This article is based on reporting originally published by baselinemag.com, drawing on the 2017 DevSecOps Global Skills Survey commissioned by Veracode and conducted by DevOps.com.
Security Skills Are Missing From DevOps Teams
As large-scale cyber-attacks become more frequent and more damaging, embedding security into the software delivery pipeline has never been more important. Yet a significant skills gap is preventing many organizations from making the shift from DevOps to DevSecOps — the practice of integrating security testing and governance directly into development and operations workflows.
According to the 2017 DevSecOps Global Skills Survey — conducted by DevOps.com on behalf of Veracode and covering nearly 400 DevOps professionals worldwide — three out of four DevOps practitioners were never required to take a single security course to earn their computer science or IT-related college degree. That foundational gap has compounding effects: developers enter the workforce without security fundamentals, and many organizations are struggling to find candidates who combine DevOps velocity with security competence.
Employers Aren’t Closing the Gap Either
What makes the situation more concerning is that enterprises are not compensating for weak academic foundations with on-the-job training. The survey found that most IT professionals reported their organizations were not providing meaningful security education in the workplace. The result is a workforce that is being asked to deliver software at DevOps speeds without the security knowledge needed to do so safely.
Nearly one-third of survey respondents said they believe their IT workforce is simply unprepared to deliver software securely at DevOps pace. IT leaders are finding it increasingly difficult to staff teams with the right blend of development agility and security awareness.
Why This Matters for DevSecOps Adoption
DevSecOps is not just a cultural shift — it requires practical, hands-on knowledge of secure coding practices, vulnerability scanning, threat modelling, and the integration of security tooling into CI/CD pipelines. Without that knowledge, security becomes a bottleneck bolted on at the end of delivery rather than a built-in quality attribute.
- Secure coding practices must be understood by developers, not just security specialists.
- Automated security testing (SAST, DAST, dependency scanning) needs to be configured and interpreted by people who understand what the results mean.
- Incident response in a fast-moving DevOps environment demands that operations engineers can recognise and react to security events quickly.
- Compliance and audit requirements increasingly expect security to be demonstrably built in, not added after the fact.
When teams lack these skills, security reviews become a chokepoint, release cycles slow down, and — more dangerously — vulnerabilities slip through undetected.
What Industry Leaders Are Saying
Maria Loughlin, then Senior Vice President of Engineering at Veracode, summarised the challenge plainly:
“This research highlights that the skills gap is real, and that there are no clear shortcuts to address it. The industry will have to come together to address that gap and ensure the safety of the application economy. Organizations should be prepared to teach and supplement security education if necessary, given the ever-changing nature of programming languages and frameworks.”
Maria Loughlin, SVP Engineering, Veracode
The observation that programming languages and frameworks are constantly evolving is particularly important. Security training cannot be a one-time event — it must be continuous, keeping pace with new attack surfaces introduced by new technology choices.
Practical Steps Organizations Can Take
While the survey does not prescribe specific remedies, the findings point clearly toward a set of organizational actions that can help close the gap:
- Invest in structured security training — Require developers and operations staff to complete security fundamentals courses, such as those covering the OWASP Top 10, secure design principles, or platform-specific hardening guides.
- Embed security champions — Designate individuals within each delivery team who take deeper security training and act as a first line of guidance for colleagues.
- Integrate security tooling into the pipeline — Automated static analysis, dependency vulnerability scanning, and container image scanning give teams immediate feedback without relying solely on human expertise.
- Make security part of the definition of done — Include security acceptance criteria in sprint planning and code review processes so it is never an afterthought.
- Partner with academic institutions — Organizations with influence can advocate for security to become a core component of computer science curricula, addressing the problem at its source.
The Broader Business Risk
The skills gap is not merely an HR inconvenience. In an era where the digital economy depends on trusted, reliable software, insecure applications represent genuine business and reputational risk. A breach caused by a vulnerability that could have been caught during development is far more costly — in remediation, regulatory exposure, and customer trust — than the investment required to train a development team properly.
DevOps succeeded in part because it broke down the wall between development and operations. DevSecOps applies the same logic to security. But that integration only works when everyone involved understands the fundamentals of building secure software. Closing the training gap is not optional — it is a prerequisite for sustainable DevOps success.
Survey source: 2017 DevSecOps Global Skills Survey, commissioned by Veracode and conducted by DevOps.com, covering approximately 400 DevOps professionals globally.