This article summarises findings from GitLab’s third annual Global Developer Survey, originally published via GlobeNewswire in July 2019. Survey methodology: 4,071 software professionals surveyed between 23 January and 27 February 2019, with a reported margin of error of ±2% at a 95% confidence level.
Overview
In July 2019, GitLab released the results of its third annual Global Developer Survey, the first edition to expand its scope beyond culture, workflow, and tooling to include operations and security groups. The goal was to produce a comprehensive picture of the entire software development lifecycle — not just the developer perspective. With responses from more than 4,000 software professionals, the survey surfaces both the measurable gains that come from mature DevOps adoption and the stubborn organisational friction that prevents many teams from reaching true DevSecOps.
“The big takeaway from this survey is that early adopters of strong DevOps models are experiencing greater security and finding it easier to innovate, but barriers still prevent developers and security teams from achieving true DevSecOps. Teams need a single solution that can provide visibility into both sides of the process for streamlined deployment.”
Sid Sijbrandij, CEO and Co-founder, GitLab
The Core Finding: Security and Development Teams Are Still Misaligned
Despite broad agreement that security must be embedded in the development lifecycle, the survey exposed deep, ongoing friction between security professionals and developers:
- 69% of developers say they are expected to write secure code.
- 49% of security professionals say they struggle to get developers to treat vulnerability remediation as a priority.
- 68% of security professionals believe fewer than half of developers can spot security vulnerabilities later in the lifecycle.
- Roughly half of security professionals reported that bugs are most often found by their team after code has already been merged in a test environment — too late to be cost-effective.
“Our research tells us that while most developers are aware of the dangers that vulnerabilities present and want to dramatically improve their security capabilities, they often still lack organisational support for prioritising secure code creation, increasing secure coding skills, and implementing automated scanning and testing tooling to make that happen sooner rather than later.”
Colin Fletcher, Manager, Market Research and Customer Insights, GitLab
The data points to a structural problem: responsibility for security is being pushed onto developers without providing them the training, tooling, or organisational backing to act on it effectively.
Mature vs. Immature DevOps Models: The Performance Gap
The survey drew a sharp distinction between organisations with mature DevOps implementations and those still in early stages. The difference is not cosmetic — it shows up directly in security outcomes, developer experience, and delivery speed.
Advantages of a Mature DevOps Model
- Security teams operating within a mature DevOps practice are 3× more likely to discover bugs before code is merged.
- They are 90% more likely to test between 91% and 100% of their codebase compared to organisations with early-stage DevOps.
- Developers in mature organisations are almost 1.5× more likely to feel innovative.
- They are 3× more likely to discover security vulnerabilities earlier in the pipeline.
Costs of a Poor DevOps Implementation
- Teams with immature DevOps are 2.5× more likely to encounter their greatest delays during the planning stage.
- They are 2.6× more likely to encounter bureaucratic red tape that slows their ability to quickly fix vulnerabilities.
Only about one-third of all respondents rated their organisation’s DevOps efforts as “good,” which suggests that the majority of organisations still have significant room to mature — and significant security risk as a result.
CI/CD Investment Is Growing
Continuous integration and delivery remain central to DevOps strategy, and investment appetite reflects that:
- 43% of respondents said their organisations practice continuous deployment — on-demand or multiple times per day.
- 41% deploy somewhere between once a day and once a month.
- Almost two-thirds of respondents said they planned to invest in infrastructure in 2019 specifically to support continuous integration, deployment, and delivery.
Taken together, the data suggests that CI/CD is no longer a differentiator but an expected operational baseline — the question for most organisations is how mature and automated that pipeline is, not whether it exists.
Remote Teams Outperform On-Site Teams on Security and Collaboration
One of the more counterintuitive findings from the 2019 survey is that distributed or mostly remote teams consistently outperformed their in-office counterparts on collaboration and security maturity metrics:
- Developers in mostly remote environments are 23% more likely to have good insight into what their colleagues are working on.
- Remote developers rate the maturity of their organisation’s security practices 29% higher than those working in a traditional office setting.
- Distributed teams are more likely to quantify and document their work than in-office teams.
- Operations professionals in remote teams are more than 2.5× more likely to be given sufficient notice to support developer work, compared to their on-site peers.
The likely explanation is structural: remote and distributed teams are forced to rely on written communication, shared documentation, and tooling to co-ordinate — habits that also happen to reinforce DevSecOps best practices like audit trails, documented runbooks, and transparent change management.
What the Data Means for DevSecOps Practitioners
The 2019 GitLab survey makes clear that DevSecOps is not primarily a tooling problem. The gap between developer and security teams is as much organisational and cultural as it is technical. Key action points that emerge from the data:
- Shift security left in practice, not just policy. Expecting developers to write secure code without investing in training, automated scanning in the IDE, and pre-merge security gates creates responsibility without capability.
- Measure DevOps maturity honestly. The one-third satisfaction rate suggests many teams overestimate their progress. Conduct internal audits against a recognised maturity model.
- Automate vulnerability detection earlier in the pipeline. The 3× improvement in pre-merge bug detection seen in mature DevOps organisations is a direct result of automated SAST, DAST, and dependency scanning integrated into CI/CD — not manual review.
- Invest in documentation and async communication norms. The remote-team findings suggest that written-first communication habits improve both collaboration and security, regardless of physical location.
- Plan for CI/CD infrastructure as a security control. Continuous deployment without comprehensive automated testing is a risk amplifier. The infrastructure investment appetite reported in the survey should be directed toward security testing coverage alongside deployment velocity.
Survey Methodology
GitLab surveyed 4,071 software professionals between 23 January and 27 February 2019. The reported margin of error is ±2%, calculated assuming a population of 23 million software professionals at a 95% confidence level. Respondents included developers, security professionals, and operations practitioners across a range of organisation sizes and industries.
The full 2019 Global Developer Report: DevSecOps was published on the GitLab website. Readers interested in the primary source data should search for it directly on about.gitlab.com.