This article is based on findings from GitLab’s Global DevSecOps Survey, as reported by itbrief.co.nz. The survey covered more than 3,650 software professionals across 21 countries.
DevOps Adoption Is Accelerating — And Reshaping Org Charts
The boundaries between development, security, and operations teams are eroding. According to GitLab’s Global DevSecOps Survey, rising DevOps adoption is changing not just toolchains but job functions — blurring traditional role definitions across the entire software delivery lifecycle.
GitLab CEO and co-founder Sid Sijbrandij acknowledged the momentum while noting that significant work remains: “DevOps practitioners are working with faster release times, continuous integration and deployment, and progress towards shifting test and security left. That said, there is still significant work to be done, particularly in the areas of testing and security.”
Developers Are Taking On Operations Responsibilities — Partially
One of the survey’s clearest signals is how the developer role is expanding into traditionally ops-owned territory — but incompletely:
- 35% of developers say they define and/or create the infrastructure their application runs on.
- Yet only 14% say they monitor and respond to that same infrastructure — a task still largely owned by operations.
- More than 18% of developers instrument code for production monitoring.
- 12% serve as an escalation point during incidents.
This gap — where developers build infrastructure but rarely own its operational health — points to a structural ambiguity that can create blind spots in both reliability and security.
CI/CD Adoption Is Real, But Uneven
The survey confirms what many practitioners report anecdotally: DevOps tooling is delivering measurable speed improvements, but adoption of its more advanced practices remains fragmented.
- 83% of developers report releasing code more quickly after adopting DevOps.
- 38% said their DevOps implementation includes CI/CD.
- 29% include test automation in their DevOps practice.
- 16% have extended their practice to DevSecOps.
- Nearly 9% are working in multi-cloud environments.
While 60% of companies deploy multiple times per day, once a day, or once every few days, the maturity of their testing and security practices often lags that cadence.
Testing Is a Persistent Weak Link
Despite the industry-wide push toward continuous testing, the survey reveals a significant gap between deployment velocity and test coverage:
- Only 12% of respondents claim to have full test automation.
- Over 42% say testing happens too late in the development lifecycle.
- More than 42% of security respondents agree that testing occurs too late — consistent with the previous year’s findings.
Fast release cycles without proportionally mature test automation create compounding risk: bugs and vulnerabilities that could be caught early instead surface in production.
Security Ownership: Everyone — and No One
Perhaps the most operationally significant finding is the lack of consensus around who owns application security. The data reveals a fragmented picture:
- More than 25% of developers feel they are solely responsible for security.
- 23% of testers and 21% of operations professionals report the same feeling.
- On the security side, 33% of security team members say they “own” security.
- 29% of security professionals believe everyone should share responsibility equally.
When ownership is distributed this unevenly — and without clear process — accountability gaps emerge. Security teams consistently report that developers are not finding sufficient bugs in early development stages, and are slow to prioritize fixing those that are found. This pattern repeated from the previous year’s survey.
Security Teams See Ongoing Friction
Security professionals responding to the survey flagged three recurring pain points in their collaboration with development teams:
- 36% said it was hard to understand, process, and fix discovered vulnerabilities.
- 31% found prioritizing vulnerability remediation difficult.
- 42%+ reiterated that testing and security checks occur too late in the lifecycle.
GitLab Vice President of Security Johnathan Hunt framed the core challenge: “Although there is an industry-wide push to shift left, our research shows that greater clarity is needed on how teams’ daily responsibilities are changing, because it impacts the entire organisation’s security proficiency. Security teams need to implement concrete processes for the adoption of new tools and deployments in order to increase development efficiency and security capabilities.”
What This Means for DevSecOps Teams
The survey data points to a set of practical challenges that teams at any DevOps maturity level should address:
- Define security ownership explicitly. Informal shared ownership — where everyone feels responsible but no one is accountable — is not a strategy. Document who owns vulnerability triage, remediation timelines, and sign-off at each pipeline stage.
- Automate security checks in the pipeline. With only 16% reporting DevSecOps implementations, most teams have room to integrate SAST, DAST, dependency scanning, and container scanning into existing CI/CD workflows rather than treating them as post-deployment steps.
- Invest in test automation incrementally. Moving from near-zero automation to full automation is rarely achievable in a single effort. Target the highest-risk code paths first and build coverage over time.
- Align on role changes proactively. As developers take on infrastructure creation and monitoring responsibilities, update job expectations, training, and on-call rotation policies accordingly — before incidents expose the gap.
About the Survey
GitLab’s Global DevSecOps Survey gathered responses from more than 3,650 software professionals across 21 countries. The survey covers developer, operations, security, and testing roles, making it one of the broader cross-functional datasets available on DevOps and DevSecOps adoption trends.
Original reporting via itbrief.co.nz.