Developing Large Language Model Integrated Cloud-Native DevSecOps for Software Delivery and Continuous Security Validation

Abstract

Modern software delivery increasingly relies on cloud-native architectures, containerization, and automated Continuous Integration and Continuous Deployment (CI/CD) pipelines to achieve rapid feature deployment. However, integrating security seamlessly into these high-speed environments remains a critical operational challenge. Traditional DevSecOps practices often depend on static analysis, rule-based scanners, and manual code reviews, which struggle to keep pace with rapid deployment cycles and frequently produce high rates of false positives. This paper presents an integrated framework that embeds Large Language Models (LLMs) directly into cloud-native DevSecOps workflows to enable continuous, real-time security validation and automated remediation. By leveraging fine-tuned LLMs trained on domain-specific security vulnerabilities and cloud infrastructure configurations, the proposed architecture automates threat modeling, static and dynamic application security testing (SAST/DAST) output contextualization, Infrastructure as Code (IaC) compliance verification, and dynamic patch generation. Implemented within a Kubernetes-orchestrated cloud-native ecosystem, the system acts as an intelligent security agent, validating code and infrastructure definitions prior to production deployment. Empirical evaluations demonstrate significant reductions in time-to-remediate (TTR), lowered false-positive overhead, and improved continuous compliance without compromising software delivery speed. Ultimately, this research provides a scalable blueprint for shifting security further left while automating continuous security validation across cloud-native software supply chains.