practical-devsecops.comReviews of practical-devsecops.com

I had a very positive experience with the DevSecOps certification. The training was practical, well-structured, and focused on real-world security integration in CI/CD pipelines. I especially liked that the labs were hands-on and helped me apply concepts such as SAST, DAST, SCA, and secure pipeline practices in a realistic way. It was a valuable learning journey and a useful certification for anyone who wants to strengthen their DevSecOps and application security skills.

I recently passed the CAISP certification and can attest that it is a fantastic course to start with on securing AI systems albeit with still some room to improve. The hands-on lab-oriented approach is a good way to learn about vulnerabilities and weaknesses of AI systems and then how to protect against the threats. The shortcoming of the course is that it is based totally on local LLMs and doesn't cover LLMs as a cloud hosted service (OpenAI, Amazon Bedrock etc.). It doesn't go too much into the platform layer on top of the model layer and how to secure them. MCP and AI Agents lesson is also too short IMO, and more depth would have been good. Finally replicating the labs locally was a bit challenging as the Python version used is 3.10 which is a bit old now and some Python modules are not compatible. My suggestion for PDSO would be to upgrade the labs to run on Python 3.12 or greater. Nevertheless, AI security is a fast-emerging field, and this course will set you on the journey to securing AI systems.

As a Security Lead with over 20 years of experience, I found the CAISP exam to be a strong and practical assessment of real-world security skills. The exam had a good balance of theory and hands-on practical components, which made it more meaningful than a purely knowledge-based certification. The six-hour lab was challenging but fair. It tested not only technical understanding, but also the ability to analyse scenarios, apply security concepts, make decisions under time pressure, and demonstrate practical competence. I appreciated that the exam reflected situations security professionals are likely to face in real environments, rather than only focusing on memorised definitions. The theory section was also useful, as it covered important security principles and helped validate broader knowledge across governance, risk, controls, and applied security practices. The practical lab was the highlight for me because it required proper thinking, structured troubleshooting, and clear application of security controls. Overall, CAISP is a valuable certification for professionals who want to demonstrate both conceptual understanding and hands-on capability. I would recommend it to security practitioners, architects, engineers, and leads who want a certification that feels relevant to day-to-day security work.

Very easy to follow course and great for teaching what is actually practical in implementation!

I’ve seen many certifications over the years, and only a few really stand out. CAISP is one of them. The hands-on labs made the experience real for me. Working through real scenarios, instead of just reading about them, helped me remember what I learned much better than theory alone. The exam was challenging in a good way. It checks if you truly understand the material, not just if you memorized it. I finished the program feeling sharper, more confident, and ready to use my new skills right away. If you’re unsure about it, I recommend giving it a try. It’s definitely worth it.

The Highlights: Mindset Shift: Moves beyond patching bugs to "Secure by Design" using the 8 Security Principles. Practical & Modern: Deep dives into Kubernetes (K8s) and AWS S3 threat models using Attack Trees. Actionable Tools: Mastered STRIDE and DFDs for identifying risks at the whiteboard, not just in the code.

A timely and well-pitched course that cuts through the AI hype and jargon, distilling what matters most for anyone looking to understand the risk and security dimensions behind it.

Good and straightforward courses, with payloads that prove to be tested before being released. But, very frustrated from the exam feedback. While I managed to solve the exam, one step I couldn't solve, and I wanted to know what I missed ; the answer from Practical DevSecOps? "we don't disclose". When I give lessons and trainings, I do it for my students so they learn, they become better. Not to hide them what they did wrong and where they could improve. Pretty unprofessional in my opinion, to hide what could be improved. Also, the fact that courses must rely on ready machines before being able to start reading the course, is not really optimized, and it could be improved.