This article draws on findings from the 2018 State of DevOps Report, produced by Puppet and Splunk. Original reporting via networksasia.net.
The DevOps Journey Is Rarely Linear
Every organisation approaches DevOps differently, and the path forward is almost never a straight line. There are false starts, stalled initiatives, and cultural friction that can kill early momentum and breed cynicism across teams. Without a clear, prescriptive framework, many organisations find themselves unable to scale DevOps practices beyond a handful of high-performing teams.
That is the central finding of the 2018 State of DevOps Report, co-authored by Puppet and Splunk. The report categorises organisations into three broad maturity tiers—Low, Medium, and High—based on how frequently they apply key DevOps practices. The data reveals a striking distribution: approximately 80 percent of organisations fall into the Medium tier, roughly 11 percent are Low, and fewer than 10 percent qualify as High.
The jump from Low to Medium is achievable for most organisations willing to commit to foundational changes. The leap from Medium to High, however, is significantly harder—and that gap represents a meaningful competitive opportunity for teams that can close it.
The Five Stages of DevOps Evolution
The 2018 report maps organisations along an evolutionary scale built around a core question: how frequently are key DevOps practices actually being used? Organisations that apply all the practices consistently are classified as highly evolved (High). Those applying few practices infrequently are Low. The majority sit in the middle, doing some things sometimes.
The five-stage model is designed to give organisations a pragmatic, prescriptive path forward—one that helps them identify where they are today, replicate existing pockets of success across teams, and make measurable forward progress rather than stalling indefinitely at Medium.
The Executive Perception Gap
One of the report’s most important findings concerns the disconnect between leadership and the teams doing the work. For nearly every DevOps practice surveyed, C-suite respondents were more likely to report that the practice was in frequent use than team-level respondents were.
- 44 percent of C-suite respondents believed their organisation automates security policy configurations, compared to 36 percent at the team level.
- 59 percent of C-suite respondents in one question variant reported automated security policy configurations, again versus 36 percent at the team level.
- In the Asia-Pacific and Japan (APJ) region, only 59 percent of respondents felt supported by leadership in their DevOps initiatives, compared to 63 percent in the United States and 60 percent in Europe.
This gap is not simply a communication problem—it is a measurement problem. When executives rely on self-reported or anecdotal signals, they develop an inflated view of organisational maturity. The practical remedy is objective, automated measurement: telemetry and dashboards that surface the actual state of DevOps adoption rather than what teams or leaders believe to be true.
Collaboration Is the Scaling Mechanism
Highly evolved organisations share a defining trait: their teams collaborate to build and share automation rather than hoarding tools and knowledge within siloed groups.
- In APJ, 41 percent of highly evolved teams collaborate to automate services for broad organisational use, compared to only 13 percent of the least evolved teams.
- Best practices and reusable patterns are shared across the organisation in 28 percent of highly evolved teams, versus just 10 percent in the least evolved tier.
The underlying dynamic is straightforward: DevOps empowers individuals to make changes without navigating layers of approvals. That empowerment only becomes an organisational asset when the knowledge and tooling behind those changes is shared. Without deliberate collaboration, DevOps success remains local—a win for one team, invisible to the rest of the business.
Security Automation as a Maturity Indicator
Security policy automation emerges in the report as one of the clearest markers separating highly evolved organisations from the rest. According to the findings, highly evolved organisations are 24 times more likely to always automate security policy configurations compared to the least evolved organisations.
This is significant because it reflects a change in mindset, not just tooling. In low-maturity organisations, security is typically addressed reactively—bolted on before an audit or after an incident. In high-maturity organisations, security policy configuration is treated as an operational concern, automated from the outset and maintained continuously. Teams initially automate security for their own efficiency; over time, that automation matures into a shared organisational capability.
This pattern aligns with the broader DevSecOps trend: the recognition that security cannot be a gate at the end of a deployment pipeline if organisations want to move at DevOps speed.
Key Takeaways for DevOps Practitioners and Leaders
- Audit your actual maturity, not your assumed maturity. The executive perception gap is real and widespread. Use automated measurement and objective metrics to establish a baseline before planning your next phase of adoption.
- Focus on scaling, not just starting. Most organisations have at least one team doing DevOps well. The hard work is replicating that success across departments—and that requires deliberate investment in shared tooling, documentation, and cross-team collaboration.
- Treat security automation as a first-class practice. The 24x gap between high and low maturity organisations on security policy automation is a strong signal. If your security configurations are still manual or audit-driven, closing that gap should be a near-term priority.
- Bridge the leadership gap with data. If executives and teams disagree on how mature DevOps practices are, the answer is not a better presentation—it is better instrumentation. Dashboards, deployment frequency metrics, and change failure rates give everyone the same ground truth.
- Accept that progress is non-linear. Stalls and setbacks are normal. Treating them as signals to refine the approach—rather than evidence that DevOps does not work—is characteristic of organisations that eventually reach High maturity.
Industry Voices
Darryl McKinnon, Vice President and Managing Director for APJ at Puppet, noted at the time of the report’s release: “DevOps practices are becoming well established, yet many organisations continue to struggle to scale the pockets of DevOps success across multiple teams and departments. Whilst more organisations are recognising the opportunity to adopt DevOps, particularly at the leadership level, there are clearly some barriers to success that have to be addressed first. In the face of rapid digitalisation, mapping out the journey and better defining those challenges are a key step in enabling that success.”
Andi Mann, then Chief Technology Advocate at Splunk, added: “This year’s report findings validate that foundational practices have a profound impact on an organisation’s overall DevOps evolutionary journey and are key to scaling successes no matter how mature the DevOps transformation is within the organisation.”
Bottom Line
The 2018 State of DevOps Report offers a sobering but actionable picture. Being stuck at Medium is the norm—not a sign of unique dysfunction. The organisations that break through to High do so not by adopting new tools in isolation, but by embedding collaboration, measurement, and automation (including security automation) into the fabric of how they operate. Understanding which stage you are in, and what practices characterise the next stage, is the most reliable starting point for making real forward progress.