This article is based on reporting originally published on ZDNet covering the State of DevSecOps report commissioned by Accurics.
The Core Problem: Security Debt Is Going Unresolved
Cloud IT environments have grown so complex that many security issues are not just difficult to fix — they are effectively left unaddressed. According to the State of DevSecOps report commissioned by Accurics, only 4% of security issues identified in production are actually remediated. The sheer complexity of modern cloud-native stacks is widening the enterprise attack surface in ways that traditional security tooling was never designed to handle.
About the Report
The report was commissioned by Accurics, a company that focuses on addressing security through infrastructure as code (IaC) practices. The research examines how increased cloud complexity is exposing gaps that point security solutions cannot cover adequately.
“The crux of the issues lies in the fact that as the cloud-native stacks become more complex, point cloud security solutions become inadequate and gaps in coverage start to emerge.”
— State of DevSecOps Report, Accurics
Cloud-Native Adoption Is Outpacing Security Controls
The report highlights rapid adoption of technologies that each introduce their own security considerations:
- 84% of surveyed organizations are using containers.
- 41% are using serverless computing.
- Service mesh adoption is also increasing, further expanding the attack surface.
Each additional layer in the cloud-native stack — containers, orchestration, serverless functions, service meshes — introduces new configuration surfaces and potential misconfigurations. As Piyush Sharrma, CTO at Accurics, explains:
“Cloud infrastructure goes far beyond traditional network, storage, and compute; organizations are rapidly adopting new technologies such as serverless, containers, and service mesh. Cloud infrastructure is becoming increasingly immutable: it is never modified after it is deployed. If something needs to be changed, new infrastructure has to be provisioned through code.”
— Piyush Sharrma, CTO, Accurics
What ‘Immutable Infrastructure’ Means for Security
The term immutable infrastructure refers to a paradigm in which deployed resources are never patched or modified in place. Instead, any change — including a security fix — requires tearing down the existing resource and reprovisioning it from updated code. This approach offers reproducibility and consistency, but it also creates a specific security risk: if an organization’s infrastructure-as-code definitions contain flaws or misconfigurations, those flaws propagate to every deployment that follows.
The immutability model demands that security be embedded into the IaC pipeline from the start, because retrofitting fixes after deployment is structurally more expensive and disruptive than in traditional mutable environments.
Configuration Drift: The Silent Risk
One of the most significant findings concerns configuration drift — the divergence between the declared state of infrastructure in code and its actual runtime state. The report found that in 90% of cloud deployments, the security baseline had shifted because privileged users made ad-hoc changes directly to live infrastructure without updating the underlying IaC definitions that were intended to be the single source of truth.
This is a critical DevSecOps failure mode: the code declares one security posture, but the running environment reflects another. Automated scanning of IaC templates may show a clean bill of health while the live environment remains misconfigured.
Exposed Cloud Storage: An Avoidable Problem
The report found that approximately two-thirds of reported security issues involved exposed cloud storage services — resources made publicly accessible due to what the authors describe as “egregious mistakes” that best practices would prevent. Misconfigured object storage buckets, overly permissive access control lists, and the absence of encryption at rest remain persistent problems across organizations of all sizes.
These are not sophisticated attack vectors. They are preventable errors that automated policy enforcement in IaC pipelines — using tools that scan Terraform, CloudFormation, or similar templates before deployment — can catch before infrastructure is provisioned.
Real-World Impact: The Kinsing Malware Example
The report cites the Kinsing malware campaign as a concrete example of how misconfigurations translate into breaches. Attackers exploited a misconfigured API port to gain access to container clusters and deploy cryptomining malware. The attack required no vulnerability in the container runtime itself — an exposed port and a missing authentication control were sufficient.
This illustrates the practical consequence of the 4% remediation rate: the vast majority of known misconfigurations sit unaddressed long enough for threat actors to find and exploit them.
Key Takeaways for DevSecOps Teams
- Shift security left into the IaC pipeline. Scan infrastructure templates for misconfigurations before they are deployed, not after.
- Enforce policy as code. Use tools that codify security baselines and flag deviations automatically in CI/CD pipelines.
- Prevent configuration drift. Restrict direct access to live infrastructure and require all changes to flow through version-controlled IaC definitions.
- Audit privileged access. Privileged users making out-of-band changes are a primary driver of drift and untracked risk.
- Do not rely on point solutions alone. As cloud-native stacks grow in complexity, individual security tools covering only one layer are insufficient. A platform-level view of risk across IaC, runtime, and identity is required.
Bottom Line
The fundamental message of the Accurics State of DevSecOps report is that cloud-native complexity has made reactive security untenable. When only 4% of production issues are being fixed, the remediation model is broken. DevSecOps disciplines — embedding security into code, pipelines, and automation — are not optional improvements; at the scale and immutability of modern cloud infrastructure, they are the only viable path to a manageable security posture.