This article is based on reporting originally published at searchitoperations.techtarget.com and commentary from practitioners at DevSecCon Seattle and Forrester Research.
DevSecOps Is Maturing — But Attackers Are Still Ahead
DevOps security practices have matured considerably inside enterprise organizations. Smaller, more frequent application deployments reduce blast radius and manual error. Infrastructure as code, configuration management, and GitOps workflows lock down the path to production while improving audit trails. By many measures, DevOps teams have improved security almost as a byproduct of improving their delivery processes.
Yet even as DevSecOps goes mainstream, data breaches continue to dominate headlines. Security researchers and practitioners speaking at industry events say that despite real progress in tooling and automation, security teams are not keeping pace with attackers — who have also learned to automate, iterate, and specialize.
“The attackers have innovated, and that’s one of the problems with our industry — we’re at least five years behind the attackers. We’re in a mode where we’re convinced, with all this VC money and money spent on marketing, that we have to wait for a product to be available to solve these problems … and they’re never going to be ready in time.”
— Adrian Sanabria, Advocate, Thinkst Applied Research
DevOps Security Tools Aren’t Enough on Their Own
Investing in security tooling is necessary, but not sufficient. Sanabria points to the well-documented 2013 Target breach as a cautionary example: security software detected suspicious activity, but IT staff failed to act on its warnings — a combination of alert fatigue and inadequate operational process.
The pattern he describes from breach research is consistent:
- Organizations already owned the tools needed to detect or prevent the breach.
- Those tools were either misconfigured, misunderstood, or not operationally integrated into team workflows.
- Alerts were generated but not acted on — due to alert fatigue, unclear ownership, or missing runbooks.
Beyond misconfigured tooling, many high-profile breaches don’t exploit technical vulnerabilities at all. Social engineering — phishing emails impersonating executives, fraudulent payment redirection, and ransomware that relies on human error rather than software exploits — remains one of the most effective attack vectors.
“Often, breaches don’t even require hacking. It requires understanding of financial processes, who’s who in the company, and the timing of certain transactions.”
— Adrian Sanabria, Thinkst Applied Research
Ransomware campaigns in particular depend almost entirely on social engineering to gain an initial foothold. Technical controls help contain the damage once an attacker is inside, but they rarely stop the initial intrusion when a human makes an uninformed decision.
Collaboration and Organizational Strategy Are Critical
The biggest unsolved problems in DevOps security are organizational, not technical. Jeremy Pullen, CEO of digital transformation consultancy Polodis, argues that security teams habitually undervalue leadership, collaboration, and cross-functional communication — treating security as a purely technical discipline rather than an organizational capability.
“Technology people don’t think of leadership skills and collaboration as primary job functions. They think the job is day-to-day technical threat remediation, but you can’t scale your organization when you have people trying to do it all themselves.”
— Jeremy Pullen, CEO, Polodis
This overreliance on individual security experts produces what Pullen calls a lamppost effect: specialists overcompensate for the risks they know best and systematically underestimate risks outside their direct experience. The result is a Whac-a-Mole dynamic — patching one vulnerability while others open up elsewhere.
Siloed team structures compound the problem. Developers and operations engineers may be blind to application-layer security risks, while security teams focus primarily on infrastructure and physical controls — leaving application security as an organizational blind spot. This is a familiar DevOps failure mode: the same silos that hurt reliability and deployment velocity also increase security fragility.
Pullen recommends that DevSecOps teams start thinking of themselves as nodes in a network rather than layers in a stack — understanding how their work connects to, and depends on, the decisions of other teams. That requires intentional enterprise architecture thinking: understanding governance boundaries, access domains, and how tools like CI/CD systems (Jenkins, GitHub Actions, etc.) fit into the broader security posture of the organization.
Security Teams Need to Practice Incident Response, Not Just Plan It
Strategic hardening of pipelines and infrastructure matters, but organizations also need to practice their response to active incidents. Nick Drage, principal consultant at Path Dependence Ltd., made this case at DevSecCon Seattle using an analogy that resonates with DevOps practitioners:
“Cybersecurity so far has been focused on solitary study and being the best technical practitioner you can be … which reminds me of golf. But in reality, cybersecurity is a fight with an opponent over territory — much more like American football.”
— Nick Drage, Principal Consultant, Path Dependence Ltd.
The football analogy is instructive in a second way: a defense that gives up yards has not necessarily given up points. Security teams that think in terms of defense in depth — not just perimeter controls — can contain an initial intrusion before it becomes a full breach. The goal isn’t to prevent every attempted incursion; it’s to protect the end zone.
Sanabria frames the same argument with a firefighter analogy: a crew that owns every piece of equipment but has never trained with it together will fail on their first real call. Yet that’s exactly the situation many enterprise security teams find themselves in when a real incident hits — they have the tools, but not the muscle memory.
The Next Wave: Human-Focused Chaos Engineering for Security
The emerging answer to this problem looks a lot like chaos engineering — but applied to human and organizational systems, not just infrastructure. Several concrete approaches are gaining traction:
- Simulated incident response workshops: Organizations such as OpenSOC run training workshops that include simulated ransomware attacks, giving teams hands-on practice responding to realistic scenarios before they happen for real.
- Red teaming: Treating penetration tests as live attacks — with real incident response procedures activated — builds organizational muscle memory and surfaces gaps in process, not just technology.
- Open source attack simulation: Tools such as Infection Monkey from Guardicore Labs simulate attack propagation inside a network, letting teams observe how a breach might spread and test their detection and containment capabilities.
- Human resilience testing: Some technology organizations practice intentional human disruption — for example, randomly directing employees to delay responses or provide incorrect answers to routine requests — to test whether the organization’s processes are resilient to individual failures.
“Despite the implications of the word ‘chaos,’ some companies are already presenting chaos engineering to their risk management leaders and auditors. This is the future of governance — controlling risk on the human side of our systems.”
— Charles Betz, Analyst, Forrester Research
Key Takeaways for DevSecOps Teams
- Tooling is necessary but not sufficient. Misconfigured or poorly operationalized security tools provide false confidence. Validate that alerts are actionable and that teams know how to respond to them.
- Most breaches have a human vector. Social engineering, phishing, and process exploitation bypass technical controls. Employee awareness and process hardening matter as much as infrastructure security.
- Break down security silos. Application security, infrastructure security, and operations need shared visibility and shared ownership — the same principle that drives DevOps culture more broadly.
- Practice incident response, don’t just document it. Tabletop exercises, red team engagements, and simulated attacks build the organizational capability to respond effectively when it counts.
- Adopt defense in depth. Assume attackers will gain an initial foothold. Design controls that contain and detect lateral movement before a breach reaches critical systems.
- Treat security as a team sport. Cross-functional collaboration, shared threat models, and leadership involvement are prerequisites for scaling security across a modern engineering organization.