Organizations that execute DevOps well are not just shipping software faster — they are also better positioned to handle security. That is one of the central conclusions from Puppet’s State of DevOps Report, which surveyed nearly 3,000 technical professionals and found a strong correlation between DevOps maturity and security integration.
DevOps Maturity and Security Go Hand in Hand
For years, security has been treated as something bolted on at the end of the software development lifecycle — a necessary hurdle that slowed teams down and frustrated developers. Puppet’s research challenges that assumption directly.
According to the report, 22% of firms leading in security integration are also advanced in DevOps adoption. The implication is significant: the disciplines reinforce each other. Companies that have invested in solid DevOps practices — clear processes, strong automation, and cross-functional collaboration — are better equipped to embed security throughout the pipeline rather than treating it as a final gate.
“Doing DevOps well actually enables you to do security well,” said Alanna Brown, Senior Director of Community and Developer Relations at Puppet.
Nigel Kersten, Field CTO at Puppet, put it in operational terms: “I think everyone’s feeling the security pressure, but the people who are doing DevOps well are the ones who can actually respond to it.”
Security Does Not Have to Slow Delivery
A common concern among engineering teams is that introducing security controls into the development pipeline will create bottlenecks. Puppet’s data suggests the opposite is true for mature teams. Six in ten firms with high levels of security integration can deploy software to production on demand — meaning security and speed are not mutually exclusive when the integration is done correctly.
The key differentiator is environmental awareness. Organizations that thoroughly understand their infrastructure, automate their deployments, and maintain tight feedback loops are the ones best able to detect, respond to, and contain security incidents quickly.
The Rise of DevSecOps: More Than a Rebrand
The term DevSecOps has grown in popularity as practitioners look to make security an explicit part of the DevOps conversation. But Puppet’s experts caution that the name change is less important than the underlying practice change.
Kersten described DevSecOps as taking “the job that security is doing in production after deployment and giving them an automated tool to do that earlier in the lifecycle” — commonly referred to as shifting left. However, he was clear that shifting left does not simply mean repeating post-deployment security checks earlier in the pipeline using automation. That approach misses the point.
The more effective model is to bake security into every stage of the development lifecycle — from requirements and design through coding, testing, and deployment. This requires sustained cross-team collaboration and bringing security stakeholders into the software delivery pipeline as active participants, not reviewers at the end.
“It doesn’t really matter what the org structure is, so long as you have folks who are dedicated to security and who are working closely in an integrated way. It’s that integration that is really the key in terms of practice and working along the software delivery pipeline.”
Nigel Kersten, Field CTO, Puppet
What Integrated Security Actually Delivers
Puppet’s research produced two particularly striking findings for organizations that thoroughly integrate security into the development lifecycle:
- Twice as confident in their security posture compared to organizations that treat security as a separate concern.
- More than twice as likely to stop a push to production when a security concern is identified — meaning they have both the visibility and the authority to act before a vulnerability reaches end users.
These outcomes reflect a maturity of process rather than a specific toolset. Security confidence at this level comes from systematic integration across teams, not from deploying any single security product.
The Challenge: DevOps Adoption Is Not Linear
While the correlation between DevOps maturity and security integration is encouraging, Puppet’s report also acknowledges the complexity of the journey. DevOps adoption does not progress smoothly, and team dynamics can become particularly strained during the middle stages — when organizations are past the initial enthusiasm but have not yet achieved the consistency and automation of a high-performing team.
Security integration during these transitional phases is especially difficult. Teams may have inconsistent tooling, unclear ownership of security responsibilities, or insufficient automation to enforce policies at scale. Organizations navigating this stage should prioritize building shared accountability for security across development, operations, and security teams — rather than waiting until their DevOps practice is fully mature.
Practical Takeaways for DevOps Teams
- Start security integration early. Engage security stakeholders during sprint planning and design reviews, not just at code review or release gates.
- Automate security checks in the CI/CD pipeline. Static analysis, dependency scanning, and secrets detection should run automatically on every commit.
- Build cross-functional security ownership. Define who is responsible for security at each stage of the pipeline and make those responsibilities explicit.
- Measure security metrics alongside delivery metrics. Track mean time to remediate vulnerabilities alongside deployment frequency and lead time for changes.
- Treat a failed security gate as useful signal, not a failure. Teams that can stop a production push for a security issue have achieved a meaningful level of pipeline maturity.
The bottom line from Puppet’s research is straightforward: the organizations investing seriously in DevOps are the same ones building the foundations for stronger, faster, and more integrated security. The two goals are not in opposition — they are interdependent.
Source: CIO Dive, reporting on Puppet’s State of DevOps Report (2019).