This article is based on findings from Synack’s 2020 State of Compliance and Security Testing Report, as reported by Frank Ohlhorst on devops.com. Synack surveyed leaders from more than 300 organizations across technology, government, healthcare, IT, and financial services.
The Cultural Shift Driving DevSecOps
According to Synack’s 2020 State of Compliance and Security Testing Report, some of the world’s largest organizations are undergoing a significant cultural shift within their development teams—one that is creating fertile ground for DevSecOps adoption. The report surveyed leaders from more than 300 organizations spanning multiple industries, including technology, government, healthcare, information technology, and financial services.
The core finding is straightforward: security testing is no longer being treated as an annual compliance checkbox. Instead, organizations are moving toward rigorous, continuous testing models that keep pace with modern software delivery pipelines.
Why Traditional Security Testing Was Failing DevOps Teams
The mismatch between legacy security practices and modern development methodologies has been a persistent problem. Agile and DevOps teams operate on continuous integration and continuous delivery (CI/CD) pipelines that ship code frequently—sometimes multiple times per day. Traditional, point-in-time security assessments performed quarterly or annually simply cannot keep up with that cadence.
The result: security became a bottleneck, a late-stage gate that slowed delivery without genuinely reducing risk. This structural failure pushed many organizations to rethink how security integrates with development and operations—ultimately driving adoption of the DevSecOps model, in which cybersecurity teams have equal standing alongside development and operations from the very start of the software lifecycle.
Regulatory Pressure Is Adding Urgency
External compliance requirements are compounding the internal pressure to modernize security testing practices. Regulations such as the California Consumer Privacy Act (CCPA), PCI DSS 4.0, and New York’s SHIELD Act each impose specific requirements around data protection and security validation. Organizations that rely on infrequent, manual security assessments are increasingly exposed—both to regulatory penalties and to the reputational damage that follows a breach.
Continuous security testing, particularly when combined with crowdsourced models that tap large pools of vetted security researchers, offers a path to meeting these requirements in a sustainable way.
Key Findings from the Synack Report
- Continuous testing is becoming the norm: 44% of surveyed organizations perform security tests on a monthly or weekly basis, signaling a genuine move away from annual assessments.
- External vendors are widely used: 63% of organizations commonly rely on external vendors to identify and reduce vulnerabilities.
- Vendor overlap is a cost problem: 52% of respondents reported unwanted cost and complexity caused by overlapping functionality across multiple security vendors.
- Testing durations are still too short: On average, most security tests last just 20 hours—far below the 1,500–2,000 hours per year that Synack recommends as a best-practice baseline for continuous coverage.
- Crowdsourced adoption is accelerating: The report projected that adoption of continuous security testing platforms would increase four-fold in 2020, driven by demonstrated effectiveness and the industry-wide cybersecurity talent shortage.
The Case for Crowdsourced Security Testing
Crowdsourced security testing platforms aggregate large numbers of vetted, skilled security researchers who can test continuously and at scale. According to Synack’s own analysis, crowdsourced security testing solutions deliver 147% higher ROI than a typical penetration test and reduce the signal-to-noise ratio in vulnerability reporting, decreasing the operational burden on internal security teams.
Synack CTO and co-founder Mark Kuhr framed the trend this way:
“The rapid embrace of crowdsourced security testing has happened because it is proven to work better than traditional security testing methods and addresses the ever-growing talent gap within organizations.”
— Mark Kuhr, CTO and Co-founder, Synack
Kuhr also noted that crowdsourced platforms can help organizations meet established compliance frameworks such as NIST 800-53 while simultaneously delivering real security outcomes—not just audit-ready documentation.
Continuous Testing as a DevSecOps Foundation
Synack CMO Aisling MacRunnels highlighted the gap that still exists between current practice and what continuous security genuinely requires:
“Although we are seeing a move toward a 24/7, 365 security culture at organizations in a wide variety of industries and geographies, there is still ample room for improvement. Our survey found that on average, most security tests are lasting just 20 hours. As the number of cyber incidents continues to increase, it will be imperative for decision-makers to implement security testing solutions on a continuous basis with 1,500–2,000 hours of testing a year.”
— Aisling MacRunnels, CMO, Synack
The implication for DevOps teams is clear: achieving a mature DevSecOps posture means more than integrating a SAST or DAST tool into a CI pipeline. It means building a culture where security testing is as continuous, collaborative, and automated as the development process itself. Crowdsourced platforms are one mechanism that makes sustained, high-volume testing economically and operationally feasible for organizations that cannot staff the equivalent capability in-house.
What DevOps Teams Should Take Away
- Audit your testing frequency. If your organization performs security assessments less than monthly, you likely have blind spots that CI/CD pipelines are outpacing.
- Consolidate your security vendor stack. More than half of organizations surveyed were paying for overlapping functionality. A unified testing platform reduces both cost and operational complexity.
- Measure hours of coverage, not just findings. The gap between 20 hours of average testing and the 1,500–2,000 hour benchmark is a useful internal metric for assessing security program maturity.
- Align security testing with compliance objectives proactively. Regulations like CCPA and PCI DSS 4.0 reward organizations that can demonstrate continuous, documented security practices—not just annual attestations.
- Treat the talent gap as a structural issue, not a hiring problem. Crowdsourced models offer access to specialized security expertise that most organizations cannot recruit and retain internally.
The Synack report reflects a broader industry recognition: DevSecOps is not simply a tooling decision. It is a cultural and organizational commitment to making security a continuous, shared responsibility across the entire software delivery lifecycle.