This article is based on findings from Sonatype’s 2020 DevSecOps Community Survey, originally reported by TechRepublic.
The State of DevSecOps in 2020
Integrating security into DevOps pipelines has proven considerably harder than simply automating deployment or testing. Sonatype — the company behind the Nexus application security platform — released its 2020 DevSecOps Community Survey to take stock of where the industry actually stands. The results highlight a clear divide between teams with mature DevOps practices and those still finding their footing, across tooling adoption, deployment frequency, and even developer satisfaction.
Who Responded: Survey Methodology and Representativeness
The survey drew more than 5,000 respondents from a Sonatype-maintained email list of approximately 160,000 software professionals. Sixty-five percent identified as individual contributors rather than executives, which lends more weight to the ground-level accuracy of responses — answers are less likely to reflect the polished view a CTO would project on behalf of their best-performing division.
The survey questions were developed with input from a range of industry advisors, including the DevOps Institute, Verica, the Software Engineering Institute’s DevOps division at Carnegie Mellon, Cloudbees, and DevOps.com. This consensus-driven approach shaped the ten security tool categories examined in the survey.
In terms of project type, 86% of respondents worked on web applications and 64% on web services, while mobile (29%) and desktop (37%) were less represented. Most respondents came from larger organisations: 68% had more than 25 developers.
Sonatype also validated self-reported maturity levels. If a respondent claimed high DevOps maturity but described a waterfall release process with quarterly web deployments, the team would downgrade that classification. This cross-checking adds a degree of rigour to the maturity segmentation.
Deployment Frequency: A Key — but Nuanced — Metric
Deployment frequency is a widely-cited proxy for DevOps maturity, but it can be misleading at the organisational level. A company with twelve teams might report deploying “twice a day” when each individual team ships roughly once a week. With that context in mind, the survey found that 55% of respondents deployed at least once a week — most likely measured at the team level.
The Ten DevSecOps Tool Categories — and Their Adoption Rates
The survey assessed adoption across ten distinct security tool categories. Listed roughly from highest to lowest adoption:
- Web Application Firewall (WAF) — the most widely adopted; 51% of even less-mature teams reported using one.
- Open Source Governance — tracking and managing open source dependencies and their licences.
- Intrusion Detection System (IDS)
- Static Analysis Security Testing (SAST) — often referred to as “code scanning.”
- Data Loss Prevention (DLP)
- Container Security
- Dynamic Analysis Security Testing (DAST) — commonly associated with penetration testing.
- Software Composition Analysis (SCA) — identifying known vulnerabilities in third-party libraries.
- Interactive Application Security Testing (IAST) — sometimes called “human pen testing” in the survey’s framing.
- Runtime Application Self-Protection (RASP) — the least adopted; only 20% of even the more mature respondents were running RASP.
The gap between WAF adoption (51% even among less-mature teams) and RASP adoption (only 20% among more-mature teams) underscores how early-stage most organisations’ runtime security postures remain. Mature teams are more likely to adopt tooling across all ten categories, but no category has reached universal adoption.
Developer Satisfaction and Security: Happy vs. Grumpy Engineers
One of the more striking findings involves developer satisfaction. Sonatype segmented respondents into “happy” and “grumpy” buckets based on questions about job satisfaction and whether they would recommend their employer to a friend. It then cross-referenced satisfaction with security tooling adoption.
Key findings from this cross-cut:
- Happy developers were nearly twice as likely to use security analysis tools: 65% of happy developers ran security analysis versus 34% of grumpy developers.
- Among those without security analysis tools, the numbers inverted: 66% of grumpy developers lacked these tools compared to 34% of happy developers.
- Mature DevOps environments correlated strongly with satisfaction: 92% of high-maturity respondents reported job satisfaction versus 61% of lower-maturity respondents.
- Grumpy developers also reported lower awareness of most security tool categories — with the notable exceptions of “Security Management” (20% happy vs. 22% grumpy) and informal awareness via rumour (19% of grumpy developers versus 5% of happy developers).
The interpretation here isn’t straightforward. It’s plausible that mature DevOps environments produce both better tooling adoption and more satisfied engineers, rather than satisfaction being a direct cause of security adoption. It’s equally possible, as the original report wryly notes, that happy developers are “too busy actually getting things done” to worry about security gaps — though the data suggests the opposite.
Real-World Consequences: The SaltStack Case
Derek Weeks, a vice president at Sonatype, highlighted the SaltStack security incident as a concrete example of what inadequate open source governance can cost an organisation. SaltStack’s maintainers released a patch before publicly disclosing the underlying vulnerability — a responsible disclosure approach. However, teams that lacked an open source governance or Software Composition Analysis system had no way of knowing they were running a vulnerable version of SaltStack, let alone that a patch was available. The result: multiple security breaches occurred the day after the public announcement.
The survey found that 21% of respondents had experienced an open source security breach in the past year. Weeks suggested even this figure is likely understated, given that many breaches go undetected without the right monitoring tools in place.
Key Takeaways for DevOps Teams
- Tooling adoption correlates with maturity. If your organisation lacks Software Composition Analysis or Static Analysis Security Testing, closing those gaps is a concrete step toward higher DevSecOps maturity.
- Runtime security remains an industry-wide gap. RASP adoption is low even among mature teams, representing an area where most organisations have room to improve.
- Open source governance is not optional. The SaltStack incident demonstrates that knowing what you’re running — and being alerted when patches drop — is as operationally critical as any deployment pipeline capability.
- Developer experience matters. The correlation between mature DevOps practices and developer satisfaction suggests that investing in tooling and process improvement may pay dividends in retention and morale, not just security posture.
- Self-assessed maturity should be verified. Sonatype’s approach of cross-checking self-reported maturity against actual practices is worth adopting internally when evaluating your own DevSecOps programme.
About the Survey
The 2020 DevSecOps Community Survey was conducted by Sonatype, providers of the Nexus application security platform. More than 5,000 software professionals participated. The survey questions were developed in collaboration with the DevOps Institute, Verica, Carnegie Mellon’s Software Engineering Institute DevOps division, Cloudbees, and DevOps.com. Original coverage appeared on TechRepublic.