Source: InfoQ. This article summarises findings from GitLab’s annual DevOps survey and an interview with GitLab Senior Developer Evangelist Brendan O’Leary, originally published on InfoQ.
Survey Overview
GitLab’s annual DevOps survey gathered responses from more than 3,500 developers across 21 countries. The survey covers three major areas: development and release practices, security, and testing. The overall picture is one of accelerating adoption — faster release cycles and improved quality — while emerging areas such as DevSecOps still require significant organisational fine-tuning.
Key Findings: Deployment Frequency and Role Evolution
The data points to a continued shift toward continuous deployment:
- 59% of companies now deploy at least once every few days, up from 45% in the previous year’s survey — a substantial year-over-year jump.
- 34% of developers report that they are now creating and managing the infrastructure their applications run on, reflecting a meaningful expansion of the traditional developer role into operations territory.
- Developers increasingly report fewer manual tasks such as manual testing, deployment, and code merging, indicating growing automation maturity.
At the same time, release velocity is not without friction. 47% of respondents identified testing as the primary reason for release delays, with bugs frequently discovered late in the release process rather than early in the pipeline.
Security: DevSecOps Still Maturing
Security integration remains a work in progress. Organisations continue to struggle with adopting practices like early Static Application Security Testing (SAST) scans and Dynamic Application Security Testing (DAST) as standard parts of their pipelines. While year-over-year progress is visible, DevSecOps as a discipline has not yet reached the same maturity level as core CI/CD practices in most organisations surveyed.
Interview: Brendan O’Leary, Senior Developer Evangelist, GitLab
InfoQ spoke with GitLab’s Senior Developer Evangelist Brendan O’Leary to unpack the survey findings and their broader implications.
On the Convergence of Development and Operations Roles
InfoQ: The survey confirms a significant portion of developers now play roles traditionally held by operations engineers. Is this a good trend? Where does it end? Will operations as traditionally understood eventually disappear?
O’Leary: I think this is a trend we’ll continue to see. DevOps aims to blur the lines between software engineering and operations engineering. While both disciplines have specific requirements, the more linked these disciplines become, the faster organisations can deliver stable software. When it comes to operating software, it’s critical for the developers of that software to have a deep understanding of how it operates at scale. At the same time, operators need to understand and deliver for the needs of the organisation’s main goal: delivering better products faster.
On the Challenges This Convergence Creates — Especially for Security
InfoQ: What challenges does the convergence of development and operations roles imply for the overall development process — and specifically for security?
O’Leary: The biggest challenge is the ability to connect real-world operations data with the changes either made or required to improve the customer experience. The old-style command-and-control security methodology doesn’t work when you’re shipping code to production every week, every day, or multiple times a day. The older disjointed toolchains developed for siloed roles need to evolve into a single DevOps platform that lets engineers work together and share a common set of data and measurements. We’ve seen the industry moving in this direction as DevOps tool makers consolidate around building a single platform for the entire software lifecycle.
On Shifting Testing Left — Benefits and Risks
InfoQ: Shifting testing left is widely seen as beneficial, but are there shadows to this trend? What risks should teams avoid?
O’Leary: Shifting testing left is critical to anyone’s DevOps transformation. However, there are risks if we don’t re-imagine what those tools look like in a modern DevOps context. Security testing must also shift earlier in the cycle, allowing developers to address issues before they progress further down the pipeline. It also becomes critical to invest as much attention in technical debt within CI/CD pipelines as we would with the product code itself. A “set it and forget it” testing model is no longer viable — the way we integrate, test, and deploy code needs to be just as adaptable as the code itself.
On Remote Work, COVID-19, and the Role of Tooling
InfoQ: The convergence of development, operations, testing, and security is fundamentally about communication and collaboration. How does this relate to the explosion of remote working driven by the COVID-19 pandemic?
O’Leary: The increased need for cross-discipline collaboration can directly benefit teams that now must collaborate remotely. From what we’re seeing in the industry, the current crisis has widened the gap between teams that have implemented effective communications and collaboration practices and those that have traditionally struggled. Long processes and organisational red tape have hindered velocity and have negatively impacted teams that now have to work together remotely. Organisations that had already invested in integrated tooling and async-friendly workflows were far better positioned to adapt.
What These Trends Mean for DevOps Teams
Taken together, the survey findings and O’Leary’s commentary point to several actionable takeaways for DevOps practitioners:
- Automate earlier and more broadly. The jump in deployment frequency is driven by automation. Teams that have not yet automated manual testing, deployment, and merging should treat this as a priority.
- Treat security as a pipeline concern, not a gate. Integrating SAST and DAST earlier in the pipeline reduces the cost of remediation and removes security as a bottleneck at release time.
- Invest in CI/CD pipeline maintainability. Pipelines accumulate technical debt just like product code. Treat them with the same engineering discipline.
- Consolidate toolchains. Fragmented tooling across roles makes collaboration harder. A unified platform with shared data reduces friction between development, operations, and security teams.
- Build collaboration infrastructure before you need it. Teams with mature async communication practices adapted more readily to forced remote work. Don’t wait for a crisis to build those habits.
The original interview with Brendan O’Leary was published on InfoQ. The survey data cited is from GitLab’s annual DevOps survey published in 2020.