Dear colleagues,

We are happy to announce the 3rd Workshop on DevSecOps Research and Opportunities (DevSecOpsRO) that will be held in conjunction with EuroS&P 2025 as a post-conference workshop on July 4th, 2025.


The security implications of attacks on the software supply chain are nowadays well-known. Indeed, attacks such as the SolarWinds hack showed the world that security cannot be treated as an add-on feature in software development and distribution.
The need for this integration and the design of suitable methodologies is often referred to as DevSecOps or SecDevOps. Despite the recently proposed models for secure development (e.g., SLSA and CSA CMM), no comprehensive framework exists that guarantees the security and resiliency of the Software Development Lifecycle (SDLC). The heterogeneity of solutions adopted by different vendors and the rapid advancement of developing technologies further complicate the creation and adoption of a common security framework. Furthermore, they create novel attack surfaces that malicious users could exploit. Thus, it is fundamental to uncover these novel threats before they can actually affect an SDLC.
With this workshop, we aim to attract novel contributions to the security of the software supply chain to foster the creation of more conscious, robust, resilient, and advanced methodologies to either expose novel threats or propose advanced countermeasures to existing threats. We invite academics, industry professionals, and enthusiasts to contribute their research, experiences, and insights into the challenges and advancements in DevSecOps.
- Topics of interest include but are not limited to:
- Methodological approaches to agile secure software development
- Security testing integration in the software supply chain
- Static and dynamic software bill of materials
- Secure software development via cloud testing
- Secrets management along the software supply chain
- Novel attacks on the software supply chain
- Machine learning approaches to speed up security testing
- Maturity models for secure software development
- Declinations of DevSecOps in different fields
- Integration of incident and response team operations
- Tracking and handling updates along the software supply chains
- AI support to Secure Software Development
- Automated vulnerability detection
- Fuzzing methodologies for the software supply chain
- Automated approaches in detecting software vulnerabilities
- Automated application of software patches
- Strategies for meeting regulatory compliance and addressing security challenges in DevSecOps
- Approaches for the creation of an effective Software Bill Of Materials


Important Dates
Full papers will be included in EuroS&P’s proceedings, while short papers will not.
Authors of selected papers will be invited to submit an extended version to a special issue in a peer-reviewed journal.
Paper submission deadline: Feb. 13, 2025
Notification of acceptance: Mar. 17, 2025
Final papers: Apr. 17, 2025
Papers must be submitted through the EasyChair system.

For additional information on paper format and submission guidelines, please visit the DevSecOpsRO website at https://spritz.math.unipd.it/events/2025/devSecOpsRO/CFP.html


Use of Generative AI
Technology provides great advantages to its users and, in particular, generative AI may be tempting to use as a substitute for human work. While this is great for many tasks, critical thinking and fact-checking are not yet among the tasks at which these models excel. Therefore, we encourage authors to provide substantial contributions via critical thinking and carefully check the correctness of whatever information is included in the paper.

The use of generative AI for reviewing is, on the other hand, strictly prohibited. We will instruct reviewers in this sense to guarantee quality reviews without leaking any confidential information you will include in your work.


The program chairs
Alessandro Brighente, University of Padova
Mauro Conti, University of Padova
Constantinos Patsakis, University of Piraeus
Agusti Solanas, Rovira i Virgili University, & APWG.EU Spain
Qiang Tang, Luxembourg Institute of Science and Technology