Shift Left: Not a Magic Bullet with Liz Rice

O’Reilly Media
O’Reilly MediaApr 20, 2026

Why It Matters

Because relying only on early‑stage scanning leaves enterprises exposed, integrating runtime defenses is critical to protect against evolving threats and supply‑chain risks.

Key Takeaways

  • Shift‑left remains valuable but isn’t a standalone security solution.
  • Scanning only finds known flaws; it can’t detect zero‑day threats.
  • Runtime controls are essential alongside early‑stage vulnerability checks.
  • Supply‑chain and SBOM practices complement, not replace, continuous monitoring.
  • Enterprises must adopt layered defenses throughout the software lifecycle.

Summary

Liz Rice argues that the shift‑left mantra, while still relevant, is no longer a silver bullet for software security. She notes that the buzz has moved toward supply‑chain transparency and SBOMs, but early‑stage testing alone cannot eliminate runtime risk.

Rice emphasizes that static scanning only catches known vulnerabilities and cannot protect against zero‑day exploits. Consequently, organizations must pair shift‑left practices with robust runtime controls and continuous monitoring to address threats that emerge in production.

A memorable line from the talk—“you can’t scan your way out of runtime risk”—captures the core message. She also points out that provenance and SBOMs, though valuable, do not guarantee safety without active defense mechanisms.

The takeaway for businesses is clear: adopt a layered security strategy that spans development, supply‑chain verification, and real‑time protection. Relying solely on early testing invites gaps that attackers can exploit, making continuous runtime safeguards essential for modern threat landscapes.

Original Description

People may not be talking about “shifting left” as much, “but thinking about security from the beginning of [the software development] lifecycle still is correct,” argues _Container_ _Security_ author Liz Rice. There’s just much more to it. Shift left isn’t a “magic bullet” that will solve all your security issues. You also need to account for risks at runtime. #shorts
Follow O'Reilly on:

Comments

Want to join the conversation?

Loading comments...