MLOps Meets DevSecOps: A Unified Approach for Secure AI System Deployment

Abstract

As machine-learning systems move from notebooks into production, the assumption that classic DevSecOps controls are sufficient breaks down: models are non-deterministic, data is a first-class dependency, and prompts behave like untrusted user input. This article presents a unified DevSecMLOps approach that merges MLOps lifecycle management with DevSecOps security engineering so that security is embedded across the entire AI system, not bolted on at the end. We treat models, datasets, and prompts as first-class artifacts in the software supply chain — immutable, traceable, signed, and reproducible — and map the expanded ML attack surface (data poisoning, model backdoors, prompt injection, model inversion, dependency and artifact tampering) onto established frameworks: the OWASP Top 10 for LLM Applications (2025), MITRE ATLAS, the NIST AI Risk Management Framework, and supply-chain standards such as SLSA and Sigstore. We give a layered control catalog spanning data provenance, model signing, AI software bills of materials (AIBOM), adversarial testing, deployment policy gates, and runtime guardrails, and we formalize the security posture with a defense-in-depth residual-risk model and a release risk score. The goal is an operating model in which every AI release is explainable, auditable, and resilient. Public security frameworks and industry sources are cited throughout.