Source: computerweekly.com | Based on the GitLab annual DevOps survey (original publication date: May 2020)
DevOps Adoption Is Growing — But Security Is Lagging Behind
An annual GitLab survey of more than 3,650 software professionals confirms that DevOps adoption is widespread and maturing — yet a persistent gap remains between how teams approach code quality and how they handle security. The data paints a picture of an industry that has embraced continuous delivery and collaboration, but has not fully operationalized the “shift left” security principles it endorses in principle.
Where Teams Stand on DevOps Maturity
According to the survey findings:
- 35% of respondents are new to DevOps, with just under one-fifth having practiced it for a year or less.
- 20% have been using DevOps for more than five years, representing the most experienced segment of the sample.
- 27% fall into what GitLab calls the “sweet spot” — three to five years of practice — a stage at which teams are described as comfortable and consistently successful.
This distribution suggests that while DevOps is no longer a niche practice, a significant portion of the industry is still early in its journey and working through foundational challenges.
Why Teams Adopt DevOps: Code Quality Leads
When developers were asked why their organisations adopted DevOps, the top motivators were:
- Improved code quality
- Faster time to market
- Reduced manual testing burden
- Better cross-team collaboration
- Developer satisfaction and happiness
Nearly 60% of respondents said their organisations deploy software multiple times a day, once a day, or once every few days. GitLab noted this likely reflects the high proportion of smaller companies in the survey sample. By contrast, only 11% deploy once a month and just 8% deploy every few months — a reminder that deployment frequency varies considerably by organisation size and industry.
CI/CD Is Now Table Stakes
Continuous Integration and Continuous Delivery (CI/CD) has emerged as the dominant technical practice within DevOps implementations. The survey found that nearly 38% of respondents include CI/CD in their DevOps implementations, followed by:
- 29% — test automation
- 16% — DevSecOps
- ~9% — multicloud strategies
GitLab summarised the finding bluntly: “The word is out about the importance of CI/CD to DevOps.” The figures confirm that automated pipelines are now widely understood as foundational — not optional — infrastructure for modern software delivery.
Microservices: Partial Adoption Is the Norm
Microservices adoption remains mixed across the industry:
- ~40% of developers report partial use of microservices.
- 26% use microservices fully.
- 31% do not use them at all.
A further cohort indicated they are planning to investigate or trial microservices. The partial adoption figure is the most telling: it reflects the practical difficulty of migrating from monolithic architectures incrementally, and the operational overhead that microservices introduce for teams that are not yet equipped to manage them at scale.
The Security Gap: Shifting Left in Theory, Not Always in Practice
The survey’s most significant findings concern security — and the gap between intent and implementation. While “shift left” security (integrating security earlier in the development lifecycle) is broadly endorsed, the data shows that the tooling and processes needed to make it real are not yet widely in place.
Static Application Security Testing (SAST)
- 65% of security professionals said their organisations push security left — earlier into the development process.
- Yet only 24% said their companies have SAST scanners integrated into a web IDE.
- Fewer than 19% surface SAST scan results inside a pipeline report accessible to developers.
Dynamic Application Security Testing (DAST)
- Fewer than 14% of companies give developers access to DAST tooling.
- Fewer than 14% provide developers with DAST scan reports.
GitLab was direct about what this means operationally: “If you want to enable developers to find and fix vulnerabilities, you have to give them the scan results in their pipelines or native workflows.” Without this integration, security findings remain siloed in separate tools or teams, which defeats the purpose of shifting left.
Container and Dependency Scanning
- 56% of developers do not run container scans — a notable gap given the prevalence of containerised workloads.
- Approximately 50% run compliance scans.
- 57% conduct dependency scans — the one security practice showing majority adoption among developers.
What Industry Leaders Are Saying
Sid Sijbrandij, CEO and co-founder of GitLab, acknowledged the positive trajectory while highlighting the remaining challenges: “There is still significant work to be done, particularly in the areas of testing and security. We look forward to seeing improvements in collaboration and testing across teams as they adjust to utilising new technologies and job roles become more fluid.”
Johnathan Hunt, VP of Security at GitLab, pointed to the underlying organisational challenge: “Although there is an industry-wide push to shift left, our research shows that greater clarity is needed on how teams’ daily responsibilities are changing, because it impacts the entire organisation’s security proficiency. Security teams need to implement concrete processes for the adoption of new tools and deployments in order to increase development efficiency and security capabilities.”
Key Takeaways for DevOps and Security Teams
- CI/CD adoption is healthy, but security tooling integration within those pipelines is severely underdeveloped.
- “Shift left” is a policy commitment for many organisations, but not yet an operational reality — SAST and DAST results are not reaching developers in their daily workflows.
- Container scanning is a blind spot: more than half of teams are not scanning containers, which is a significant risk in any containerised deployment environment.
- Dependency scanning shows the most promise as the most widely adopted developer-facing security practice.
- Role clarity matters: as DevSecOps blurs traditional boundaries between developer, QA, and security responsibilities, teams need explicit process definitions — not just tool access.
For DevOps teams looking to close the security gap, the most immediate actions are integrating SAST results directly into developer pipelines and IDEs, enabling container scanning as part of the CI/CD workflow, and establishing clear ownership for security findings across development and security teams.