This article is based on reporting originally published on devops.com, covering a survey conducted by Vanson Bourne on behalf of Trend Micro.
Survey Overview
A survey of 1,310 IT decision-makers, conducted by market research firm Vanson Bourne on behalf of Trend Micro, reveals a striking gap between DevSecOps ambition and organizational reality. While nearly three-quarters of respondents (74%) said integrating developer, IT operations, and cybersecurity processes has grown more important over the past year, more than one-third (34%) said existing silos are actively making it harder to build a DevOps culture. The data paints a picture of organizations that understand what they need to do but have not yet figured out how to get there.
Teams Agree They Need to Work More Closely — But Aren’t
The demand for closer collaboration is nearly universal among respondents:
- 89% said software development and IT security teams need to be in closer contact.
- 77% said the same applies to developers, security, and operations working together.
- 78% acknowledged their organization needs to improve at fostering integration, setting common goals, and sharing learning experiences across teams.
Despite this near-consensus, only 33% of respondents said DevOps is currently a shared responsibility between software development and IT operations at their organization. Nearly half (46%) said their DevOps strategy is only partially developed.
The Root Causes: Trust and Tooling
Greg Young, Vice President of Cybersecurity at Trend Micro, identified two recurring obstacles to achieving DevSecOps in practice:
- A lack of trust between developers and cybersecurity professionals.
- A lack of tooling designed to foster collaboration and communication across functional boundaries.
The developer-security rift is well documented in the industry. Application developers sometimes deprioritize security controls to meet shipping deadlines, only for those shortcuts to become exploitable vulnerabilities in production. Security teams, for their part, are sometimes perceived as slowing delivery pipelines through overly cautious review processes. Both perspectives contain legitimate concerns, and bridging them requires deliberate organizational effort — not just goodwill.
What Respondents Identified as the Path Forward
Survey respondents pointed to three primary strategies for achieving DevSecOps:
- 61% — Foster greater integration between teams.
- 58% — Set common goals that span development, operations, and security.
- 50% — Share learning experiences and post-mortems across teams.
Young emphasized that cybersecurity professionals need to be positioned as active contributors throughout the software development lifecycle — not just as policy gatekeepers who review work at the end. Security input should be available at every stage: design, development, testing, and deployment. The goal is to embed security into the quality assurance process itself, rather than treating it as a final checkpoint that risks becoming a bottleneck.
Why DevSecOps Is No Longer Optional
The pace of modern software delivery has outrun traditional security review models. Application development cycles have accelerated dramatically, and most security teams are already under-resourced relative to the volume of code being shipped. Bolting security on at the end is no longer a viable strategy — the only scalable alternative is to make security controls a continuous, integrated part of the development workflow.
That said, cultural change will not happen automatically. Even organizations that adopt the right tooling will struggle if senior leadership does not set explicit expectations and hold teams accountable for DevSecOps outcomes. Without executive sponsorship, DevSecOps tends to remain a stated aspiration rather than an operational reality.
Key Takeaways for DevOps and Security Teams
- Silos between development, operations, and security remain the biggest structural obstacle to DevSecOps adoption.
- Trust between developers and security professionals must be built deliberately — through shared goals, shared tooling, and shared accountability.
- Security teams should move from a gate-keeping role to a collaborative, embedded role across the full development lifecycle.
- Tooling choices matter: platforms that surface security feedback directly inside developer workflows (e.g., IDE plugins, CI/CD pipeline integrations, automated SAST/DAST) reduce friction and encourage earlier remediation.
- Senior leadership commitment is a prerequisite — without it, DevSecOps improvements stall at the team level.
The survey data makes clear that awareness of the problem is not the bottleneck. The work ahead is organizational: building the trust, the processes, and the tooling that turn DevSecOps from a compelling idea into daily engineering practice.