This article is based on a contributed piece by Reuven Harrison, CTO and Co-Founder of Tufin, originally published as part of the VMblog Predictions 2017 series.
The Myth of Separate Worlds
The DevOps movement has gained significant momentum as organizations recognize the tangible benefits of faster software delivery, cross-functional collaboration, and continuous innovation. Yet a persistent myth continues to undermine those gains: the belief that DevOps and security teams naturally inhabit separate worlds, where developers see security as a roadblock and security teams view DevOps as an unmanaged risk.
Left unchallenged, this cultural divide does not just create friction — it creates exploitable gaps. DevOps oversights can quietly become the root cause of the next serious data breach.
Why DevOps Teams Become Attack Targets
DevOps practices introduce specific security risks that are easy to overlook when teams are focused on shipping features quickly. Three patterns stand out:
1. Minimal Oversight and the “Move Fast” Philosophy
DevOps teams are designed to move quickly and operate with considerable autonomy. That agility is a strength, but without structured security oversight built into the process, there is no reliable mechanism to confirm that code is being written and deployed securely. Speed without guardrails is a risk multiplier.
2. Over-Privileged Access
Because DevOps teams want to reduce friction and accelerate delivery, it is common for more team members than necessary to hold access to privileged or sensitive systems. A wider circle of privileged users directly increases the attack surface. Cybercriminals routinely target accounts with elevated access precisely because compromising one can yield significant rewards.
3. Unvetted DIY Toolchains
DevOps teams are pragmatic by nature and will adopt whatever tools help them ship faster — often without routing those decisions through IT security. The result is that the security team may have no visibility into which third-party applications and libraries are touching the network, no opportunity to vet them, and no process to catch outdated or vulnerable dependencies before they are embedded in production pipelines.
The Real Cost of the Silo Mentality
Data breaches driven by DevOps-related oversights are largely preventable. The irony is that the very agility that makes DevOps teams so valuable can be redirected to make compliance and security checks faster and more consistent — if teams work together rather than in opposition.
When DevOps and security remain in silos, organizations face compounding risks: misconfigured infrastructure, unreviewed code, ungoverned access, and shadow toolchains. Any one of these can serve as an entry point for a determined attacker.
A Better Approach: Security Baked Into the Pipeline
In modern cloud-native environments, developers increasingly own the full stack — application code, infrastructure-as-code, networking configuration, and storage. This expanded scope demands a rethink of how security responsibilities are distributed.
The key principle is that security awareness belongs to developers, but security ownership does not. Expecting individual developers to be fully responsible for compliance and security is unrealistic and violates the fundamental principle of Separation of Duties. Instead, security managers and platform teams should embed automated security controls directly into the DevOps toolchain — CI/CD pipelines, infrastructure provisioning workflows, and deployment gates.
This approach, often described as shifting security left, achieves several goals at once:
- Security checks run automatically at every stage of the pipeline, not just at release.
- Developers get fast feedback on security issues while context is still fresh, making remediation faster and cheaper.
- The security team retains policy control without becoming a manual bottleneck.
- Continuous integration is complemented by continuous security, reducing the risk of human error and misconfiguration in complex, fast-moving environments.
Practical Steps to Unite DevOps and Security
- Define security policies as code. Express firewall rules, access controls, and compliance requirements in version-controlled configuration files so they travel with the application through the pipeline.
- Integrate static and dynamic analysis into CI/CD. Tools that scan for vulnerabilities, secrets, and misconfigurations should run automatically on every pull request or build, not as a separate gate managed by a different team.
- Enforce least-privilege access by default. Adopt role-based access controls and regularly audit who holds elevated permissions. Automate the removal of access that is no longer needed.
- Establish a shared responsibility model. Make security metrics visible to DevOps teams and include security engineers in sprint planning and architecture reviews. Shared visibility creates shared accountability.
- Automate compliance reporting. Where regulations require audit trails, generate them automatically from pipeline telemetry rather than relying on manual documentation after the fact.
The Bottom Line
DevOps and security are not natural enemies. The tension between them is a structural problem — one created by organizational silos, misaligned incentives, and the mistaken belief that speed and security are mutually exclusive. With the right automation tools and a culture of shared ownership, DevOps can become a driver of compliance rather than a threat to it, and security can become an enabler of delivery rather than an obstacle.
Organizations that recognize this early and invest in integrating security into their DevOps workflows will find themselves better positioned to move fast and stay safe. Those that do not will eventually discover the cost of that division — usually at the worst possible moment.
About the Original Author
This article draws on analysis contributed by Reuven Harrison, CTO and Co-Founder of Tufin. Reuven has more than 20 years of software development experience, including senior developer roles at Check Point Software, and holds a Bachelor’s degree in Mathematics and Philosophy from Tel Aviv University. He has led Tufin’s product and technology strategy since the company’s founding.