DevOps teams have naturally embraced microservices and modern application delivery workflows. But those same teams often face friction from risk-averse leadership or from security functions that struggle to keep pace with the speed of cloud-native development. Organizations where development teams take an active role in shaping cloud transformation strategies tend to fare better on both delivery speed and security posture.
The following analysis draws on themes from the State of Cloud Native Security Report 2020 published by Palo Alto Networks—described at the time of writing as one of the largest globally distributed market research datasets on cloud-native security. The data points below are sourced from that report.
Cloud-Native Architectures and What They Mean for DevOps Security
Cloud Workloads Are Growing—Rapidly
Survey respondents estimated that, on average, 46% of all workloads were already running in the cloud at the time of the survey. Ninety-five percent of respondents expected that share to grow over the following 24 months. For DevOps teams, this trajectory means more deployments, more managed services, and more surface area that security controls must cover.
Cloud Infrastructure Is Constantly Changing
Eighty percent of survey respondents said their company’s cloud infrastructure is continuously evolving—driven by experimentation with new services, evaluation of emerging cloud offerings, and iterative refinement of best practices. This constant change creates a significant challenge for security teams: tooling and policies calibrated for today’s architecture may be outdated by next quarter.
That concern is widely felt: 75% of respondents worried that cloud threats already outpace the organization’s security capabilities. Continuous change is not inherently bad for DevOps, but it demands that security practices keep the same cadence as infrastructure updates—not lag behind them.
Multi-Cloud Is the Norm, Not the Exception
Nearly every organization surveyed—90%—confirmed they use more than one cloud provider. Workloads are spread across a mix of compute architectures:
- Virtual Machines (VMs): ~30% of workloads on average
- Containers: ~24%
- Platform-as-a-Service (PaaS): ~22%
- Container-as-a-Service (CaaS): ~21%
This diversity of platforms and compute models means security teams need both broader and deeper visibility across the entire infrastructure estate. The survey found that 57% of security teams were already using more than five distinct security tools, with some organizations running eleven or more. More tools often means more dashboards, more policy engines, and more manual effort to correlate findings—a problem of its own.
The Threat Landscape: No Single Dominant Risk
When asked to name their single greatest cloud security threat, respondents spread their answers across ten different categories—none commanding a clear majority. This distribution itself is important: there is no obvious chokepoint to secure, which makes prioritization harder and collaboration between development and security teams more essential.
| Threat Category | % of Respondents Ranking It #1 |
|---|---|
| Data exposure | 13.2% |
| Malware | 12.8% |
| Application vulnerabilities | 10.9% |
| Weak or broken authentication | 10.0% |
| Insider threats | 9.7% |
| Credential leakage | 9.1% |
| Insecure APIs | 9.0% |
| Infrastructure misconfigurations | 9.0% |
| Application misconfigurations | 8.7% |
| Over-permissioned access and misconfigurations | 7.7% |
The near-equal distribution across these categories explains why DevOps and security teams sometimes disagree on priorities. Without a single dominant threat to rally around, teams must negotiate which risks deserve the most immediate attention—a conversation that works best when security is embedded in development workflows from the start rather than bolted on at the end.
Embedding Security Across the Full Application Life Cycle
The report ranked organizations by their level of security preparedness and compared the habits of the highest-ranked cohort against lower-ranked peers. The results support a clear pattern: organizations with the strongest security posture treat security as a continuous, integrated practice rather than a gate at the end of the pipeline.
- 45% of highly prepared organizations embed security directly into their DevOps processes.
- 41% integrate security controls at four or more stages of the development life cycle.
- Leading organizations automate key security practices—including configuration monitoring and vulnerability scanning—and implement guardrails or quality gates that block insecure code from advancing through the pipeline.
The practical implication for DevOps teams is straightforward: shift security left. Identify vulnerabilities during the design and development stages, not after code is deployed. This means selecting CI/CD tooling and cloud security platforms that can run policy checks, scan container images, and validate infrastructure-as-code templates automatically at each stage.
DevOps teams should also work with security leadership to evaluate consolidated platforms capable of spanning multiple cloud providers and compute types. Replacing a fragmented collection of point tools with a platform that provides unified visibility and integrated policy enforcement reduces complexity and makes continuous security monitoring operationally sustainable.
Practical Next Steps for DevOps Teams
The data from the 2020 report points to a clear direction of travel for teams navigating cloud-native security:
- Accept that multi-cloud and hybrid compute is permanent. Design security controls that work across VM, container, PaaS, and CaaS workloads from the outset rather than retrofitting later.
- Shift security left. Integrate static analysis, secrets scanning, dependency checks, and policy validation as early as the developer’s local environment and certainly within every CI pipeline run.
- Automate configuration monitoring. Infrastructure misconfigurations and over-permissioned access together account for a significant share of prioritized threats. Automated drift detection and least-privilege enforcement reduce this risk without adding manual toil.
- Reduce tool sprawl. If your organization is running more than five security tools across the cloud estate, evaluate whether a consolidated platform can reduce the operational overhead of correlating findings across dashboards.
- Increase collaboration between development and security teams. The breadth of the threat landscape means no single team can own cloud security alone. Shared threat models, joint incident reviews, and co-authored security requirements help both sides align on priorities.
Summary
Cloud-native adoption is accelerating, and that acceleration is not slowing down. The organizations that navigate this transition most effectively are the ones treating security as a continuous, automated, life-cycle-wide responsibility rather than a compliance checkpoint. For DevOps teams, that means advocating for integrated security tooling, embedding controls early in the pipeline, and building the kind of collaborative relationship with security teams that enables fast delivery without unacceptable risk.