This article draws on findings from Puppet’s 2019 State of DevOps Report, based on a survey of nearly 3,000 respondents, as reported by CIO Dive.
Retail Surprises as the On-Demand Deployment Leader
When DevOps practitioners think of elite software delivery, they typically picture technology giants like Amazon, Google, and Netflix. Yet Puppet’s 2019 State of DevOps Report — drawn from nearly 3,000 survey respondents — found that retail outperforms most other sectors in a critically practical metric: the ability to deploy to production on demand.
According to the report, 57% of retail respondents can deploy to production on demand, with 28% doing so regularly. Alanna Brown, Senior Director of Community and Developer Relations at Puppet, described retail’s position as “head and shoulders” above other industries when she spoke to CIO Dive.
Why Retail Moves Fast
Two factors explain retail’s outsized DevOps agility:
- Competitive pressure from Amazon: The rise of e-commerce — and Amazon’s relentless pace of iteration — has forced brick-and-mortar and online retailers alike to accelerate software delivery or risk irrelevance. Competition acts as a forcing function that tech bureaucracy rarely can.
- Lower regulatory burden: Unlike financial services, insurance, or government agencies, retailers are not subject to the same compliance and security mandates that require slower, more controlled release processes. This freedom allows retail engineering teams to iterate more aggressively.
In retail, breaking down departmental silos isn’t a DevOps aspiration — it’s a business survival strategy. Teams are incentivized to move fast, optimize systems, and remove friction from software delivery pipelines.
Technology Leads Where It Counts Most: Security Integration
Despite retail’s deployment advantage, the technology sector holds the top position for DevOps maturity overall — particularly in integrating security into the software delivery lifecycle.
According to the Puppet report:
- 35% of technology companies treat security as a shared responsibility across teams, compared to a cross-industry average of 31%.
- This positions the tech sector as the closest to a true DevSecOps model among all industries surveyed.
Brown’s framing of this relationship is worth internalizing: “If you are doing DevOps well, chances are you are already doing security well.” The implication is that security integration is not a separate discipline bolted on to DevOps — it is a natural byproduct of mature DevOps practice.
A Note on the Technology Sector’s Survey Demographics
Top-tier technology companies such as Amazon, Google, and Netflix are widely cited — including by DevOps Research and Assessment (DORA) — as capable of deploying thousands of times per day. This would ordinarily skew overall technology-sector scores upward significantly.
However, Brown noted that the technology survey sample skewed toward smaller companies, which prevented the data from being dominated by elite performers. This is an important caveat when interpreting the numbers: the tech sector’s aggregate score reflects the broader industry, not just its outliers.
Government and Financial Services Lag Behind
At the other end of the DevOps maturity spectrum sit government agencies and financial services and insurance firms. The report identified regulation and bureaucracy as the primary constraints on adoption in these sectors.
Key findings from the report include:
- Financial services and insurance have established a DevOps foundation but progress toward more advanced adoption is slow. Compliance requirements, risk-aversion, and complex legacy infrastructure all contribute to this drag.
- Government is the slowest to remediate critical vulnerabilities: only 24% of government respondents can remediate critical vulnerabilities in under one day.
- By contrast, 53% of retail respondents can achieve the same remediation within a single day — more than double the rate of government agencies.
These figures illustrate that DevOps maturity is not purely a function of technical capability. It is equally a function of organizational structure, risk appetite, and the external pressures — regulatory or competitive — that shape engineering culture.
What Cross-Industry Comparisons Tell Us
The Puppet report’s industry breakdown offers a useful framework for understanding why DevOps adoption varies so widely. The bottlenecks are different depending on context:
| Sector | Primary DevOps Driver | Primary DevOps Barrier | On-Demand Deployment (approx.) |
|---|---|---|---|
| Retail | Competitive pressure | Organizational silos | 57% |
| Technology | Engineering culture | Survey sample skew | Not specified separately |
| Financial Services | Early DevOps investment | Regulation, risk controls | Below average |
| Government | N/A | Bureaucracy, compliance | Slowest overall |
For DevOps practitioners and engineering leaders, the takeaway is straightforward: benchmark your organization not just against elite technology firms, but against comparable industries facing similar regulatory and competitive conditions. Retail’s success shows that constraint — in this case, the absence of heavy regulation — can be a genuine structural advantage worth understanding and, where possible, replicating through internal policy decisions.
Key Takeaways for DevOps Teams
- Competitive pressure is a legitimate DevOps accelerant. If your organization lacks external urgency, look for ways to create internal accountability around deployment frequency and mean time to recovery.
- Security integration is a marker of DevOps maturity, not a separate track. Teams that have genuinely adopted DevOps principles tend to share security ownership across functions.
- Regulatory environments shape what’s possible. Engineering leaders in constrained sectors should focus on reducing internal bureaucracy wherever regulations don’t explicitly require it.
- Vulnerability remediation speed is a meaningful lagging indicator. The gap between retail (53% remediating critical issues in under a day) and government (24%) underscores how operational culture — not just tooling — drives security outcomes.
Source: Puppet 2019 State of DevOps Report, as reported by CIO Dive.