Original announcement published January 28, 2020, via GlobeNewswire. Source: finance.yahoo.com.
Overview
Puppet released its first State of DevOps: Industry Report Card in January 2020, expanding on its eighth annual State of DevOps survey. Based on nearly 3,000 responses from technical professionals across multiple industries, the report benchmarks how different sectors are progressing in two key dimensions: overall DevOps maturity and the integration of security practices into the software delivery lifecycle (often called DevSecOps).
The report was produced by Puppet in collaboration with CircleCI and Splunk. A third-party research firm, OnResearch, hosted the survey and performed the data analysis. Splunk contributed analysis and commentary; all other content was authored by Puppet and CircleCI.
Top-Level Findings
- The technology industry leads all sectors in both DevOps maturity and security integration across requirements, design, build, and test phases.
- The financial services and insurance sector scored the lowest on security integration despite handling highly sensitive data — a finding the report attributes partly to the complexity and volume of regulatory requirements constraining DevOps evolution.
- The retail industry surpasses even technology firms in on-demand deployment capability.
- Government agencies reported the slowest remediation times for critical vulnerabilities.
- The telecom industry showed the fastest year-over-year growth in DevOps maturity but also the highest reported friction between security and delivery teams.
Industry-by-Industry Breakdown
Technology
The technology sector sits at the top of the DevOps maturity curve and leads on security integration across the full software delivery lifecycle. Notable data points from the report:
- 35% of technology companies view security as a shared responsibility across all teams — above the cross-industry average of 31%.
- 28% of technology respondents say leadership always supports DevOps initiatives, the highest of any industry surveyed.
Financial Services and Insurance
Financial services and insurance organizations have a solid DevOps foundation — the sector has the largest proportion of companies rated “Medium” on the DevOps evolution scale — but struggle to advance further. Key challenges include:
- The sector has the fewest organizations rated “High” on DevOps maturity, suggesting a ceiling effect tied to regulatory burden.
- Only 17% of respondents strongly agree that their audit process helps minimize business risk — the lowest figure of any industry, compared to a 24% overall average.
- Security integration scores are the lowest across all sectors, a counterintuitive result given the sensitivity of financial data.
Telecom
Telecom is a sector in rapid transition. The report highlights significant year-over-year improvement alongside a persistent cultural challenge:
- The number of telecom companies scoring in the “High” DevOps maturity category rose 42% compared to the prior year’s survey.
- Despite this progress, telecom has the highest level of friction between security and delivery teams, with 19% of companies reporting collaboration challenges.
Retail
Retail stands out for deployment speed and vulnerability remediation — areas where consumer-facing pressure to ship frequently appears to be driving operational excellence:
- 57% of retail firms are capable of deploying to production on demand.
- 28% report that they are actively deploying on demand — the highest rate across all industries, surpassing even technology firms.
- 53% of retail respondents remediate critical vulnerabilities in under one day, the fastest rate of any sector.
Government
Government agencies face the steepest challenges in vulnerability remediation speed, and security integration is highly polarized:
- Only 3% of government respondents can remediate critical vulnerabilities in under one hour.
- 24% can remediate in under one day — the slowest remediation profile in the report.
- Security integration shows little middle ground: 43% report significant or full integration, while 42% report no or minimal integration.
The Security Integration Imperative
A consistent theme across all sectors is that security integration into DevOps pipelines — sometimes called shifting security left — remains uneven. Alanna Brown, Sr. Director of Community and Developer Relations at Puppet, summarized the challenge in the report announcement:
“Integrating security into your DevOps practices can be challenging, but when done correctly is proven to pay off. Security should not be an afterthought; it must be a shared responsibility across teams during every stage of their software delivery lifecycle.”
Alanna Brown, Sr. Director Community and Developer Relations, Puppet
The report’s cross-industry average of 31% for organizations treating security as a shared responsibility indicates that the majority of companies still operate with security siloed from delivery teams — a structural gap that directly affects remediation speed and overall risk posture.
Report Methodology
The survey targeted technical professionals with direct knowledge of their organization’s IT operations and software delivery processes. Key methodological details:
- ~3,000 responses collected as part of Puppet’s eighth annual State of DevOps survey.
- Survey hosted and data analysis conducted by OnResearch, an independent third-party research firm.
- Report authored by Puppet and CircleCI; Splunk contributed analysis and commentary on findings.
Takeaways for DevOps Practitioners
The Industry Report Card format is useful because it moves beyond the generic DevOps maturity model and surfaces sector-specific constraints. For teams planning DevOps or DevSecOps initiatives, the findings suggest several practical considerations:
- Regulatory environments slow maturity progression. Financial services organizations should invest specifically in automating audit evidence collection and compliance reporting rather than treating compliance as a manual, delivery-blocking process.
- On-demand deployment is achievable outside the technology industry. Retail’s results demonstrate that deployment frequency is driven by operational investment, not solely by the nature of the software being built.
- Security team friction is a cultural and tooling problem. Telecom’s high friction score alongside strong maturity growth suggests that DevOps evolution alone does not resolve security collaboration issues — explicit DevSecOps practices and shared tooling are needed.
- Remediation speed is a leading indicator. Government’s low remediation rates reflect infrastructure and process constraints that DevOps automation could directly address, even within compliance-heavy environments.
The full 2019 State of DevOps: Industry Report Card, including deeper per-industry analysis and recommendations, was made available by Puppet at the time of the announcement. Readers should check Puppet’s official resources site for the current availability of the report.