This article is based on survey findings presented at the Cloud Native Security Summit and originally reported by devops.com. The survey was commissioned by Capsule8, Obsidian Security, and Signal Sciences, and conducted by Enterprise Strategy Group (ESG).
Key Findings: Cloud-Native Security Is a Growing Concern
At the Cloud Native Security Summit, Enterprise Strategy Group (ESG) released the results of a survey of 600 senior IT leaders examining how organizations are approaching security in cloud-native environments. The headline finding: DevSecOps automation has become the top cloud security priority as teams struggle to keep pace with the complexity of modern application delivery.
The numbers paint a clear picture of an industry under pressure:
- 43% of respondents identified maintaining consistency across disparate infrastructures as their biggest challenge with cloud-native applications — and the same proportion named DevSecOps automation as their highest cloud security priority.
- 90% expressed concern about lacking visibility into misconfigured cloud services, server workloads, network security, or privileged accounts.
- 83% said they were worried about insider misuse of privileged accounts.
- 66% reported that IT is more complex than it was two years ago, with 35% citing the management of multiple cybersecurity controls as a major contributor to that complexity.
Why DevSecOps Is Rising on the Cloud-Native Agenda
Doug Cahill, senior analyst and group director at ESG, noted that as organizations mature their DevOps practices for building and deploying cloud-native applications, security is increasingly being incorporated as part of the quality assurance process — rather than retrofitted after the fact. The industry is moving from “bolt-on” security toward building cybersecurity controls into software from the ground up.
Capsule8 CEO John Viega framed much of this shift as necessity-driven. In traditional on-premises environments, security teams could rely on physical or virtual appliances to protect a controlled perimeter. That approach breaks down in the cloud, where organizations operate under a shared responsibility model, often spanning multiple cloud service providers, and where they no longer control the underlying infrastructure.
Viega also highlighted a practical problem that is easy to underestimate: in many large organizations, hundreds of cloud accounts have been created independently by individuals across different business units — each with widely varying levels of security knowledge and practice. This ad-hoc sprawl creates significant exposure that traditional security tooling is poorly equipped to address.
The Speed Problem: Security Teams Cannot Keep Pace
Obsidian Security CTO Ben Johnson pointed to velocity as a core challenge. The rate at which cloud-native applications are deployed and updated is outrunning the capacity of dedicated security teams to review and respond. Many organizations, Johnson suggested, are still underestimating the full scope of the cloud-native security challenge they face.
This velocity gap is precisely why DevSecOps — integrating security practices and tooling directly into CI/CD pipelines — is gaining traction. Automated security gates, policy-as-code, container image scanning, and infrastructure-as-code validation are examples of controls that can operate at the speed of modern delivery pipelines without requiring a security review for every deployment.
Shifting Left: Security Expertise Moves to Development Teams
Hala Al-Adwan, VP of Technology at Signal Sciences, observed that while cybersecurity professionals will remain essential as consultants and architects, the day-to-day responsibility for implementing security controls is steadily shifting left — toward the developers and DevOps engineers who build and operate applications.
This shift creates a tooling challenge. Legacy security infrastructure was designed for specialist administrators who could interpret complex dashboards and manage dedicated appliances. DevOps teams need something different: programmable, API-driven security tooling that integrates natively into continuous integration and continuous deployment (CI/CD) workflows. Tools that generate too much noise or require context-switching out of the developer workflow are unlikely to see consistent adoption.
The Cultural and Scaling Challenge
Even with strong organizational intent, DevSecOps adoption faces a fundamental supply-and-demand problem. There are not enough trained cybersecurity professionals to embed one in every development squad or participate in every sprint. The practical goal, therefore, is not to staff every team with a security specialist — it is to encode security knowledge into tooling, automation, and guardrails that development teams can use without deep security expertise.
This is where investments in developer security education, secure-by-default platform configurations, and automated policy enforcement become critical. Security must scale with the organization, not depend on heroic individual effort.
Will Cloud-Native Applications Actually Be More Secure?
In principle, cloud-native architectures — built on containers, microservices, and immutable infrastructure — offer meaningful security advantages over legacy monolithic applications. Smaller blast radius, shorter-lived workloads, and infrastructure-as-code all create opportunities for stronger security posture.
In practice, realizing those advantages depends on teams actually implementing security controls throughout the development lifecycle. The survey findings suggest that the industry recognizes the priority, but the gap between intent and execution remains significant. Whether improved security outcomes will also motivate organizations to accelerate migration away from legacy monolithic applications is an open question.
Key Takeaways for DevOps and Platform Engineering Teams
- Audit cloud account sprawl. Unmanaged or loosely governed cloud accounts are a leading source of misconfiguration risk.
- Invest in visibility tooling. If your team cannot see misconfigured services, privileged account activity, or network anomalies, you cannot respond to them.
- Treat security as a pipeline stage, not a gate. Automated security checks embedded in CI/CD reduce friction and scale naturally with delivery velocity.
- Prioritize programmable, developer-friendly security tools. Legacy appliance-style tooling does not fit modern delivery workflows.
- Plan for knowledge transfer, not just headcount. Security expertise must be encoded into templates, policies, and guardrails — not just held by specialists.
Survey conducted by ESG and commissioned by Capsule8, Obsidian Security, and Signal Sciences. Original coverage via devops.com.