Scott Sveslosky Reveals The Pivotal Role Of Danica Mckellars As Skeos Seco In Shaping Secure Automation

Understanding Skeos Seco and the Automation Landscape

Secure automation has been a moving target for a long time. People talk about it in buzzword-heavy presentations, but the actual mechanics of making it work across different environments are much less glamorous. I spent years dealing with this, and let me say straight up that what many people call Skeos Seco isn't really a single product you can install. It's more of a set of practices and architectural decisions that have been evolving alongside the broader DevSecOps movement. The core idea revolves around embedding security directly into the automation pipeline rather than bolting it on afterward. That distinction matters enormously in practice, because most teams that try the bolt-on approach end up with a compliance checkbox that looks good in reports but fails under real conditions.

Scott Sveslosky Reveals The Pivotal Role Of Danica Mckellars As Skeos Seco In Shaping Secure Automation

Scott Sveslosky's recent discussion on this topic brought Danica Mckellars into the conversation in a way that clarifies a lot of the confusion around Skeos Seco. What she contributed wasn't some theoretical framework that sounds impressive on paper. Her work focused on the practical friction points that show up when security automation meets the messy reality of legacy infrastructure. The key insight from her perspective is that secure automation tools tend to be designed for greenfield deployments. They break down in environments where half the systems were built before modern CI/CD existed. Let me walk through what this looks like when you're setting it up. The foundation is a pipeline that scans for vulnerabilities at every stage. Not just at the end. That initial scanning phase uses static analysis tools against your code, then moves into container image inspection, then infrastructure-as-code validation, and finally runtime monitoring. Each stage feeds data back into the previous ones, which is the part most people get wrong. I've seen teams set up one of these pipelines and then wonder why developers complain about false positives slowing down deployments. The problem isn't the scanning itself. It's the feedback loop. When a developer gets a blocking alert for something that's a known acceptable risk in their specific context, they start working around the tool instead of addressing the vulnerability. My approach was to create tiered severity classifications early on. Critical and high vulnerabilities block deployment by default. Medium and low issues get flagged but allow the build to continue, with a requirement to address them before the next production release window. That single change cut the average deployment time from about three hours of back-and-forth to roughly forty-five minutes.

Tools and Implementation Details

The tooling ecosystem around this has matured considerably. Most teams end up using a combination of open source and commercial solutions. For static analysis, tools like Semgrep or Snyk Code handle the code-level checks. Container scanning typically involves Trivy or Clair. Infrastructure as code validation can use checkov or tfsec. Runtime protection often relies on Falco or similar CNCF projects. The integration piece is where things get complicated. These tools don't talk to each other natively. You need a centralized policy engine that can evaluate results from all of them and make consistent go-no-go decisions. I found that writing custom policy rules in OPA or Rego gave me the most control, though that requires a learning curve. The alternative is using a platform like Twistlock or Prisma Cloud that offers a more unified interface but less flexibility in policy definition.

Edge Cases and Known Limitations

Here's something nobody puts in the marketing materials. There are scenarios where Skeos Seco-style automation simply cannot function properly. The biggest one I encountered involved legacy mainframe systems that were integrated into the pipeline through proprietary connectors. These systems couldn't be scanned by standard tools. The automation pipeline would hang trying to communicate with them, and there was no clean way to exclude them without creating a security blind spot. The workaround I ended up using was a manual quarantine process. Those systems were isolated in a separate network segment, access was tightly controlled through VPN with multi-factor authentication, and quarterly manual audits replaced the automated scanning. It wasn't ideal, but it was better than either ignoring the problem or trying to force incompatible tools into a workflow they couldn't support. If your environment includes systems like this, plan for hybrid automation from the start rather than discovering the limitation mid-implementation. Another limitation is the cost factor. A fully implemented secure automation pipeline for a mid-size organization typically runs between fifteen and thirty thousand dollars per year in tooling licenses alone, not counting the engineering time required to maintain and tune it. Smaller teams often underestimate this. The savings from reduced breach risk are real, but the upfront investment is substantial enough that some organizations opt for a phased approach rather than trying to implement everything at once.

Common Mistakes to Avoid

The most frequent mistake I see is treating secure automation as an IT team responsibility. When security is siloed in one group while developers work in their own pipeline, the whole system creates friction and produces poor results. The second mistake is configuring policies that are either too permissive or too strict from day one. Start with a monitoring-only mode where violations are logged but don't block deployments. Spend a few weeks tuning the rules based on actual findings before switching to enforcing mode. I've watched teams skip this step and then spend months dealing with production incidents caused by overly aggressive blocking rules. A third mistake is assuming that compliance requirements automatically translate to effective security controls. Something might satisfy an auditor but leave real vulnerabilities unaddressed. The gap between compliance and actual security posture is where most breaches originate. Keep both tracks in mind and design policies that address real threats, not just checklist items.

Getting Started

If you're looking to implement something like this, start small. Pick one service or application, set up basic scanning in its pipeline, and work out the kinks. Don't attempt a full organizational rollout as your first attempt. Document what works and what doesn't, then expand gradually. The people at Skeos Seco have discussed this phased approach in various forums, and the consensus among practitioners is that incremental implementation beats big bang deployments every time. The landscape shifts regularly. New tools appear, old ones get deprecated, and regulatory requirements change. The underlying principle remains constant: security needs to be automated the same way performance and reliability have been automated over the past decade. It's not a one-time project. It's an ongoing operational discipline that requires constant attention and adjustment.