This article is based on reporting by ITPro Today covering Puppet’s 2019 State of DevOps: Industry Report Card, released in late January 2020.
Key Finding: DevOps Adoption Is Not Uniform Across Sectors
DevOps encompasses a broad set of development, operational, and security practices — and not every industry is adopting them at the same pace. That is one of the central findings of the 2019 State of DevOps: Industry Report Card, a 40-page report published by DevOps vendor Puppet in late January 2020.
The report card is derived from Puppet’s eighth annual State of DevOps survey, which gathered responses from approximately 3,000 technical professionals. Rather than presenting aggregate findings, this edition slices the data by industry vertical — grading financial services, retail, telecom, government, and technology on both DevOps practice adoption and security integration within the development pipeline.
“As the creator and one of the authors of the State of DevOps Report for the past eight years, and working closely with numerous customers through the various stages of their DevOps evolutionary journeys, the findings were more validating than surprising.”
— Alanna Brown, Senior Director of Community and Developer Relations, Puppet
Industry Grades at a Glance
The report card assigned letter grades to each industry across two dimensions: overall DevOps adoption and security integration. The results highlight meaningful gaps between sectors.
| Industry | DevOps Adoption Grade | Security Integration Grade |
|---|---|---|
| Technology | A | A− |
| Financial Services & Insurance | B | C− |
| Retail | Not specified | Not specified |
| Government | C | Lowest ranked |
| Telecom | Not specified | Not specified |
Note: The source article did not publish specific grades for all five industries. The table above reflects only the grades explicitly reported.
Technology Sector Leads the Pack
The technology industry earned an “A” for DevOps adoption and an “A−” for security integration — the highest scores across all sectors surveyed. According to Brown, this outcome was expected: DevOps principles tend to be embedded in the culture and operating model of technology companies from an early stage, making security integration a natural extension of existing practices rather than a retrofit.
Financial Services Held Back by Technical Debt and Silos
Financial services and insurance firms received a “B” for DevOps adoption but only a “C−” for security integration — a significant gap between operational maturity and security practice. Brown attributed this disparity to several structural factors common in established financial institutions:
- Accumulated technical debt from decades of legacy system investment
- Outdated technology stacks that are difficult to modernize incrementally
- Heavy regulatory requirements that slow the pace of change
- Functional silos between development, operations, and security teams that impede collaboration
These constraints make it harder for financial services firms to fully integrate security into the DevOps pipeline, even when they have made meaningful progress on the operational side.
Retail Prioritizes Deployment Frequency
While the technology sector scored highest overall, the retail industry stood out for one specific metric: on-demand deployment capability. According to the report, 57% of retail respondents said they are capable of deploying to production on demand, and 28% reported that they actually do so regularly.
“We work with a lot of big retailers, so it’s no surprise to us that they are heavily focused on deployment frequency because deploying changes faster gives them a clear competitive edge.”
— Alanna Brown, Puppet
For retailers, the ability to push updates quickly — whether for pricing, product availability, or customer-facing features — is a direct competitive advantage, which helps explain the sector’s emphasis on deployment pipeline maturity.
Government Struggles with Both Adoption and Security
The government sector received the lowest overall assessment in the report, earning only a “C” for DevOps adoption. Only 41% of government agencies reported the ability to deploy code on demand — well below the retail sector’s 57%.
Security integration was an even more significant weakness. The report stated:
“Out of all industries, government had the lowest percentage of respondents reporting that security tools are integrated into the development ecosystem, and security and development teams collaborate on threat models (9 percent).”
— 2019 State of DevOps: Industry Report Card, Puppet
A 9% collaboration rate between security and development teams is a stark indicator of how siloed government IT environments remain. Without integrated threat modeling and shared tooling, the gap between development velocity and security assurance is likely to widen rather than close.
Most Large Enterprises Are “Stuck in the Middle”
Beyond the industry-specific findings, Brown highlighted a broader challenge facing large enterprises across all sectors: many have adopted DevOps practices in isolated pockets but have not been able to scale those practices organization-wide.
“We have been working very closely with large enterprises on their DevOps initiatives, and we’ve found that most are stuck in the middle. They’ve adopted some practices and seen success in pockets, but there are still considerable barriers to scaling DevOps.”
— Alanna Brown, Puppet
This “stuck in the middle” dynamic is a well-recognized challenge in DevOps transformations. Pilot successes in individual teams or product lines do not automatically translate to enterprise-wide adoption, particularly when organizational structure, culture, governance, and tooling remain inconsistent across business units.
What This Means for DevOps Practitioners
The industry-segmented view of DevOps maturity offered by Puppet’s 2019 report card provides useful benchmarks for teams evaluating their own progress. A few practical takeaways:
- Security integration is a lagging indicator across most industries. Even sectors with relatively strong DevOps adoption (financial services) scored significantly lower on security integration. DevSecOps remains an area where most industries have room to improve.
- On-demand deployment is a meaningful maturity signal. The gap between capability (57% in retail) and actual practice (28%) suggests that infrastructure readiness alone is insufficient — cultural and process changes are also required.
- Government and regulated industries face structural barriers. Technical debt, compliance requirements, and organizational silos are not problems that tooling alone can solve. Transformation in these sectors requires executive sponsorship and deliberate process change.
- Scaling beyond pilot programs is the defining challenge for enterprises. Teams that have demonstrated DevOps success locally should prioritize identifying and removing the organizational blockers that prevent broader adoption.
Puppet has published the State of DevOps Report annually since 2012, making it one of the longest-running longitudinal data sets on DevOps adoption. The full 2019 Industry Report Card is available through Puppet’s website.