Original reporting attributed to itproportal.com, citing a security survey by Venafi.
Security Gaps Are Common Across DevOps Maturity Levels
A report by machine-identity security firm Venafi found that many organisations fail to enforce consistent security practices in their DevOps environments—and the problem is not limited to teams just starting out. Even teams that describe their DevOps practices as mature still exhibit fundamental security weaknesses.
Common issues identified in the report include reusing passwords across multiple machines and failing to secure machine-to-machine communications. These are well-understood risks, yet they persist in environments at every stage of DevOps adoption.
Key Findings from the Venafi Survey
The survey drew a clear contrast between teams in the middle of adopting DevOps and those operating in self-described mature environments:
- Consistent security enforcement: Only 53% of respondents mid-adoption said security measures are enforced consistently, compared to 82% in mature environments.
- Certificate rotation: Among mature DevOps organisations, 62% consistently replace development and test certificates with production certificates when code moves to production. For teams just adopting DevOps, that figure drops to 36%.
- Security awareness: 89% of respondents from mature environments said their DevOps teams understand the security controls needed to protect against attacks. In organisations just starting out, that figure falls to 56%.
The Certificate and Cryptographic Key Problem
One of the most persistent and under-addressed risks highlighted by the report is the improper management of cryptographic keys and digital certificates. Certificates are used to uniquely identify machines and encrypt communications. When development or test certificates are carried into production without replacement, or when TLS/SSL keys are not rotated, attackers gain opportunities to impersonate services or intercept encrypted traffic.
Kevin Bocek, then chief security strategist for Venafi, summarised the core problem:
“It’s clear that most organizations are still struggling with securing the cryptographic keys and digital certificates used to uniquely identify machines. Although DevOps teams indicate that they understand the risks associated with TLS/SSL keys and certificates, they clearly aren’t translating that awareness into meaningful protection. This inaction can leave organizations, their customers and partners extremely vulnerable to cryptographic threats that are difficult to detect and remediate.”
Kevin Bocek, Chief Security Strategist, Venafi
Why Security Awareness Alone Is Not Enough
The survey data reveals an important distinction: awareness does not equal action. Even in mature DevOps environments where nearly nine in ten team members understand the required security controls, a meaningful gap remains between knowing what to do and consistently doing it.
Several factors contribute to this gap in practice:
- Speed pressure: DevOps culture prioritises fast delivery. Security steps that slow down pipelines are often skipped under deadline pressure.
- Tooling gaps: Without automated enforcement built into CI/CD pipelines, security controls depend on manual discipline—which is inconsistent by nature.
- Shared credentials: Reusing passwords or SSH keys across environments reduces operational friction but dramatically expands the blast radius of a compromise.
- Certificate sprawl: As the number of microservices and containers grows, tracking and rotating certificates manually becomes impractical without dedicated tooling.
Practical Steps to Improve DevOps Security Posture
Regardless of where a team sits on the maturity curve, the following practices address the core weaknesses identified in the report:
- Automate certificate lifecycle management. Use tools that automatically issue, rotate and revoke certificates as part of the deployment pipeline so human oversight is not the single point of failure.
- Enforce unique credentials per environment. Development, staging and production environments should use separate keys, certificates and secrets. Never promote test credentials into production.
- Integrate security gates into CI/CD pipelines. Policy-as-code tools can reject builds that carry insecure configurations before they ever reach production.
- Implement secrets management. Use a dedicated secrets management solution to store and distribute credentials, rather than hardcoding them in configuration files or environment variables.
- Audit machine identities regularly. Maintain an inventory of all TLS/SSL certificates, SSH keys and service accounts, and set alerts for expiry or unexpected changes.
The Bottom Line
Security debt accumulates quietly in DevOps environments. The Venafi findings make clear that maturity reduces—but does not eliminate—poor security practices. Teams that build automated, policy-driven security directly into their pipelines are better positioned to close the gap between awareness and consistent enforcement. For organisations still treating security as a manual, end-of-pipeline step, the exposure is real and the remediation window narrows as environments scale.