This article is based on findings originally reported by informationsecuritybuzz.com, drawing on a 451 Research report commissioned by Synopsys titled DevSecOps Realities and Opportunities.
The State of Security in DevOps Pipelines
DevSecOps—the practice of embedding application security directly into DevOps workflows—was already an established concept by 2018, yet adoption remained inconsistent across the enterprise. A study commissioned by Synopsys (Nasdaq: SNPS) and conducted by 451 Research surveyed 350 enterprise decision-makers across large organisations in a variety of industries. The resulting report, DevSecOps Realities and Opportunities, painted a clear picture: awareness of the benefits of integrating security into CI/CD pipelines was high, but actual implementation was lagging significantly.
The headline finding was striking: only half of CI/CD workflows included application security testing elements, despite respondents acknowledging its importance. This gap between intent and execution is a recurring theme in DevSecOps adoption and one that continues to challenge engineering and security teams today.
Key Findings from the Survey
- Speed expectations are high: 63% of respondents expected to deploy software at least four times faster in a DevOps model compared to traditional delivery approaches.
- Security is not integrated early enough: Even when security testing was present, it was often applied too late in the pipeline to provide meaningful risk reduction or to avoid expensive rework.
- SCA was identified as the most critical gap: Software composition analysis (SCA)—the process of identifying open source components affected by known vulnerabilities—was ranked as the application security element most urgently needed in CI/CD workflows.
- Open source blind spots are significant: Nearly 40% of organisations either did not perform SCA or claimed not to use any open source components at all. This is a concerning disconnect given that a separate Open Source Security and Risk Analysis report by Black Duck Software found that over 95% of applications contain open source code.
Why Security Is Being Left Behind
Respondents cited several practical barriers to integrating security into their DevOps workflows:
- Lack of automation and consistency: Manual security processes do not scale alongside rapid, high-frequency deployments.
- Reduced delivery speed: Security gates are often perceived as bottlenecks that slow down release cycles—a serious concern in teams measured on deployment frequency.
- Alert fatigue from false positives: High false-positive rates from security tools cause developers to lose trust in scan results, leading to warnings being ignored or suppressed.
These challenges are not new, but they become more acute as DevOps teams manage larger infrastructures, release software more frequently, and introduce significant code changes with each deployment. Without a deliberate strategy for integrating security tooling, scaling application security testing across these pipelines becomes increasingly difficult.
The Case for Shifting Security Left
Despite the challenges, the survey data supported a constructive conclusion: automated security tools integrated early in the software development life cycle (SDLC) have a measurable positive impact on both delivery speed and software quality. This aligns with the well-established “shift left” principle—catching vulnerabilities at the development or build stage is significantly cheaper and faster to resolve than finding them in staging or production.
Jay Lyman, principal analyst at 451 Research, summarised the opportunity clearly:
“While some DevOps teams are starting to incorporate application security into their CI/CD workflows, driven by factors such as improved software quality, compliance, and risk avoidance, there is ample room for improvement. In many cases, security testing is not being integrated often or early enough in the process for organisations to fully benefit from reduced risk and rework headaches.”
Jay Lyman, Principal Analyst, 451 Research
Software Composition Analysis: The Open Source Security Gap
One of the most actionable findings from the report concerns open source risk management. SCA tools scan application dependencies and flag components with known CVEs (Common Vulnerabilities and Exposures). The fact that nearly 40% of surveyed organisations either skipped SCA entirely or believed they had no open source dependencies is a significant risk posture problem.
Open source libraries are ubiquitous in modern application development. Teams that do not actively inventory and monitor these components are effectively running with unknown exposure. Incorporating SCA into the CI/CD pipeline—ideally triggered automatically on every build or pull request—provides continuous visibility into dependency risk without requiring manual intervention from security teams.
What DevSecOps Success Looks Like in Practice
Andreas Kuehlmann, general manager of the Synopsys Software Integrity Group at the time, framed the broader opportunity:
“DevSecOps presents an opportunity to make application security part of the cultural and technological fabric of modern, high-velocity development and deployment models. This study highlights many of the opportunities and challenges DevOps teams face in adapting and applying application security tools and best practices. It also validates that automation, speed, accuracy, and CI/CD integration are critical to making DevSecOps successful.”
Andreas Kuehlmann, General Manager, Synopsys Software Integrity Group
For engineering teams looking to close the gap identified in this research, a pragmatic starting point includes:
- Integrate SAST (static application security testing) into your build pipeline so that code is scanned automatically on every commit or pull request.
- Add SCA tooling to detect vulnerable open source dependencies before they reach production.
- Tune tools to reduce false positives so that developers receive actionable alerts rather than noise they will learn to ignore.
- Make security a shared responsibility between development, operations, and security teams—not a gate owned solely by a centralised security function.
- Measure and report on security metrics alongside deployment frequency, lead time, and change failure rate to give security the same operational visibility as reliability.
Conclusion
The 2018 451 Research and Synopsys study captured a formative moment in DevSecOps adoption: the industry understood what needed to be done, but execution was inconsistent. The core barriers—lack of automation, speed concerns, and false positive fatigue—remain relevant challenges for many organisations. The path forward has not changed: automate security testing, integrate it early, and treat it as a first-class engineering concern rather than a compliance checkbox applied at the end of the release cycle.