This article is based on reporting originally published by TechRepublic, drawing on GitLab’s Global Developer Report and an interview with Colin Fletcher, Manager of Market Research and Customer Insights at GitLab.
The Security Case for Mature DevOps
GitLab’s Global Developer Report surveyed 4,071 software professionals and found a striking correlation between DevOps maturity and security outcomes: teams with mature DevOps practices are three times more likely to spot vulnerabilities earlier than teams with less developed practices. The same report found that organizations with advanced DevOps are 90% more likely to test between 91% and 100% of their code, compared with organizations in the early stages of DevOps adoption. Nearly half of all respondents reported practicing continuous deployment in at least part of their organizations.
Despite those gains, only about one-third of respondents rated their organization’s DevOps efforts as “good,” and barriers to fully integrated DevSecOps remain widespread.
Why DevOps Improves Vulnerability Detection
According to Colin Fletcher of GitLab, the security benefits of DevOps are not accidental—they flow directly from three foundational characteristics:
- Radical transparency. When every stakeholder—developers, security engineers, and operations staff—can see the full state of the pipeline, vulnerabilities are visible to more people at every stage.
- Collaboration. Cross-functional ownership of security means that security testing is treated as a shared responsibility rather than a gated handoff at the end of a release cycle.
- Automation. Automated security scanning—including static application security testing (SAST), dynamic application security testing (DAST), dependency scanning, and container scanning—is embedded directly in the CI/CD pipeline, so checks run consistently on every code change rather than periodically or on-demand.
Fletcher described the contrast with traditional IT models plainly: legacy operating models tend to be siloed and reactive. Security is a separate team with separate tools, engaged late in the delivery process. DevOps collapses that separation, making security “just another attribute” of the application that the entire team owns from the first commit.
Where Vulnerabilities Are Found: The Role of Test Environments
The GitLab report highlighted that merging code in test environments was the stage where bugs were found most frequently. This reinforces the value of integrating automated testing gates at the merge-request level—catching issues before they reach staging or production rather than after deployment, when remediation is far more costly.
Why More Code Gets Tested in DevOps Teams
Fletcher identified three overlapping factors that explain why DevOps organizations achieve higher code-test coverage:
- Smaller, focused units of work. Agile development principles, which underpin DevOps, encourage delivering code in smaller increments. Smaller changesets are easier to test thoroughly and quickly.
- Broader team involvement in testing. When testing is a shared team responsibility rather than a QA-only activity, more contributors participate in reviewing and validating code.
- Automation as a default. DevOps culture assumes that anything that can be automated should be. Testing pipelines run automatically on every push, removing the human decision of whether to run tests at all.
Achieving Continuous Deployment
Continuous deployment is enabled by the same factors that produce higher test coverage. Fletcher pointed to three enablers:
- Agile development principles that produce releasable increments frequently.
- Continuous integration (CI) pipelines that automate building, packaging, and testing so that a deployable artifact is always available.
- Modern delivery mechanisms—particularly containers and serverless computing—that reduce the friction of pushing code to production environments.
Barriers to DevSecOps: What Still Gets in the Way
Despite measurable progress, the report surfaces persistent friction points. Key barriers include:
- Developer prioritization gaps. Nearly half of security professionals (49%) reported difficulty getting developers to prioritize vulnerability remediation. When security tickets compete with feature work and the two teams have separate incentives, security tends to lose.
- Tool and team silos. Fletcher described the core inhibitor as “a stubborn division of tools, responsibilities, teams, incentives, processes, and data”—all of which prevent genuine collaboration and continuous improvement.
- Cultural and organizational inertia. DevOps requires upending decades of assumptions about how software teams are structured. Fletcher noted that shifts of this magnitude are typically measured in decades, not quarters.
- Substandard implementations. The report found that poor DevOps implementations are at least 2.5 times more likely to experience planning delays and bureaucratic entanglements than mature ones—a reminder that adopting DevOps tooling without changing culture and process can make things worse, not better.
Overcoming the Barriers
Fletcher’s prescription for overcoming these barriers is consistent across organizations of different sizes and industries: sustained investment across culture, tooling, skills, incentives, and organizational design—simultaneously, not sequentially. Specifically:
- Align developer and security team incentives around shared outcomes (e.g., mean time to remediation, deployment frequency).
- Adopt a single platform or tightly integrated toolchain that gives all stakeholders visibility into the same pipeline data.
- Invest in cultural transformation as seriously as in tooling—leadership commitment is a prerequisite, not an afterthought.
- Apply agile principles to the DevOps adoption itself: iterate, measure, and improve continuously.
Remote Teams and DevOps Maturity
One counterintuitive finding from the report: remote teams outperformed in-office teams on several DevOps dimensions. Developers in mostly remote environments were 23% more likely to have good visibility into what their colleagues were working on, and rated their organization’s security practice maturity 29% higher than those in traditional office settings. The report attributed this to remote work’s dependence on written documentation, asynchronous communication, and transparent tooling—habits that reinforce the same transparency and collaboration that make DevOps security effective.
Operational Advantages Beyond Security
Security is not the only operational benefit that mature DevOps delivers. Fletcher highlighted two additional gains:
- Speed. Faster delivery of new applications, features, and bug fixes is the most commonly cited driver of DevOps adoption—and the benefit most immediately felt. In mature teams, delivery capacity can begin to outpace the ability of product owners to define new work.
- Operational flexibility. Better documentation, greater automation, and deeper collaboration enable more asynchronous work patterns, giving team members more control over when and where they work. This is harder to quantify than speed, but Fletcher noted it as a meaningful quality-of-life improvement for engineering teams.
Key Takeaways for DevOps and Security Teams
- Mature DevOps practices correlate strongly with earlier vulnerability detection and higher code-test coverage.
- Embedding SAST, DAST, dependency scanning, and container scanning into CI/CD pipelines makes security testing automatic and consistent rather than periodic and manual.
- The biggest barrier to DevSecOps is not tooling—it is the persistence of organizational silos and misaligned incentives between development and security teams.
- Substandard DevOps is worse than no DevOps: incomplete adoption without cultural change introduces new friction without delivering the promised benefits.
- Remote-first practices and the documentation habits they enforce can accelerate DevOps maturity.