Source: Dark Reading. Original report by DigiCert (published 2017). Statistics and quotes below are drawn from the original reporting.
The Survey at a Glance
An overwhelming majority of organizations believe that integrating security directly into DevOps makes business sense. According to a 2017 report from DigiCert, 98% of survey respondents said they were either already working on, or actively planning, a DevOps-security integration initiative — a figure that surprised even DigiCert’s own chief security officer, Jason Sabin.
The survey queried 300 US companies. Roughly one-third of respondents came from IT, DevOps, or IT security management roles, giving the results a practitioner-level perspective rather than a purely executive one.
Where Organizations Actually Stand
The 98% headline breaks down into two roughly equal halves:
- 49% of respondents said they had already completed their DevOps and security integration.
- 49% said they were actively working on completing it.
That split matters. Nearly half the respondents have direct, completed-integration experience to draw from — making their reported challenges and outcomes a meaningful signal rather than speculation.
Why Organizations Want DevSecOps
The primary drivers cited in the report are stronger security posture and greater development agility — not compliance mandates or regulatory pressure. The fact that both goals appear together is significant: it suggests that organizations are starting to see security and speed as complementary rather than competing priorities.
This represents a meaningful shift in mindset. The traditional friction between development teams (who want to ship code quickly) and security teams (who are often perceived as gatekeepers that slow delivery) has historically been one of the biggest barriers to integration. The survey data suggests that shared goals are beginning to override that friction.
Reality Check: Integration Takes Longer Than Expected
One of the most practical findings in the report concerns timeline expectations. Among the approximately 150 companies that had completed a DevOps-security integration:
- The majority reported the process took one to two years on average.
- Before starting, companies typically estimated the effort would take only seven to eleven months.
That gap — between expected and actual duration — is a common pattern in large organizational change programs and is worth building into project planning from the outset. Teams that budget for a year-plus timeline are likely to manage stakeholder expectations far better than those who promise completion in under a year.
The Top Integration Challenges
Security teams at companies that had completed integration named the following as their top obstacles:
- Time to complete (70%): The process simply takes far longer than anticipated.
- Security team resistance to change (69%): Security professionals, used to operating as a separate control gate, can struggle to adapt to a model where security is embedded throughout the pipeline.
- Relationship and collaboration skills (68%): Getting historically siloed teams to work together requires interpersonal and organizational skills that are not always present in technical teams.
Addressing Cultural Resistance: The Role of a Change Agent
Jason Sabin, DigiCert’s CSO at the time, offered a perspective that goes beyond tooling: the most effective lever for DevSecOps adoption is cultural leadership, not just process change.
“A lot of people get into DevOps and they try to build a team of DevOps, but they often have struggled. That’s because you have to work with other teams like the operations team or the security team. It is better to build a culture. Be a social leader or an agent of change, instead.”
— Jason Sabin, CSO, DigiCert
A change agent in this context is an internal champion who helps define clear roles for security, IT, and DevOps teams, then actively facilitates their integration. This person does not need to be the most senior leader in the room — they need credibility across team boundaries and the ability to translate between different working cultures.
Practical Steps for Reducing Security Resistance
Sabin’s recommendations for bringing security teams on board include:
- Involve security early. Include security stakeholders at the beginning of the development process, not as a final gate before release.
- Emphasize automation and predictability. Demonstrate that automation makes security outcomes more consistent and reliable — not less controlled.
- Automate PKI and access controls. Limit access and enforce signing and encryption across the network through automated Public Key Infrastructure (PKI) management.
- Embed security tooling in the CI/CD pipeline. Patching, certificate management, vulnerability scanning, and static code analysis should all run automatically within the DevOps workflow rather than as manual, out-of-band processes.
Relationship Skills Are an Underrated Bottleneck
The 68% of teams that cited relationship skills as a challenge points to something that tooling alone cannot solve. Sabin’s example is instructive: a developer who views QA as less skilled, or two teams defaulting to incompatible communication tools (one using Slack, the other using email), can stall integration as effectively as a technical blocker.
Organizations that treat DevSecOps purely as a toolchain problem tend to underinvest in the human and organizational side of the transition. Dedicated onboarding sessions, shared team rituals, and explicit agreement on communication norms are practical first steps.
Outcomes for Organizations That Completed Integration
The effort appears to pay off. Among companies that had completed a DevOps-security integration, respondents reported approximately 21–22 percentage-point improvements across three dimensions:
- Information security posture
- Application delivery deadline adherence
- Ability to reduce application security risk
Sabin noted that these figures reflect improvement beyond what respondents initially expected — meaning integration delivered more value than organizations projected when they began the process.
Key Takeaways for DevOps and Security Teams
- Budget realistically for time. Plan for one to two years, not months, for meaningful integration at scale.
- Start with culture, not just tools. Identify and empower a change agent inside the organization.
- Bring security left. Shifting security review and tooling earlier in the development lifecycle reduces friction and improves outcomes.
- Automate repetitive security tasks. Manual security gates are the enemy of development velocity; automation preserves both speed and control.
- Invest in cross-team relationships. Communication norms, shared goals, and mutual respect between dev, ops, and security teams are prerequisites for lasting integration.