Tools Used in DevSecOps · Start here

The Tool Landscape

This page is the map for every tool this course teaches in depth — twenty-five of them, one dedicated page each. The Certified DevSecOps Professional (CDP) exam is narrow by design: five live challenges, no multiple choice, and a toolchain its blueprint names directly in only a handful of places. This course covers a much wider ecosystem than that on purpose, because the tool you're actually handed on the job is rarely the one an exam bothered to name. Below: a grouped-by-job view — the way you should actually learn these tools — and then the same twenty-five listed alphabetically, the order the sidebar uses.

Every tool, in detail

☺ Like you're 10: This page is the map of the whole toolbox. Each tool below also has its own full page — what it's for, how it works, the exact commands, and what usually goes wrong.

Below is the landscape view: why only a handful of these tools are curriculum-named, a job-by-job grouping, and the full A–Z. But each tool also has a dedicated page — what it does, the commands and config you actually write, day-to-day gotchas, and how it compares to its closest rival. All 25 are listed twice on this page: first grouped by the job they do, which is how you should learn them, and then A–Z, which is how the sidebar lists them. If you want the shorter, eight-category conceptual pass first — the question each category answers, without the full tool catalogue — the tooling landscape is that page; this one is the deeper, fuller map it was always pointing to.

Static analysis (SAST)

Dynamic analysis (DAST)

Software composition analysis (SCA)

Secrets management

Container & supply chain

Infrastructure as code

Policy as code

Runtime security

Compliance as code

Cloud security posture (CSPM)

SIEM & security monitoring

Threat modeling

Vulnerability management & aggregation

A–Z · every tool, with its sidebar number

The same 25 tools in the order the sidebar lists them. Use this when you already know the name and just want the page — or when you've landed on a tool page from the sidebar and want to know, in one glance, whether it's curriculum-named (★) or wider ecosystem (◆) and which job group it belongs to above.

Count the stars in that table and you get 5 pages carrying a ★ and 20 pages carrying a ◆ — a narrower curriculum-named slice than a tool count this size might suggest, and exactly the point: the CDP grades whether you can do the work under pressure, not whether you've memorized twenty-five tools' worth of flags.

Pick a job → see its tools

☺ Like you're 10: Choose a job from the dropdown and you'll see just the tools for that job, with a one-line note and who on the Squad owns it.

Flip the picker below from one DevSecOps job to the next. Each panel lists the relevant tools — curriculum-named and wider-ecosystem alike — with a one-line "what it does" and the character who owns that piece of the pipeline. Every panel links to its full lesson, because this page is the map; the lessons are the territory.

Meeting a tool you've never run — at exam time

☺ Like you're 10: If a tool is new to you, don't panic — read its --help, find one example that already works, and copy the shape of it.

Twenty-five tool pages is a lot to have cold, and a live challenge can still hand you a flag combination or an output format none of them covered in exactly that shape. The transferable skill isn't memorizing every tool's entire surface area — it's making the tool teach you the one command you need, fast, the same way a working DevSecOps engineer meets an unfamiliar CLI on a Tuesday:

• Ask the tool itself first. <tool> --help or <tool> -h lists every subcommand and flag; most of these tools also support a scoped <tool> <subcommand> --help for exactly the piece you're stuck on.
• Ask for structured output. Nearly every tool on this page can emit JSON — -f json, --format json, --json, the exact flag varies by tool — and structured output is what you can actually grep, pipe, or diff under exam-clock pressure, when a wall of colored terminal text is not.
• Copy a working example, then adapt it. A default config, a sample policy, an existing profile already sitting in the challenge environment is a working starting point every time — changing three lines of something that already runs beats writing anything from a blank file.
• Verify by rerunning, not by assuming. Every category on this page — a scan, a policy check, a signature, a control — reports its own pass or fail. Trust that report over your memory of what the fix should have done.

Check your answers

1. Five: OWASP ZAP, OWASP Dependency-Check, TruffleHog, InSpec, and DefectDojo — any two of these is a correct answer.
2. Syft & Grype, Sigstore & cosign, and OPA & Conftest. Each pair ships and is documented as one workflow in practice — Syft builds the SBOM Grype scans, Sigstore's infrastructure is what cosign's CLI drives, and Conftest is simply Rego packaged for CI — so this course treats each pair as one page rather than splitting a single workflow in two.
3. Supply chain (its native job) plus secrets and IaC — Trivy is a single static binary that scans images, filesystems, IaC definitions, and secrets, and can generate an SBOM, all from one install.
4. <tool> --help (or -h) — every tool on this page supports it, and it's faster than searching for documentation you may not even be able to reach during a live exam.