You’ve built the pipeline, defined the culture, and standardised the stack. But if security is still bolted on at the end of the delivery cycle, you’re leaving measurable performance gains on the table. That’s the central finding of Puppet’s 2019 State of DevOps Report — its eighth annual edition — which surveyed approximately 3,000 practitioners worldwide and focused squarely on security integration as the next frontier of DevOps maturity.
Security as an Unrealised Ideal
The report describes security in DevOps as an “unrealised ideal” — widely discussed, rarely achieved end-to-end. The authors acknowledge the uncomfortable truth: security is not a competitive differentiator in the way that shipping features quickly is. That tension helps explain why so many organisations deprioritise it even when they know better.
Yet the data shows that the organisations willing to do the hard work of embedding security across every phase of the software delivery lifecycle consistently outperform those that don’t — not just on security metrics, but on core delivery metrics as well.
What the Numbers Show
The survey segmented respondents by level of security integration, from no integration at all to security present across all phases of the delivery cycle. The performance gap between these groups is significant:
- DevOps maturity: 21% of respondents with the highest level of security integration reported reaching an advanced stage of DevOps maturity. Only 6% of those with no security integration could say the same.
- On-demand deployment: 61% of high-security-integration firms said they could deploy to production on demand, compared with 49% of firms with no security integration.
- Stopping insecure releases: Security-conscious firms were more than twice as likely to be able to halt a push to production when a moderate security vulnerability was detected, giving their customers meaningful protection against shipping insecure code.
- Security posture improvement: 82% of high-integration respondents said their security practices had significantly improved their overall security posture. Among those with no integration, that figure dropped to 38%.
These figures make a compelling case that investing in security integration is not purely a risk-mitigation exercise — it correlates with better delivery performance across the board.
Why Integration Is So Hard
The report is candid about the difficulty of the journey. Security integration exposes years of accumulated technical debt — the “duct tape and glue” holding legacy systems together. As one layer of complexity is addressed, another emerges. The report describes this bluntly: resolving one roadblock reveals the next, and the process can feel relentless before it becomes routine.
This is consistent with findings from the 2018 edition, which stressed that reaching a state where Dev and Ops work in genuine harmony requires slow, deliberate evolution. In that survey, only about one in ten organisations sat at either extreme of the maturity spectrum; the vast majority — roughly 79% — were somewhere in the middle, still working through the process.
What Advanced Teams Are Doing Differently
The report identifies a clear pattern in what distinguishes the most mature teams from the rest. Organisations at the advanced end of DevOps implementation are:
- Automating security policy configuration — removing manual, error-prone enforcement steps and encoding security requirements directly into the pipeline.
- Exploring automated incident response — moving beyond detection toward automated remediation for known threat patterns.
- Building high-trust, autonomous team structures — enabling application, operations, and security teams to collaborate cross-functionally without creating bottlenecks.
- Treating security as a shared responsibility — rather than delegating it entirely to a security team, delivery teams are empowered and expected to make security improvements themselves.
The combination of automation, organisational trust, and cross-functional ownership is what separates teams that have genuinely integrated security from those that have merely added a security sign-off step at the end of a sprint.
DevOps Principles Apply Directly to Security
Alanna Brown, then senior director of developer relations at Puppet and lead author of the report, summarised the core message clearly:
“The DevOps principles that drive positive outcomes for software development — culture, automation, measurement and sharing — are the same principles that drive positive security outcomes. Organisations that are serious about improving their security practices and posture should start by adopting DevOps practices.”
Alanna Brown, Senior Director of Developer Relations, Puppet
This framing is useful for engineering leaders who struggle to make the case for DevSecOps investment internally. The argument is not simply that security is important — it’s that the practices your team is already using for delivery excellence are the same ones that produce security excellence. The incremental cost of extending them to security is lower than building a parallel security process from scratch.
Key Takeaways for DevOps Teams
- Start with visibility. You can’t automate what you haven’t defined. Map where security checks currently happen in your pipeline and identify the gaps.
- Automate policy enforcement early. Static analysis, dependency scanning, and secrets detection should run on every commit — not as a final gate before production.
- Break down team silos. Security teams embedded in delivery cycles, rather than positioned as an external audit function, correlate strongly with better outcomes in the survey data.
- Measure security outcomes as delivery metrics. Mean time to remediate vulnerabilities, percentage of builds blocked by security failures, and deployment frequency post-incident are all trackable.
- Accept the long arc. The report is clear that full integration takes time. The 2018 data showed most organisations are mid-journey. Progress is incremental, but the compounding benefits are real.
The 2019 Puppet State of DevOps Report does not present a shortcut to DevSecOps maturity. What it does provide is a data-backed argument that the journey is worth taking — and that the same cultural and technical foundations you’ve already laid for continuous delivery are the right starting point for getting security right.