenges encountered during this transition that inhibited realization of some of the benefits associated with Agile and DevSecOps. Largely, these challenges were a result of poor planning, engineering, and communication. We present this advisory account to others undertaking similar DevSecOps and Agile transitions, particularly in large organizations, so that they may better strategize and prepare methods to diminish similar shortcomings and increase the odds of a successful transition.
Part of a Collection
International Conference on Software and Systems Processes 2022 Assets
Cite This SEI Report
Scanlon, T., & Morales, J. (2022, May 19). Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study. Retrieved August 18, 2026, from https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/.
@techreport{scanlon_2022,
author={Scanlon, Tom and Morales, José},
title={Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study},
month={May},
year={2022},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/},
note={Accessed: 2026-Aug-18}
}
Scanlon, Tom, and José Morales. "Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, May 19, 2022. https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/.
T. Scanlon, and J. Morales, "Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 19-May-2022 [Online]. Available: https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/. [Accessed: 18-Aug-2026].
Scanlon, Tom, and José Morales. "Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 19 May. 2022. https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/. Accessed 18 Aug. 2026.
Scanlon, Tom; & Morales, José. Revelations from an Agile and DevSecOps Transformation in a Large Organization: An Experiential Case Study. Software Engineering Institute. 2022. https://www.sei.cmu.edu/library/revelations-from-agile-devsecops-transformation-in-large-organization-experiential-case-study/