This article summarizes findings from a study published by Enterprise Strategy Group (ESG) in collaboration with Data Theorem, originally reported by devops.com (October 2019).
Overview
Enterprise Strategy Group (ESG), working with Data Theorem — a provider of tools for securing APIs and mobile applications — surveyed 371 IT and cybersecurity professionals at North American organizations to assess the state of DevSecOps adoption. The results paint a picture of genuine momentum tempered by fragmented implementation, organizational silos, and tool sprawl.
Where DevSecOps Adoption Stands
Headline adoption figures look encouraging on the surface:
- 55% of respondents have already incorporated security into their DevOps processes.
- 22% plan to do so.
- 20% are still in the evaluation stage.
However, the survey reveals that adoption is uneven in practice. Only 33% of organizations involve cybersecurity teams at the start of the application development process — a foundational requirement for genuine shift-left security. And just 39% report that cybersecurity professionals are involved in more than half of their cloud-native application projects today, though that figure is projected to reach 78% within two years.
Coverage of actual applications is even more telling: only 8% of respondents are securing 75% or more of their cloud-native applications with DevSecOps practices right now. Within two years, 68% expect to reach that threshold — a dramatic projected shift that underscores both the ambition and the gap.
The Multi-Platform Security Challenge
One reason consistent DevSecOps is difficult to achieve is the diversity of platforms organizations already run. According to the survey, workloads are distributed across:
- Virtual machines: 34%
- Bare-metal servers: 28%
- Containers: 23%
- Serverless computing frameworks: 15%
Only 10% of organizations currently run more than half their workloads on public cloud, but that proportion is forecast to rise to 30% within two years.
This sprawl directly drives the top reported security challenges:
- Consistently managing cybersecurity across multiple platforms: 43%
- Cost and complexity of implementing controls across platforms: 35%
- Lack of understanding of threat vectors facing cloud-native applications: 35%
Container and Serverless Security Gaps
For teams working with containers, the survey identified two equally-cited top concerns:
- Aligning security controls with deployment models: 32%
- Verifying that images in registries meet compliance requirements: 32%
For serverless environments, API vulnerabilities were the most commonly cited concern at 32%. Budget allocations reflected these priorities closely: vulnerability scanning of registry-resident container images (26%) narrowly edged out API security tooling (25%) as the leading spend category.
Tool Sprawl and the Vendor Consolidation Dilemma
One of the more striking findings involves the tension between tool specialization and platform consolidation. The survey found:
- 73% believe their organization uses too many specialized products to secure cloud-native applications properly.
- 50% expect their organization to consolidate controls by procuring from a smaller set of vendors — or even a single vendor.
- Yet 59% still prefer disparate point controls to achieve more functionality, even if it means managing multiple tools across different compute types and locations.
This contradiction is common in security purchasing decisions: teams recognize the overhead of fragmented tooling but are reluctant to trade away functionality for simplicity. The most important product attributes cited by respondents were a rich set of pre-deployment capabilities, runtime security features, support across mixed server workload types, and flexible deployment options.
Organizational Structure: Still a Bottleneck
Perhaps the most fundamental barrier identified in the study is organizational design itself. 82% of respondents said their organization has different teams assigned to secure cloud-native applications. Among that group:
- 50% plan to merge these responsibilities in the future.
- 32% intend to keep them separate.
As ESG Senior Analyst and Group Director Doug Cahill noted, cybersecurity is increasingly being baked into applications rather than bolted on after the fact. But achieving that consistently at scale requires dismantling the team boundaries that still keep security downstream of development in most organizations.
Key Takeaways for DevOps and Security Teams
The ESG findings offer several actionable signals for teams navigating their own DevSecOps journey:
- Shift left early and formally. Involving security at the start of development — not just during testing or deployment — is still uncommon. If only a third of organizations do this today, there is real competitive differentiation available to those who do.
- Address the platform coverage gap. Having a DevSecOps process that applies to some pipelines but not others is a significant risk. Audit which workload types and deployment environments lack consistent security controls.
- Prioritize API security. Whether workloads run in containers or serverless environments, API vulnerabilities consistently surfaced as a top concern. Ensure API scanning is part of your CI/CD pipeline, not a post-release afterthought.
- Challenge your tooling assumptions. If your team recognizes tool sprawl as a problem but keeps acquiring point solutions, define explicit criteria for when a platform investment is more appropriate than another specialized tool.
- Plan the organizational change, not just the technical one. Merging security and development responsibilities requires governance decisions, training, and process redesign — not just new tooling.
Conclusion
The ESG/Data Theorem study confirms what many practitioners already sense: broad awareness of DevSecOps has not yet translated into consistent, organization-wide practice. The two-year projections — 78% cybersecurity team involvement in cloud-native projects, 68% securing 75% or more of applications — reflect strong intent, but intent and execution are very different things. The organizations that close the gap fastest will be those that treat DevSecOps as a structural and cultural change, not merely a tooling upgrade.