DevOps Is Still Evolving — And That’s the Point

DevOps has never been a finished product. It is, by design, a continuously improving discipline built on Lean and Agile principles. What began as a collaboration between development and operations teams has steadily expanded to encompass security, compliance, and — most recently — the broader business organization itself.

The latest evolution of this approach is called BizDevSecOps. The name is a mouthful, but the concept is straightforward: every function that has a stake in delivering business value through technology — business stakeholders, developers, security teams, operations engineers, and auditors — should be part of the same collaborative loop from day one.

From DevOps to BizDevSecOps: What Changed?

Early DevOps adoption focused on tearing down the wall between software development and IT operations. That alone delivered significant improvements in release velocity and system reliability. But as organizations matured, two gaps became apparent:

• Security was bolted on at the end — treated as a gate rather than an integral part of the pipeline.
• Business stakeholders were kept at arm’s length — often represented by an IT business analyst proxy rather than actual business decision-makers.

BizDevSecOps addresses both gaps directly. According to Rosalind Radcliffe, an IBM Distinguished Engineer, this is not a radical reinvention: “It is just a more realistic name for ‘DevOps.'” The core intent was always to align all business and technical functions. BizDevSecOps simply makes that intent explicit.

Why Security Can No Longer Be an Afterthought

One of the most important shifts in BizDevSecOps is the treatment of security as a first-class citizen in the delivery pipeline. The traditional model — build first, secure later — creates expensive rework, compliance debt, and in many cases, serious vulnerabilities that reach production.

Radcliffe is direct on this point: “No longer can companies think of security second or later or separate. Security must be designed in from the beginning.”

In practical terms, this means:

• Integrating automated security scanning into the CI/CD pipeline at every stage.
• Embedding secure coding practices into the design and development process — not just the testing phase.
• Involving auditors from the outset so that auditability is built into solutions rather than retrofitted.

Expanding DevOps Beyond Modern Applications

Another significant evolution is the extension of DevOps practices to all IT areas — not just greenfield applications. Mature DevOps organizations are applying the same principles of automation, continuous integration, and feedback loops to legacy systems and network infrastructure.

This is a meaningful shift. It means DevOps is no longer a privilege reserved for teams building microservices on Kubernetes. The methodology must scale to mainframe environments, on-premises infrastructure, and decades-old codebases if organizations are to see enterprise-wide benefit.

Getting Started with BizDevSecOps

Transitioning to a BizDevSecOps model is not purely a technical challenge — it requires organizational and cultural change. Radcliffe offers several concrete recommendations:

1. Bring real business representatives into the team. Substituting an IT business analyst as a proxy for genuine business leadership is a common mistake. Accurate business insight requires actual business decision-makers. “Proxies are not good enough with short turnaround times,” Radcliffe warns. Include real end users in feedback cycles wherever possible.
2. Automate security into the pipeline. The goal is to make security checks continuous and non-blocking where possible, rather than a manual gate at the end of a release cycle.
3. Introduce secure coding practices early. Training and tooling should support developers in writing secure code during design and implementation — not during a post-development security review.
4. Rethink funding models. Most organizations still fund discrete IT projects with defined start and end dates. BizDevSecOps requires a shift toward program-based or continuous backlog funding that supports ongoing delivery and improvement rather than one-time releases.
5. Move toward insourced development where appropriate. Radcliffe observes a trend of organizations bringing development capability back in-house to maintain greater control and agility over their technology roadmap.

Reframing IT: From Cost Center to Business Driver

One of the most consequential cultural shifts enabled by BizDevSecOps is how leadership perceives IT. For decades, technology operations were viewed primarily as a cost to be managed. BizDevSecOps reframes that relationship entirely.

Radcliffe offers a compelling illustration: “Yes, financial institutions manage money, but their primary business delivery is through IT.” Companies are increasingly judged not by their internal processes, but by the capabilities and experiences they deliver through their applications. That makes technology delivery a strategic business function — not a support function.

The Future: Transform or Be Disrupted

Digital transformation and the rise of the API economy are creating conditions in which the adoption of BizDevSecOps is becoming less of a competitive advantage and more of a survival requirement. Organizations that fail to adapt their delivery models risk being outpaced by competitors — including born-digital disruptors who built around agile, automated, security-first approaches from the start.

However, Radcliffe points out that established enterprises with significant IT assets have a genuine opportunity. By transforming their delivery capabilities, they can leverage their scale and existing infrastructure to compete with — and even disrupt — the disruptors themselves: “The new unicorns had an advantage in their quick start, but if those large companies with significant IT assets can transform, they can disrupt those new disruptors and lead into new business markets.”

Key Takeaways

• BizDevSecOps is the natural, explicit evolution of DevOps — integrating business, development, security, and operations into a unified, collaborative model.
• Security must be designed into pipelines and products from the start, not appended at the end.
• Legacy systems are not exempt — DevOps principles apply across all IT environments.
• Real business representation on delivery teams is essential; proxy relationships create delays and misalignment.
• Funding models must shift from project-based to continuous program funding to support ongoing delivery.
• Organizations that successfully transform will be positioned to compete with — and disrupt — digital-native competitors.