This article is based on findings originally reported by InformationWeek, drawing on the DigiCert “2017 Inviting Security into DevOps Survey” of 300 senior IT, DevOps, and Security executives.
The Security Gap in Fast-Moving DevOps Pipelines
DevOps has moved well beyond the experimental stage. For most organizations, it is now the default model for application development and delivery—breaking down silos between developers and IT operations and accelerating release cycles significantly. But that same velocity creates a dangerous blind spot: when security teams are not embedded in the process from the start, vulnerabilities get baked into products before anyone notices.
The challenge is not a lack of awareness. It is a matter of culture, timing, and tooling. Bolting security on after the fact is expensive, disruptive, and increasingly untenable as organizations scale their DevOps practices.
What the Data Says: The DigiCert 2017 Survey
In May 2017, DigiCert commissioned a survey of 300 senior management executives across IT, DevOps, and Security functions. All respondents came from organizations that had already adopted a DevOps posture—spanning small, medium, and large enterprises. The results paint a clear picture of both the urgency and the difficulty of integrating security into DevOps.
- 98% of enterprises surveyed had made integrating security teams into their DevOps methodology a stated priority.
- Approximately 49% reported they were actively working on the integration.
- Another 49% reported they had already completed it.
- 88% said integrating security without slowing the development process was somewhat to extremely important.
The near-universal consensus signals that the industry has crossed a tipping point. Security integration is no longer a “nice to have”—it is an operational expectation.
The Cost of Getting It Wrong
Respondents were clear about what happens when security is left out of the DevOps loop:
- 78% cited increased costs as a consequence of poor security integration.
- 73% cited slower application delivery.
- 71% cited increased security risks.
Addressing a vulnerability after an application ships grinds the development process to a halt. Engineering time is redirected, release schedules slip, and remediation costs compound. The irony is that the speed DevOps is meant to deliver evaporates the moment a post-release security incident occurs.
“The security team was adamant from the get-go that DevOps included security. They wanted to make sure that every angle of attack, every potential vector, every potential risk could be thought of ahead of time to minimize the potential for patient data to be exposed publicly.”
— IT Manager, large healthcare provider (survey respondent)
The Payoff When Integration Works
Organizations that had completed the integration reported measurable advantages over those still in progress:
- 22% more likely to report doing well with information security.
- 21% more likely to report meeting application delivery deadlines.
- 21% more likely to report lower application risk.
These figures reinforce the core argument: agility and security are not mutually exclusive. Done correctly, embedding security into DevOps improves both dimensions simultaneously.
Why the Transition Is Hard
Despite high intent, many organizations struggle to make integration real. Survey respondents identified several recurring obstacles:
- The process takes too long to show results.
- Security teams are resistant to changing established workflows.
- There is often no single person with both the technical credibility and the interpersonal skills to bridge cultural divides between teams.
This is a fundamentally human problem as much as a technical one. Tooling can automate a lot, but it cannot resolve the friction that emerges when development velocity norms collide with security gatekeeping norms.
Four Best Practices for Successful DevSecOps Integration
The DigiCert survey identified four practices consistently associated with successful security integration. These are not aspirational ideals—they reflect what organizations that completed the transition actually did.
1. Appoint a Social Leader
Identify one person whose explicit role is to drive cultural change. This person should clearly define the responsibilities of IT, Security, and DevOps roles, and act as the relationship bridge across all three functions. Without this kind of designated champion, integration efforts tend to stall in committee or collapse under competing priorities.
2. Bring Security to the Table from Day One
Place a security lead on every DevOps initiative and involve them at the project kickoff—not at the review stage. Practical steps include limiting access privileges from the start and implementing automated Public Key Infrastructure (PKI) to enforce signing and encryption across all network communications.
3. Invest in Automation
Manual security checks are a bottleneck in fast-moving pipelines. Automate baseline security practices directly into the DevOps workflow, including:
- Certificate lifecycle management
- Automated patching
- Vulnerability scanning
- Static code analysis (SAST)
When security checks run automatically in the CI/CD pipeline, they no longer depend on a human remembering to run them—and they no longer slow down developers waiting for a security sign-off.
4. Integrate and Standardize
Implement controls around standard security processes and integrate them with server configuration management and orchestration platforms. The goal is automated, consistent security enforcement that operates behind the scenes—invisible to developers during normal work, but reliably enforced at every step.
The Bottom Line: DevSecOps Is the Standard, Not the Exception
The transition from DevOps to DevSecOps—where security is a shared responsibility embedded throughout the software delivery lifecycle—is no longer optional for organizations operating at scale. The DigiCert survey data makes the business case plainly: enterprises that complete this integration report better security outcomes and better delivery performance. The two goals reinforce each other when the integration is done well.
The path forward requires both cultural leadership and technical investment. Identify your social leader, automate what can be automated, standardize what should be standardized, and involve security from the first line of a project—not the last.