u/Say_My_Name_00

Before deploying new code to a production environment, what security testing, validation steps, and checklist items do you usually follow?

I'm interested in understanding industry best practices for secure deployments. Specifically:

What security tests do you perform before production release?

Do you conduct SAST, DAST, or penetration testing for every release?

How do you handle dependency and vulnerability scanning?

What infrastructure and configuration checks do you perform?

What IAM, secrets management, and access control validations are included in your checklist?

How do you verify logging, monitoring, and alerting before go-live?

Do you have a formal security sign-off or approval process?

We are planning to purchase a defender for our organization. Our infrastructure is hosted in AWS and includes both Windows and Linux servers. We have more than 200 employees in the organization, and we need a security monitoring solution that can provide protection and visibility for both endpoints and servers.

We would like to know which XDR tool would be the best fit for our environment. It would also be helpful if you could share approximate pricing or licensing costs based on your experience