Introducing Ratel: Shift-Left Security with Cyberattack-Driven Development (CDD)
Stop testing if your code works. Start testing if it resists.
In the fast-paced world of modern software engineering, especially in high-stakes environments like banking, security is often the “bottleneck”. Developers are under pressure to ship features, and security audits often arrive too late, revealing vulnerabilities that require costly architectural changes.
Today, I am introducing Ratel-CLI, the first implementation of the new paradigm: Cyberattack-Driven Development (CDD).
What is CDD?
Cyberattack-Driven Development is a methodology where security isn’t a final check, but the foundation of the development lifecycle. Instead of writing traditional unit tests, CDD focuses on simulating expert attack patterns from day one.
Get Fabio Meyer’s stories in your inbox
Join Medium for free to get updates from this writer.
Ratel is the honey badger of security tools: resilient, aggressive, and relentless. It allows any developer to inject expert-level security gates into their project with a single command.
The Ratel Workflow: Trust but Verify
Ratel-CLI (built in Rust for performance and safety) introduces a unique “Trust but Verify” workflow through three core commands (for now!):
1. ratel init
Ratel “sniffs” your project structure (detecting Java/Spring Boot or Node.js or Python) and automatically injects a suite of expert-curated security tests. It creates a ratel.yaml file—your digital audit trail.
2. ratel check
Integrity is everything. Ratel calculates SHA-256 hashes of your security tests. If a developer “tweaks” a test to bypass a security gate in the CI/CD pipeline, ratel check will immediately raise an alert.
3. ratel certify
We believe in flexibility. If a modification is legitimate, the developer can “certify” the new version. This signs the changes and establishes a new secure baseline, recording exactly when the expertise was customized.
Why banking teams will love it
In a banking environment, compliance and traceability are non-negotiable. Ratel provides:
- Zero-Friction Adoption: Developers don’t need to be security experts to start.
- Immutability: Expert standards are protected by cryptographic hashes.
- Shift-Left Compliance: Audit trails are generated at every commit, not once a year.
So…. whats next?
The CLI and the methodology are just the beginning. Cornerstone has been laid successfully.
The next milestone: The Ratel Language.
So lets focus on a custom, attack-oriented instruction set. This domain-specific language (DSL) will allow experts to script complex attack scenarios that Ratel will execute with surgical precision.
Join the movement. Follow the progress on GitHub.
#CyberSecurity #RustLang #DevSecOps #CDD #FinTech #OpenSource
