DevSecOps
One gated path from commit to production, with security and compliance built in.
At a glance
NGT builds one gated path from commit to production: security and quality checks on every change, policy as code, hardened cloud estates and SRE to run it. We assess, prove it with one team, then roll it out.
SAST, dependency, image and infrastructure checks run on every change. Nothing reaches production without passing them.
ISO 27001, PCI DSS or HIPAA controls written as policy, checked on each deploy, evidenced automatically.
Assess, pilot the standard with one team or delivery centre, then roll it out and run it.
Commit to production on one gated path
The reference pipeline NGT adapts for each client. Select a component for what it does and the practice behind it.
- Checks first, on every changeQuality, SAST and dependency checks in the pull request; images scanned and signed before the registry.
- Deployed by GitOpsArgo CD syncs each environment from Git. Production waits for a named approver.
- Policy as codeCompliance rules checked on every deploy and evidenced without screenshots.
- Watched from day oneLogs, metrics, traces and threat detection feed one view of findings per team.
Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.
Problems we solve
Six problems customers bring us, each with the architecture we use for it. Select one.
Many teams, many ways to build
Every team runs its own version control, pipelines and scanners. Fixes are copied by hand and nobody sees security findings across teams.
- One shared GitLab with CI templates a platform team owns
- Shared runners on Kubernetes, one pod per job on Spot
- Short-lived deploy roles instead of cloud keys in pipelines
One standard workflow every team builds on, with security findings seen across teams.
Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.
What NGT delivers
Six service lines. Most engagements start with the assessment and combine two or three.
Explore DevSecOps
5 pages, each a few minutes to read.
Frequently asked questions
What customers ask first.
With Scan: two to three weeks to assess repositories, pipelines, secrets and access, and to score maturity. Evaluate turns the findings into a prioritised roadmap in one to two weeks.
If you already know the gaps, we can pilot the pipeline with one team and assess in parallel.
Not when they are designed for it. Fast checks run first, on the laptop and in the pull request; slower scans run on deployed environments.
Thresholds are agreed per team and tightened over time, so the first gates stop critical issues without blocking every build.
No. We integrate what works and replace a tool only where it blocks a gate or duplicates another. We have delivered on GitHub, GitLab, Bitbucket, Jenkins, Azure DevOps and the AWS developer tools.
These are frameworks we design and evidence controls against on client platforms; the certification or attestation belongs to the client.
NGT's own projects follow FPT Software's information-security risk process, mapped to ISO/IEC 27001:2022 Annex A controls.
AWS, Azure, Google Cloud and Huawei Cloud, hybrid estates with on-premises systems, Kubernetes and serverless. The controls are the same everywhere; the native services differ.
Yes. SRE & observability is one of our service lines: SLOs and error budgets, monitoring, on-call and post-mortems.
Under NGT's service-based model the reference P1 response is 30 minutes, with resolution in 4 hours. Each contract sets its own.
