Sounds more like an attempt at Secure DevOps rather than a true DevSecOps environment where security is seated in the DevOps team itself. No security person worth the title would ever declare an environment completely vulnerability free. Frankly, I would fire the idiot for saying so, right there on the spot. No questions asked or needed.
As for "shifting left" your CI/CD needs to start at the developer level using a good SAST tool like Veracode or one of the free tools like SonarQube community edition. The next stage would be incorporating your DAST, scanning for active and follow on vulnerabilities from both a static and environmental coding prospect. Containers maybe fine left by themselves but combined with numerous other containers may have hidden vulnerabilities not seen by themselves. Finally, if your doing everything correctly look into IAST or Interactive Application Scanning Tools that use thousands of sensors like an old fashioned IPS but for containers, injected into the container itself. I have seen IAST replace more expensive pentesters and give me better reports/actionable items to follow up on and as a bonus, doesn't burn out as fast as human pentesters.
Even deploying all three layers, following up with good feedback at each level, you're going to still have some flaws but combined with a solid active defense should make the life of your average "electronic burglar" aka "hacker" far more difficult than the average web based application base. Also look at your architecture as a whole. Are you using event based architecture, where you can start and stop services from automagically running to find intruders? I can list another dozen or so active and passive architecture principals to make anything extremely difficult to penetrate but it doesn't mean the best of designs and procedure will ever be impenetrable. Unless of course your talking about a Government system, then we know its impenetrable.
- b/eads
