In the development and maintenance of application systems, information security has become a necessary item. Therefore, the goals of Security by Design have become increasingly clear, and the team has gradually reached a consensus. The earlier the development stage of the system, the earlier security will be included in the design. Overall The cost is lower. However, in the process of digital transformation, the old system already exists, and maintenance and operation have to be worried about, and loopholes are constantly being discovered, and they have to be repaired in a hurry. In the process of pursuing agile development, the information security team, R&D team, and maintenance team have different perceptions of each other, resulting in team conflicts. This agenda explores how to use automated security tools to meet security needs at all stages of SDLC and CI/CD, and explores successful cases of best practices.