This article is based on reporting originally published at containerjournal.com.
What Is the DLT Secure Software Factory?
DLT Solutions LLC, a wholly owned subsidiary of Tech Data, has introduced a Secure Software Factory (SSF) framework designed to give U.S. public sector agencies a structured, opinionated path toward adopting DevOps best practices. The framework is built around Kubernetes and containers, targeting organizations that have historically struggled to move away from traditional waterfall software delivery models.
According to DLT CTO David Blankenhorn, the SSF was created in response to a clear gap: government agencies and educational institutions are risk-averse by nature, yet face growing pressure to deliver modern, responsive digital services. A prescriptive framework, rather than open-ended guidance, lowers the barrier to entry for these organizations.
Tools and Vendors in the SSF Ecosystem
The SSF is not a single product — it is an integrated framework spanning a curated set of commercial and open-source tools. Blankenhorn cited the following vendors as part of the initial ecosystem:
- Checkmarx — static application security testing (SAST)
- CloudBees — enterprise CI/CD pipeline management
- Dynatrace — observability and application performance monitoring
- GitHub / GitLab — source control and collaboration
- Eggplant — intelligent test automation
- MindPoint Group — cybersecurity compliance and hardening
- Parasoft — automated software testing
- Red Hat — enterprise Kubernetes (OpenShift) and Linux infrastructure
- Sonatype — software supply chain and dependency management
- StackRox — Kubernetes-native container security
- Sysdig — runtime container security and monitoring
- XebiaLabs — release orchestration and DevOps intelligence
- ZenHub — agile project management integrated with GitHub
Together, these tools cover the full software delivery lifecycle: planning, coding, testing, securing, deploying, and monitoring applications running on Kubernetes clusters.
Why Kubernetes as the Foundation?
The SSF is optimized for building microservices-based applications packaged as containers and deployed on Kubernetes. While Kubernetes adoption in government production environments has lagged behind the private sector, development teams building applications for government agencies have increasingly turned to container-based workflows.
This dynamic is significant: the introduction of containers at the development layer is creating a forcing function for broader DevOps conversations within agencies that might otherwise have deferred modernization indefinitely. The SSF aims to formalize and accelerate that progression by providing a detailed process map — from initial planning and code integration through to DevSecOps practices aligned with government compliance requirements.
Addressing the Cultural Challenge
Technology alone is rarely the blocker in government DevOps adoption. Blankenhorn acknowledged that the more significant obstacle is cultural. Government agencies operate under constraints — regulatory, budgetary, and organizational — that make rapid iteration difficult to justify internally.
Key cultural and organizational challenges include:
- Risk aversion: Any process that accelerates deployment cycles requires trust-building and institutional buy-in before it can be absorbed at scale.
- Waterfall legacy: Many agencies still rely on waterfall methodologies for application delivery, making the shift to iterative DevOps cycles a significant process change.
- Workforce familiarity: Staff accustomed to long release cycles need structured training and change management support.
The SSF’s role in this context is to act as a decision guide — reducing the ambiguity of “how do we start?” by prescribing specific steps, tool integrations, and process checkpoints that align with how government IT programs already operate.
Government DevOps Maturity: Where Agencies Stand
Research from Puppet’s State of DevOps reports has consistently placed government agencies near the bottom of DevOps maturity rankings — an outcome that reflects structural realities more than a lack of technical capability. However, exceptions exist. The U.S. Air Force, for instance, has been recognized as an early adopter of DevOps practices within defense, demonstrating that public sector agility is achievable with sufficient leadership and mandate.
The broader trend toward mobile-first citizen services and open government data initiatives is increasing pressure on agencies to modernize. As end users — including government staff and citizens — grow accustomed to the responsiveness of commercial digital applications, expectations for government services will rise accordingly.
Expanding the Ecosystem: IT Service Providers
Beyond direct agency adoption, DLT — leveraging its position as part of Tech Data’s global distribution network — plans to work with IT services providers serving the public sector. The near-term goal is to help those providers extend their existing DevOps practices to government clients. Longer term, DLT intends to build out a training framework so IT service providers can establish DevOps practices from the ground up where none currently exist.
This channel strategy recognizes that many government agencies procure technology through managed service providers and system integrators rather than directly from vendors, making those intermediaries critical leverage points for driving adoption of the SSF at scale.
Key Takeaways
- The DLT Secure Software Factory is a Kubernetes-based DevOps reference framework built specifically for U.S. public sector agencies and educational institutions.
- It integrates tools across the full DevSecOps lifecycle, from planning and source control to security scanning, testing, release orchestration, and runtime monitoring.
- Cultural resistance and waterfall legacy processes remain the primary adoption barriers, not technology availability.
- DLT’s channel strategy targets IT service providers as a scalable path to broader government adoption.
- Kubernetes adoption at the development team level — even before agencies run it in production — is accelerating the DevOps conversation within government.