Today, IT and businesses often find themselves in silos working separately without a shared vision of the customer experience and all the services supporting it. IT must move beyond maintaining up a time to deliver the agility and competitive edge the business needs this means better cohesion between IT and business using predictive tools to prevent service failure meet Splunk IT service intelligence.

 IT service intelligence teams can no longer afford to be reactive especially when it comes to performance and availability. A protective IT strategy is necessary to get ahead of a problem and to protect revenue and your customer experience. Splunk IT service intelligence delivers a predictive IT, running an AIs we have AI scalable data platform that can ingest, search, analyze, and all types of data. ITSI allows you to go from reactive to predictive IT while gaining insights across both IT and business services. Splunk ITSI allows customers to predict service degradation 30 to 40 minutes in advance with the proactive alert for the KPIs most at risk so you can resolve incidents before they start gaining an end-to-end view of both IT and business KPIs on a single screen so you can work on what matters most when it comes to AI ops strategy. ITSI helps you become more proactive and even predictive reduce your incident investigation time business impact outages and event noise ensure your best customer experiences yes and keep the business and IT working better together with Splunk IT service intelligence. Put AI at the heart of your operations and try the free ITSI sandbox from today.

What are the benefits of Splunk IT Service Intelligence?

From the start as we are learning the series of Splunk software tools. In this stack, we discuss that every software has its own performances, capabilities, and security management but how the software works predictive and analytic. This is the reason behind endorsing the system software like how fast service is happening, and how the software is managing by the ITs team. With this effect, there are certain benefits related to Splunk ITSI admin as:-

• Intelligent incident management: Accelerate MTTR using real-time event correlation, automated incident prioritization and integrations with IT service management (ITSM) tools.
• Advance analytics & alerting: It manages a certain function as anomaly detection, adaptive thresholding, and predictive alerts & dashboards.
• Service analyzer: Service monitoring dashboards that display dependent systems and apps. Drill- down into a service’s underlying components to determine what’s impacting its health score.
• End to End visibility: protect business performance by monitoring service health, drill down into underlying infrastructure, all from one dashboard. 

Why we should learn Splunk IT Service Intelligence?

Nowadays, in this trending world. You have met with so many tools in the IT software services. Whenever we talk about Splunk’s advanced services then intelligence plays a prominent role in the IT entities. Now, we are talking about the learning conditions for IT service intelligence. So, what are the reasons to implement a Splunk ITSI? Before we had traditional solutions and those solutions were created as operational challenges like lack of visibility, complex environment, & slow response times. The most important talk is that lack of intelligence service created a significant impact on a business like lost revenue, inefficient productivity, poor customer experiences, & struggle to innovate then it creates technical advance in the field of IT sectors on the basis of Business and IT Service Monitoring, Intelligent Incident Management, Machine Learning, and Predictive Analytics. I wish that these awareness scenarios will give you brain mapping concepts for the Splunk intelligence certified admin.

How our Splunk IT Service Intelligence course/training would help?

This tutorial will help you about understanding the core features of Splunk ITSI like IT event management, service monitoring, and advanced analytics & alerting. It will give you a balancing ideology in the field of KPIs, Data sources, entities, services, incident response, automated remediation, predictive analytics, and event analytics. Through these interactive lectures and hands-on challenges, you will be able to learn to use IT service intelligence, services & glass tables, Notable event & event aggregation policies, and deep dives-investigation with swim lane views. After this, it gives you certification and that makes you qualified for the job opportunities along with the expected high-paid salary and makes your life efficient with future scope.

Related video:  

Infoworks DataFoundry Now Available as a Free Trial on Google Cloud Marketplace

Infoworks.io has announced a free trial program for Infoworks DataFoundry on the Google Cloud Marketplace. The trial introduces an updated version of DataFoundry featuring an interactive assistant designed to guide users through data onboarding to Google Cloud and the development of advanced analytics use cases.

DataFoundry had previously been made available on the Google Cloud Marketplace the prior fall. This free trial expands access and lowers the barrier to entry for Google Cloud customers looking to automate data operations at scale.

What Is Infoworks DataFoundry?

DataFoundry is Infoworks’ flagship platform for Enterprise Data Operations and Orchestration (EDO2). It is designed to automate and accelerate the deployment and orchestration of analytics projects, removing the need for manual coding or deep infrastructure management. Key characteristics include:

• No-code automation: Data engineers, scientists, analysts, and business users can build data pipelines without writing custom code.
• Scalable data onboarding: Automates ingestion and preparation of enterprise data at scale.
• Multi-environment support: Works across cloud, hybrid, multi-cloud, and on-premises environments.
• Rapid time-to-value: Enables organizations to deploy analytics projects to production within days rather than months.

What the Free Trial Includes

The DataFoundry free trial runs natively on Google Cloud and is optimized to leverage Google Cloud’s underlying infrastructure. The trial package includes:

• An interactive assistant providing step-by-step guidance for building data onboarding and analytics use cases.
• Integration with Google Cloud’s advanced analytics services, including BigQuery and TensorFlow.
• Support for third-party AI and machine learning solutions available on Google Cloud.
• Access to DataFoundry’s full pipeline orchestration and automation capabilities.

Why This Matters for Data Engineering Teams

One of the persistent challenges for enterprises migrating to or expanding on cloud platforms is the complexity of data operations — ingesting, transforming, governing, and operationalizing data at scale. This work typically consumes significant data engineering time and specialized talent.

Russ Barck, Vice President of Strategic Alliances at Infoworks, framed the value proposition directly:

“Infoworks DataFoundry frees data engineers, scientists, analysts and even business users to focus on leveraging Google Cloud in delivering use cases that drive digital transformation. Our unique automated, no-code offering means the major time and talent sink of dealing with underlying data operations and orchestration complexity is no longer an issue.”

— Russ Barck, VP Strategic Alliances, Infoworks

Manvinder Singh, Director of Partnerships at Google Cloud, also commented on the partnership:

“Businesses today need to derive more insights and greater value from their data. We’re delighted that Infoworks will make its enhanced DataFoundry capabilities available via Google Cloud Marketplace, helping customers more seamlessly bring their data to Google Cloud.”

— Manvinder Singh, Director of Partnerships, Google Cloud

Supported Industries and Customer Base

According to Infoworks, DataFoundry is already deployed by some of the world’s largest enterprises across a range of industries, including:

• Financial services
• Retail
• Technology
• Healthcare
• Oil and gas
• Manufacturing

How to Access the Free Trial

The DataFoundry free trial can be accessed directly through the Google Cloud Marketplace or via the Infoworks website at infoworks.io.

About Infoworks

Infoworks offers an Enterprise Data Operations and Orchestration (EDO2) platform that automates the full lifecycle of analytics project deployment — from data ingestion and preparation through to production operationalization. The platform supports cloud, hybrid, multi-cloud, and on-premises deployments. More information is available at infoworks.io.

The Core Problem: A Failure to Communicate

If DevSecOps isn’t gaining traction in your organization, the root cause is almost always the same: development, security, and operations teams are not talking to each other effectively. Historically, these three groups worked in silos, each frustrated that the others “don’t understand” their constraints or priorities. That frustration is a predictable outcome of isolation—teams that don’t communicate can’t build mutual understanding.

DevSecOps has been evolving for several years, but it is still working its way into mainstream adoption. For organizations that rely on agile CI/CD pipelines to stay competitive, integrating security into the development and operations workflow is no longer optional. It’s a prerequisite for shipping quality software at speed.

The Cultural Shift DevSecOps Demands

True DevSecOps is not simply a matter of adding security scanning tools to a pipeline. It requires a fundamental cultural shift: development, security, and operations stop functioning as adversarial groups and instead operate as different roles on a unified team sharing one goal—produce secure, high-quality software as efficiently as possible.

Enabling that shift starts with communication. And the most practical way to improve communication across these disciplines is cross-training—giving each team enough context to understand what the other teams do, why it matters, and how their work intersects.

Two Tiers of Security Training for DevOps Teams

To bring security more effectively into DevOps, focus on two complementary levels of training:

1. Baseline secure coding training for all developers
2. A security champions program that develops deeper expertise in select developers

Tier 1: Secure Coding Training for All Developers

The goal of baseline training is not to turn developers into security engineers. It is to ensure that every developer understands that security is a dimension of code quality—and that producing quality code means understanding how applications can be attacked.

Practical starting points for secure coding training include the OWASP Top 10 and the CWE Top 25. These publicly available, community-maintained resources cover the most common and impactful vulnerability classes, including:

• Injection (SQL, command, LDAP, etc.)
• Authentication, authorization, and access control
• Sensitive data exposure
• XML External Entities (XXE)
• Security misconfiguration
• Cross-Site Scripting (XSS)
• Insecure deserialization
• Insufficient logging and monitoring
• Use of components with known vulnerabilities

Training developers to recognize and avoid these vulnerability classes at the point of code authorship is significantly more efficient than discovering and remediating them late in the release cycle.

Tier 2: The Security Champions Program

The security champions model addresses a structural imbalance in many DevOps organizations. Security teams are frequently outnumbered by a wide margin relative to developers—some industry estimates suggest ratios as high as one security professional for every hundred developers, with operations falling somewhere in between. A security team of that size cannot scale to review every commit, threat-model every service, or respond to every developer question in real time.

A security champions program solves this by cultivating security advocates within development teams. The concept rests on a simple communication principle: a peer is more persuasive and more accessible than an outsider. A developer who has received additional security training can answer colleagues’ questions, catch issues during code review, and serve as a bridge to the central security team—in the same language developers use every day.

Critically, a security champions program should be opt-in, not mandatory. The most effective champions are developers who are already curious about security and motivated to deepen their skills. Participating in a champions program should be framed—and genuinely experienced—as a career development opportunity: expanded expertise, greater visibility, and stronger marketability.

Developer Enablement: Shifting Security Left

Training alone is not sufficient if security checks are still deferred to the end of the software development life cycle (SDLC). Late-stage security testing is expensive: defects found after code is integrated, tested, and staged for release require significantly more effort to fix than defects caught during development. The cost—in engineer time, rework, and delayed releases—compounds quickly at scale.

The principle of shifting security left means integrating security activities as early as possible in the SDLC:

• Design phase: Threat modeling to identify attack surfaces before a line of code is written.
• Development phase: Static analysis (SAST) and IDE plugins that flag insecure patterns in real time.
• Build and CI phase: Automated dependency scanning (SCA) and secrets detection integrated into the pipeline.
• Test phase: Dynamic analysis (DAST) and API security testing as part of automated test suites.
• Pre-production: Infrastructure-as-code scanning to catch misconfigured cloud resources before deployment.

When developers are empowered with the training and tooling to find and fix security issues in their own code, the volume of issues escalated to the security team drops significantly. This reduces friction between development and security—one of the most common and damaging sources of organizational conflict in software delivery organizations.

The Guiding Principle: Make the Secure Path the Easy Path

The long-term goal of all of these initiatives—cross-training, secure coding education, security champions, and shift-left tooling—is to make secure behavior the default, lowest-effort path for developers. When secure coding patterns are taught early, championed by peers, and reinforced by automated tooling in the developer’s existing workflow, security stops being a bottleneck and becomes a built-in property of the software.

That is the practical definition of DevSecOps done well: not a separate security gate at the end of a pipeline, but a shared discipline embedded across the entire engineering organization. The outcome is faster delivery of software that is secure by design—not just secure by inspection after the fact.

Getting Started

If your organization is beginning this transition, a practical sequence looks like this:

1. Assess current gaps — Survey your development and security teams to understand where communication breaks down and where security knowledge is weakest.
2. Launch baseline secure coding training — Use OWASP Top 10 and CWE Top 25 as your curriculum foundation. Prioritize languages and frameworks your teams actually use.
3. Identify and recruit security champion candidates — Look for developers who already engage with security topics, ask security-related questions, or have relevant backgrounds.
4. Define the champions program structure — Clarify time commitments, training resources, recognition, and the champions’ ongoing relationship with the central security team.
5. Integrate security tooling into CI/CD — Start with high-signal, low-noise tools that fit existing workflows. Avoid overwhelming developers with false positives early in the program.
6. Measure and iterate — Track metrics such as mean time to remediate vulnerabilities, the ratio of issues caught in development versus production, and developer satisfaction with security tooling.

Building a DevSecOps culture is a gradual process, not a one-time project. Progress is measured in consistent incremental improvements to communication, capability, and tooling—not in a single organizational restructure.

Why Content Teams Are Turning to Agile and DevOps Principles

At the core of Agile methodology is a focus on team coordination over rigid process. That same principle applies directly to content production. Bob Gower, an Agile marketing coach and co-author of Radical Alignment, frames it clearly: “As with DevOps and Agile, successful content management in my experience is less about technology and more about workflows and teamwork. The power of a flexible workflow is the ability to reflect and get better continuously. Teams and management need to embrace this, but it can feel a tad chaotic at times.”

The parallel to software delivery is intentional. In DevOps, teams break work into short cycles, automate repetitive steps, and continuously improve based on feedback. Content teams adopting similar practices replace waterfall-style handoffs — one person writes, sends to an editor, who sends to an approver — with parallel, iterative workflows where multiple contributors can work on the same asset simultaneously.

According to Nucleus Research analyst Evelyn McMullen, collaboration tools alone are not enough. AI, machine learning, and metadata will be key for streamlining processes and improving media workflow management. Before investing in any tooling, she recommends that organizations first map their workflows, define the outcomes they need to manage, and build a strategy. “One challenge we see enterprises running into is immediate need for content management without any planning or strategy in place,” she said.

The Baseline: Moving Beyond Email Attachments and Word Documents

The simplest starting point for collaborative content work is a non-destructive, multi-user editor. Tools like Google Docs eliminate the need for version control via email, ensure no edits are lost, and allow multiple contributors to work in parallel. Gower is blunt about the alternative: “I’m shocked at how many editors still send around Microsoft Word docs. It’s so inefficient.”

From there, project-specific tools can automate handoffs and task assignments. The gap between content management maturity and software development maturity remains significant, however. As Dan Stoll, director of technical product marketing at workflow automation provider Nintex, puts it: “Content management normally is a set-and-forget process in that people add content, content goes for review and content gets published.” DevOps, by contrast, is characterized by short activity bursts, shared libraries, and reusable components. Stoll believes content tooling will eventually reach similar automation depth, but organizations will need purpose-built tools in the interim.

Real-World Example: Automating Content Cross-Pollination at Nintex

Nintex has built an internal content platform that demonstrates what automated content pipelines can look like. Sales teams can locate marketing materials and price books based on criteria already configured in the CRM system. A cloud automation service reviews and moves approved content from a central gallery into the sales team’s platform automatically. “This process is completely automated,” Stoll explained, “and allows us to go about publishing and reviewing as normal in the gallery, knowing that our content is being cross-pollinated into other systems to increase visibility.”

AI and Metadata: The Next Layer of Media Workflow Intelligence

AI is beginning to take on meaningful roles in content production workflows. Current applications include:

• Automated metadata generation for video and audio assets, enabling fast search, retrieval, and repurposing
• Content scanning for relevancy, flagging outdated material for revision
• PII redaction — automatically identifying and removing sensitive data such as phone numbers or credit card details before publication
• Language identification, entity extraction, sentiment analysis, and scene detection via low-code AI integrations

Greg Loose, head of media and entertainment at AI technology provider Veritone, sees AI-generated metadata as a practical, near-term win: it allows companies to locate media assets within seconds and quickly share, repurpose, license, and monetize content. “AI is interwoven within other enabling technologies, such as on-demand media asset management platforms, making them and the assets themselves intelligent,” he said.

Case Study: Recovering from a Content Database Disaster at WikiLawn

WikiLawn, an online lawn and garden resource, lost its entire content database due to data corruption. The incident forced a complete overhaul of the organization’s content tools and processes, according to president Dan Bailey. The existing on-premises enterprise content management (ECM) system made searches difficult and slowed imports from the website and social media channels.

The team migrated to Microsoft SharePoint as a combined content hub and management service. The transition — including assessing storage needs, evaluating existing content, and completing the move — took approximately two weeks. The database can now operate in the cloud or on-premises, with fast storage, categorization, and search capabilities.

Bailey remains candid about the limitations: “Content management services are focused more on access right now than seamless iteration, which is one of the main things we need.” His ideal would be an all-in-one platform supporting multiple content types with automatic saving to both online and local branches — effectively a content equivalent of a Git-backed workflow.

Case Study: Iterating on Content Like Code at SEO.co

Nate Nead, CEO of digital marketing firm SEO.co, draws a direct analogy between software development and content production: “Getting to the best version of a piece of content is like iterating to the best version of a piece of code.” The company runs weekly content scrum meetings to assign tasks and track progress, having migrated from spreadsheets and Google Docs to Asana for task management and Slack for communications.

“Being nimble is about having the right process coupled with the right tools,” Nead said. The structured sprint cadence ensures content moves through planning, drafting, review, and publication without accumulating in someone’s inbox.

COVID-19 as an Accelerant for Collaborative Content Tooling

Remote work mandates in 2020 forced organizations that had been evaluating collaborative content tools to deploy them immediately. Michael Segner, director of content and communications at AvePoint — a provider of migration, backup, and governance software for Microsoft 365 — reported a sharp spike in adoption of Microsoft Teams and related tools as organizations sent digital workers home.

Segner’s own team moved away from a waterfall-style linear process — write, email, edit, email, approve — to a channel-based model in Teams. Documents are uploaded to a specific channel where any authorized team member can rewrite and edit in parallel. Once approved, the document is published to a central “Go To Market” SharePoint site for internal or public access. “This way, we have a single authoritative document that our whole company can access and leverage and that is easy to iterate,” Segner noted.

What to Call This: The Naming Problem in Content Workflow Evolution

Software delivery has two widely recognized terms — DevOps and Agile — to describe faster, more collaborative, iterative lifecycles. Content teams lack an equivalent shorthand. Several terms have been proposed by analysts and practitioners:

• New work nucleus (Gartner): A framework in which content collaboration platforms replace enterprise file sync and share (EFSS), workstream collaboration replaces unified communications, and collaborative work management replaces traditional project management tools
• Intelligent information management (Nucleus Research): Extends beyond traditional content services to encompass AI-driven classification and retrieval
• Content automation (Nintex): The use of AI to move content through production and distribution phases
• Intelligent content (Veritone): All content supported by AI through metadata and workflows to drive engagement and revenue
• Content as a service (FileCloud): Enabled by metadata integration, smart classification, powerful search, flexible APIs, and cloud-agnostic open systems
• Cloud content management (Box): Encompasses file organization, sharing, storage, access control, permission management, and collaborative workflow

No single term has achieved consensus, but the underlying direction is consistent: content workflows are moving toward the same principles that define modern software delivery — automation, iteration, shared ownership, and continuous improvement.

Case Study: Agile Content Refresh at Simple Life Insure

Insurance broker Simple Life Insure in San Diego needed to keep policy and underwriting documents current while also refreshing website content to maintain search performance. CEO Ty Stewart opted for SaaS tools rather than custom software. The team’s content workflow uses:

• BuzzSumo — for identifying trending topics and emerging long-tail keywords, and for surfacing existing content that needs to be restructured
• Trello — for managing workflow stages: finding topics, drafting SEO-optimized outlines, writing, reviewing, publishing, and monitoring performance
• Cloud-based project management — to move tasks between team members and track completion

“In our industry, making those timely updates is pivotal since information needs to be accurate, given changing regulations in the finance and insurance world, which happens annually,” Stewart said. He acknowledges the workflow doesn’t perfectly mirror DevOps or Agile practices for code, but adds: “They absolutely work for our content refresh strategies and only require a cloud-based project management tool to keep everything on track.”

Key Takeaways for DevOps and Engineering Teams Supporting Content Workflows

• Start with process, not tooling. Map your workflows and define your outcomes before evaluating platforms. Technology amplifies good process and amplifies bad process equally.
• Eliminate linear handoffs. Waterfall-style sequential editing creates versioning problems and delays. Channel-based or document-based parallel editing removes these bottlenecks.
• Invest in metadata. AI-generated metadata is the foundation for fast asset retrieval, content reuse, and monetization — particularly for video and audio.
• Treat content iteration like code iteration. Weekly scrums, task tracking in project management tools, and defined review stages bring software delivery discipline to content teams.
• Automate cross-system content distribution. Publishing to one system and manually copying to others is the content equivalent of deploying by hand. Automation pipelines that push approved content across systems reduce errors and save time.
• Plan for cloud-native or hybrid storage. On-premises ECM systems create search bottlenecks and import delays. Cloud or hybrid architectures support faster collaboration and disaster recovery.

The convergence of DevOps thinking and content management is still early. The tooling is maturing, the terminology is unsettled, and the automation depth lags well behind what software teams take for granted. But the direction is clear: content workflows that embrace iteration, automation, and shared ownership will outperform those that don’t.

This article is based on reporting originally published at searchcontentmanagement.techtarget.com.

Five Years in the Making: Ansible for DevOps, 2nd Edition

After five years of continuous development, 834 commits, and 24 major revisions, Jeff Geerling published the 2nd edition of Ansible for DevOps. The book has sold over 60,000 copies and served as the foundation for a free Ansible 101 video series on YouTube. The 2nd edition marks the start of the 2.x revision series.

The book covers a broad range of infrastructure automation topics:

• Managing Linux servers with Ansible basics
• Continuous integration pipelines
• Application deployments
• Container image management
• Kubernetes cluster management with Ansible

The Problem with Traditional Edition-Based Publishing

Geerling’s original commitment was simple: ebook updates would be free, forever. He has published at least one new revision per quarter since the first release (version 0.42 on LeanPub in 2014). However, selling through Amazon introduced friction: Amazon follows the traditional publishing convention of “editions,” where any substantive update beyond minor corrections requires a new edition — complete with a new ISBN and a new product listing.

This model made sense in the era of print, but it creates a poor experience for readers of digital technical books. Anyone who has owned outdated print books on Python 2, PHP 5, or legacy Linux distributions understands the problem. Technology moves faster than print publishing cycles, and readers who buy digital copies deserve to benefit from an author’s ongoing improvements.

What an Evergreen Technical Book Looks Like in Practice

Keeping a technical book genuinely current requires more than occasional edits. Geerling’s approach to maintaining Ansible for DevOps as an evergreen resource included:

• Quarterly revisions to reflect new Ansible releases, deprecation cycles, and evolving best practices.
• Chapter rewrites when underlying architecture shifted significantly enough to make older guidance misleading.
• A companion GitHub repository containing all code examples from the book, with CI tests that run on a weekly schedule to catch bit rot — examples that silently break as dependencies, APIs, or Ansible modules change.
• An open issue tracker where readers can report broken or confusing examples, and submit patches directly.

The CI testing approach is particularly notable for a book project. Rather than relying solely on manual review, automated weekly test runs surface problems proactively, before readers encounter them.

The Financial Case for Self-Publishing Technical Books

Geerling is candid about the economics. Over five years, Ansible for DevOps earned him nearly $200,000 in royalties — after platform fees of 30–70% from Amazon, Apple Books, and LeanPub (LeanPub being the most author-generous of the three).

For context, a comparable deal with a traditional publisher might have yielded:

• A few thousand dollars as an advance
• Roughly a 5% royalty rate on net sales
• No royalties until the advance was earned out
• An estimated total return of under $50,000 for the same sales volume

Self-publishing platforms like LeanPub typically return 70–80% of the sale price to the author. Amazon’s cut varies by price tier and format. The gap in author earnings between self-publishing and traditional publishing is substantial, and for a successful title it can represent a difference of four times or more in total income.

“Self-publish, don’t write for a publisher.” — Jeff Geerling

Honest Advice: Don’t Quit Your Day Job

Despite Ansible for DevOps being a genuinely successful technical book — one of the more successful self-published DevOps titles available — Geerling is direct: $200,000 over five years averages $40,000 per year. That is meaningful supplemental income, but it does not replace the salary a skilled DevOps engineer or software architect can command.

His conclusion for anyone considering writing a technical book:

• If you have deep, practical expertise in a cloud or infrastructure topic, your salary as a practitioner will likely exceed your maximum book revenue by a factor of five or more.
• Write the book as a practitioner, not as a full-time author. The best technical books come from people solving real problems in production environments, not from authors who write to fill a publisher’s catalog.
• “Fluff” tech books — written by light users of a tool or by serial authors without hands-on depth — are immediately apparent to experienced readers and rarely offer the small, high-value tips that justify the purchase price.

LeanPub and the Lean Publishing Model

One of the practical enablers of Geerling’s approach is LeanPub, a publishing platform designed for iterative, in-progress book writing. Key properties that make it well-suited for technical authors:

• You can publish and sell a partial, in-progress manuscript immediately.
• Readers who buy early can engage with the content and provide feedback while the book is still being written.
• Updates to buyers are automatic and free — no new purchase required.
• Author royalty rates are significantly higher than traditional publishers or even most major retail platforms.

This model validates demand early, reduces the risk of spending months writing a book nobody wants, and aligns author incentives with reader experience over the long term.

What This Means for DevOps Engineers Considering Writing

If you are a DevOps or platform engineering practitioner with genuine depth on a specific tool or workflow, self-publishing a technical book is a viable way to build credibility, contribute to the community, and earn supplemental income. The key takeaways from Geerling’s experience:

• Start lean. Publish early on a platform like LeanPub and iterate publicly.
• Automate quality assurance. Treat code examples like production code — use CI to test them on a regular schedule.
• Commit to maintenance. A technical book that goes stale within a year damages your reputation more than not writing one at all.
• Self-publish first. Traditional publishing deals rarely make financial sense for technical authors with the motivation to self-publish.
• Keep your day job. Even a successful technical book is unlikely to match your engineering salary.

About the Books

Ansible for DevOps, 2nd Edition is available on Amazon, LeanPub, and Apple Books. Jeff Geerling is also writing Ansible for Kubernetes, a deeper dive into Kubernetes and container automation with Ansible, available in progress on LeanPub with the same free-updates-forever commitment.

For more from Jeff Geerling, see jeffgeerling.com.

The Problem: Kubernetes Was Built for Production, Not for ML Experimentation

If your organization is running machine learning workloads, you have almost certainly run into a familiar tension: data science teams need enormous compute resources, and your Kubernetes cluster is right there. The temptation to hand them cluster access is real. The consequences, however, are predictable.

Kubernetes was engineered for running stable, production-grade, replicated services. ML and deep learning (DL) workloads are almost the exact opposite: they are experimental, ephemeral, highly variable in resource demand, and they change constantly. Pretending otherwise creates operational pain for everyone involved.

What Data Scientists Actually Need

Data scientists are researchers first. Their job is to develop models, tune hyperparameters, and run experiments — often hundreds or thousands of them concurrently. To do that effectively, they need:

• Remote compute with GPU access. Local laptops typically lack the memory, storage, and GPU capacity required for modern deep learning workloads.
• Fast environment iteration. Experiment code changes frequently. Keeping Dockerfiles, requirements.txt files, and Conda YAML manifests up to date manually is a distraction from the actual science.
• Domain-specific monitoring. They care about model accuracy, training loss curves, and experiment throughput — not CPU utilization graphs.
• Queue-based job scheduling. Running many concurrent experiments that are short-lived relative to server uptime is an HPC-style challenge, not a standard Kubernetes workload pattern.

Why Giving Data Scientists Raw Kubernetes Access Is a Bad Idea

On a well-managed Kubernetes cluster, a set of operational rules exist for good reason. Granting unrestricted access to ML teams tends to violate most of them:

• Placing all pods in a single namespace.
• Manually managing large numbers of heterogeneous pod types and repository workloads.
• Attempting to control Kubernetes scheduler ordering — which is not reliably possible.
• Leaving thousands of stale, single-use container images on the cluster.
• Triggering uncontrolled node autoscaling in response to a flood of pending experimental jobs.

Unlike traditional software deployment — where a tested, stable artifact is replicated across nodes — ML experimentation means continuously deploying unstable, in-progress code at scale. A cluster of tens of thousands of one-off container images is not a hypothetical; it is a common outcome.

Breaking Down the Real Requirements

The needs of DevOps teams and data science teams differ significantly across every dimension of infrastructure management. Understanding the gap is the first step toward bridging it.

Resource Access

For a DevOps engineer, resource access means namespaces, RBAC policies, network policies, and reliability. For a data scientist, it means: Is this a CPU machine or a GPU machine, and how many GPUs does it have? A simple tiered model — CPU, 1×GPU, 2×GPU, 8×GPU — typically covers the majority of AI team requirements. The nuance that matters to operations is largely irrelevant to the researchers.

Environment Packaging

From a DevOps perspective, environment packaging means containerizing a stable codebase. For ML teams, the development environment changes constantly. Manually maintaining Dockerfiles and dependency manifests is time-consuming and error-prone — stale configurations accumulate quickly because they are decoupled from the actual coding environment. What is needed is automatic extraction of the environment state, with seamless replication from local development machines to remote execution pods.

Monitoring

DevOps monitoring focuses on infrastructure health: CPU usage, memory pressure, disk I/O, pod restarts. Data science monitoring focuses on experiment health: training loss, validation accuracy, throughput, and custom business-relevant metrics. No universal standard exists for ML experiment monitoring, and the ability to define and track custom metrics is often what separates a productive ML team from one flying blind.

Job Scheduling

Kubernetes job scheduling is oriented around resource allocation for long-running or indefinite workloads. ML job scheduling is closer to an HPC queuing problem: there are always more experiments queued than available resources, jobs are relatively short-lived, and the scheduling policy — which job runs first, on which resources, with what priority — directly affects research velocity. Kubernetes was not designed to optimize for this pattern.

MLOps: A Purpose-Built Layer for AI Workloads

MLOps tooling has emerged specifically to address this gap. Rather than replacing Kubernetes, a well-designed MLOps platform sits on top of it — presenting a resource interface tailored to data science teams while letting Kubernetes continue to do what it does well: managing the underlying hardware cluster.

From a Kubernetes perspective, the MLOps platform is just another application: a replicated service with a known resource footprint, deployed and managed like anything else on the cluster. From the data science team’s perspective, it exposes their allocated compute nodes as a logical cluster they control directly.

What an MLOps Platform Provides

• Dedicated job queues with priority ordering, experiment tracking, and isolation from Kubernetes scheduler internals.
• Automatic environment packaging that extracts and replicates the current development environment into a container without requiring the data scientist to manually maintain Dockerfiles.
• Experiment-centric monitoring with customizable metrics dashboards suited to model development workflows.
• Lifecycle management for experiments, including the ability to terminate runaway jobs without DevOps intervention.
• Self-service provisioning so that the AI team can launch, monitor, and clean up their own workloads within the resource budget already allocated by the DevOps team.

The Resulting Division of Responsibility

With an MLOps layer in place, the operational model becomes significantly cleaner:

• DevOps team: Manages Kubernetes, allocates hardware resources to the MLOps platform, and updates resource allocations when needed. They are not in the critical path for every experiment run.
• Data science team: Self-services through the MLOps platform. They launch experiments, track results, manage their queues, and iterate on models without needing to understand Kubernetes internals or file infrastructure tickets.

The MLOps solution acts as the glue: it picks jobs from the ML team’s queues, provisions the appropriate environment (inside a container or as a sidecar), submits the workload to Kubernetes with proper resource requests, monitors execution, and handles cleanup — all without manual DevOps involvement.

Key Takeaways

• Kubernetes is the right tool for managing production infrastructure and hardware clusters. It is not the right tool for managing ML experiment workflows directly.
• Data science teams have fundamentally different requirements for resource access, environment management, monitoring, and scheduling than traditional software engineering teams.
• MLOps platforms address these requirements by providing a purpose-built interface that runs on top of Kubernetes without disrupting its operational model.
• A clean MLOps integration reduces the operational burden on DevOps teams, eliminates cluster sprawl, and gives data scientists the autonomy they need to iterate quickly.

The payoff is straightforward: fewer 2 a.m. provisioning calls, fewer stale container images clogging your registry, and a data science team that can actually focus on building models rather than filing infrastructure tickets.

The following analysis draws on themes from the State of Cloud Native Security Report 2020 published by Palo Alto Networks—described at the time of writing as one of the largest globally distributed market research datasets on cloud-native security. The data points below are sourced from that report.

Cloud-Native Architectures and What They Mean for DevOps Security

Cloud Workloads Are Growing—Rapidly

Survey respondents estimated that, on average, 46% of all workloads were already running in the cloud at the time of the survey. Ninety-five percent of respondents expected that share to grow over the following 24 months. For DevOps teams, this trajectory means more deployments, more managed services, and more surface area that security controls must cover.

Cloud Infrastructure Is Constantly Changing

Eighty percent of survey respondents said their company’s cloud infrastructure is continuously evolving—driven by experimentation with new services, evaluation of emerging cloud offerings, and iterative refinement of best practices. This constant change creates a significant challenge for security teams: tooling and policies calibrated for today’s architecture may be outdated by next quarter.

That concern is widely felt: 75% of respondents worried that cloud threats already outpace the organization’s security capabilities. Continuous change is not inherently bad for DevOps, but it demands that security practices keep the same cadence as infrastructure updates—not lag behind them.

Multi-Cloud Is the Norm, Not the Exception

Nearly every organization surveyed—90%—confirmed they use more than one cloud provider. Workloads are spread across a mix of compute architectures:

• Virtual Machines (VMs): ~30% of workloads on average
• Containers: ~24%
• Platform-as-a-Service (PaaS): ~22%
• Container-as-a-Service (CaaS): ~21%

This diversity of platforms and compute models means security teams need both broader and deeper visibility across the entire infrastructure estate. The survey found that 57% of security teams were already using more than five distinct security tools, with some organizations running eleven or more. More tools often means more dashboards, more policy engines, and more manual effort to correlate findings—a problem of its own.

The Threat Landscape: No Single Dominant Risk

When asked to name their single greatest cloud security threat, respondents spread their answers across ten different categories—none commanding a clear majority. This distribution itself is important: there is no obvious chokepoint to secure, which makes prioritization harder and collaboration between development and security teams more essential.

The near-equal distribution across these categories explains why DevOps and security teams sometimes disagree on priorities. Without a single dominant threat to rally around, teams must negotiate which risks deserve the most immediate attention—a conversation that works best when security is embedded in development workflows from the start rather than bolted on at the end.

Embedding Security Across the Full Application Life Cycle

The report ranked organizations by their level of security preparedness and compared the habits of the highest-ranked cohort against lower-ranked peers. The results support a clear pattern: organizations with the strongest security posture treat security as a continuous, integrated practice rather than a gate at the end of the pipeline.

• 45% of highly prepared organizations embed security directly into their DevOps processes.
• 41% integrate security controls at four or more stages of the development life cycle.
• Leading organizations automate key security practices—including configuration monitoring and vulnerability scanning—and implement guardrails or quality gates that block insecure code from advancing through the pipeline.

The practical implication for DevOps teams is straightforward: shift security left. Identify vulnerabilities during the design and development stages, not after code is deployed. This means selecting CI/CD tooling and cloud security platforms that can run policy checks, scan container images, and validate infrastructure-as-code templates automatically at each stage.

DevOps teams should also work with security leadership to evaluate consolidated platforms capable of spanning multiple cloud providers and compute types. Replacing a fragmented collection of point tools with a platform that provides unified visibility and integrated policy enforcement reduces complexity and makes continuous security monitoring operationally sustainable.

Practical Next Steps for DevOps Teams

The data from the 2020 report points to a clear direction of travel for teams navigating cloud-native security:

1. Accept that multi-cloud and hybrid compute is permanent. Design security controls that work across VM, container, PaaS, and CaaS workloads from the outset rather than retrofitting later.
2. Shift security left. Integrate static analysis, secrets scanning, dependency checks, and policy validation as early as the developer’s local environment and certainly within every CI pipeline run.
3. Automate configuration monitoring. Infrastructure misconfigurations and over-permissioned access together account for a significant share of prioritized threats. Automated drift detection and least-privilege enforcement reduce this risk without adding manual toil.
4. Reduce tool sprawl. If your organization is running more than five security tools across the cloud estate, evaluate whether a consolidated platform can reduce the operational overhead of correlating findings across dashboards.
5. Increase collaboration between development and security teams. The breadth of the threat landscape means no single team can own cloud security alone. Shared threat models, joint incident reviews, and co-authored security requirements help both sides align on priorities.

Summary

Cloud-native adoption is accelerating, and that acceleration is not slowing down. The organizations that navigate this transition most effectively are the ones treating security as a continuous, automated, life-cycle-wide responsibility rather than a compliance checkpoint. For DevOps teams, that means advocating for integrated security tooling, embedding controls early in the pipeline, and building the kind of collaborative relationship with security teams that enables fast delivery without unacceptable risk.

Overview: A Beat-and-Decline Earnings Event

Datadog (NASDAQ: DDOG) reported its Q2 2020 earnings on August 6th, delivering a revenue beat and raising its full-year guidance. Despite those positives, the stock dropped approximately 16% in after-hours trading — a counter-intuitive reaction that left many investors searching for an explanation.

The most likely culprits were conservative forward guidance and management commentary about large customers pulling back on cloud infrastructure spending — a macro headwind that directly affects Datadog’s consumption-based revenue model.

Q2 2020 Customer and Revenue Metrics

The underlying business metrics for Q2 2020 remained strong, even if growth rates moderated slightly from the prior quarter:

• Total customers: Approximately 12,100, representing 37% year-over-year growth (down from 40% YoY in Q1).
• Large customers (ARR ≥ $100,000): 1,015, up 71% YoY (down from 89% YoY in Q1).
• Large customer additions by quarter: 131 in Q4 2019, 102 in Q1 2020, and 45 in Q2 2020 — a declining sequential add rate.
• Q2 revenue: $140 million, following $131 million in Q1 2020.
• Gross margin: Approximately 80%, an increase of roughly 5 percentage points year-over-year.

The slowdown in large customer additions is notable because customers with ARR of $100,000 or more account for approximately 75% of Datadog’s total revenue. Management acknowledged that some of these enterprise customers were actively reducing cloud infrastructure consumption as a cost-cutting measure during the economic uncertainty of mid-2020, which rippled directly into Datadog’s usage-based billing.

Why Large Customer Spending Matters So Much

Datadog’s pricing model is closely tied to the volume of infrastructure being monitored. When a large enterprise reduces its cloud footprint — whether by shutting down non-essential workloads or consolidating environments — Datadog’s billable usage shrinks proportionally. This is a structural characteristic of usage-based SaaS businesses that can cause revenue growth to decelerate even when the customer count is growing.

The silver lining, as noted in the original analysis, is that a significant portion of large enterprises’ IT infrastructure still runs on-premises. As economic conditions improve and cloud migration accelerates, these customers represent an organic expansion opportunity without Datadog needing to win new logos.

Full-Year 2020 Guidance

Management raised its full-year 2020 revenue outlook to between $566 million and $572 million. Working backward from the Q1 and Q2 actuals:

• Q1 actual: $131 million
• Q2 actual: $140 million
• H2 implied guidance: approximately $295–$301 million combined
• Q3 guidance implied: approximately $144 million (~50% YoY growth)
• Q4 guidance implied: approximately $151–$157 million (~35% YoY growth)

The implied Q4 deceleration to roughly 35% YoY was seen as particularly conservative, given that Q4 had historically been Datadog’s strongest quarter. Analysts and investors familiar with Datadog’s track record of under-promising and over-delivering took this as a signal that actual results could come in meaningfully higher.

Product Expansion and Cross-Selling Momentum

One of the more compelling data points from Q2 was the continued adoption of multiple Datadog products within the same customer account:

• Two or more products: 68% of customers (up from 63% in Q1 and 40% one year prior).
• Four or more products: 15% of customers.

This multi-product adoption rate is a strong indicator of platform stickiness. Customers deeply integrated across observability, APM, log management, security, and related modules are far less likely to churn and are natural candidates for upsell as they expand their infrastructure. Cross-selling across the platform was identified as a key potential catalyst for beating the conservative full-year guidance.

Datadog also received industry recognition during the quarter, including the 2020 Gartner Peer Insights Customers’ Choice designation for IT Infrastructure Monitoring Tools and the “Best Mission-Based Data Solution” award as part of the 2020 AWS Public Sector Partners Awards.

Convertible Note Offering and the Undefined Labs Acquisition

On June 2, 2020, Datadog completed a private offering of $747.5 million in aggregate principal of 0.125% Convertible Senior Notes due in 2026. The initial conversion price was approximately $92.30 per share, representing a roughly 37.5% premium over the stock price at the time of issuance.

A portion of those proceeds funded the acquisition of Undefined Labs, a startup focused on observability tooling for developer and test workflows. Undefined Labs was founded in 2018 and had offices in San Francisco and Madrid. The acquisition price was not publicly disclosed. The deal signals Datadog’s intent to extend its platform further left into the software development lifecycle — moving from purely operational observability toward developer-facing tooling.

Valuation Context After the Sell-Off

Following the 16% after-hours drop, Datadog’s price-to-sales (P/S) ratio fell to approximately 39x at the time of writing. While still elevated in absolute terms, this was more defensible when compared to the company’s revenue growth rate relative to peers. The original analysis cited the following approximate P/S ratios for competitors as of that period:

• Elastic (ESTC): ~16x P/S
• Splunk (SPLK): ~13x P/S
• New Relic (NEWR): ~5x P/S

Datadog’s premium valuation has historically been justified by its significantly higher revenue growth rate compared to these competitors. New Relic, in particular, was noted as being in the midst of a major platform restructuring effort to modernize its product and close the competitive gap with Datadog.

Investment Takeaway from August 2020

The core argument in the original analysis was that the post-earnings sell-off was an overreaction driven by conservative guidance and macro noise rather than deteriorating fundamentals. Key points of the bull case at the time:

• Management has a documented history of setting conservative guidance and then beating it.
• The multi-product cross-selling story remained intact and was accelerating.
• Large customer cloud spending headwinds are cyclical and likely to reverse as economic conditions normalize.
• Gross margins of ~80% demonstrate strong unit economics.
• The Undefined Labs acquisition reinforced the company’s commitment to broadening the platform.

The suggested approach for long-term investors was dollar-cost averaging, with the mid-$70s price level identified as a reasonable entry point to accumulate additional shares.

Note: All financial figures, stock prices, and valuation multiples in this article reflect conditions as of August 2020. This article is for informational purposes only and does not constitute investment advice. Original analysis sourced from Seeking Alpha.

Verizon Partners with Google Cloud to Modernize Customer Contact Centers

Verizon announced a pilot program to deploy Google Contact Center Artificial Intelligence (CCAI) with the goal of delivering more intuitive, efficient customer experiences across voice and chat channels. The partnership reflects a broader push by Google Cloud to position its AI tooling as infrastructure for telecom and enterprise contact centers.

How Google Contact Center AI Works

At the core of the offering is natural language understanding (NLU), which allows customers to state or type their requests in plain language rather than navigate layered IVR menus. When a customer contacts Verizon by phone or direct chat, the AI interprets the intent and routes or resolves accordingly — reducing friction at the first point of contact.

According to a Google Cloud statement cited in the original report, the technology is intended to “help empower shorter call times, quicker resolutions, and improved outcomes for customer satisfaction.”

When a call escalates to a human agent, Google CCAI continues to contribute by:

• Providing real-time agent assist — surfacing relevant knowledge base articles and suggested responses during the live interaction
• Locating relevant customer history and context automatically
• Reducing the cognitive load on agents so they can focus on complex or sensitive issues

The Role of Dialogflow

Much of the experience is powered by Dialogflow, Google Cloud’s platform for building conversational agents across voice, chat, and messaging channels. Unlike older bot frameworks that modeled human conversations as strictly linear flows, Dialogflow is designed to handle multi-turn, dynamic conversations — more closely approximating how human agents actually interact with customers.

Dialogflow supports integration across a wide range of channels and can manage multiple concurrent requests, which is critical for high-volume contact center environments.

Industry Analyst Perspective

Irwin Lazar, Vice President and Service Director at Nemertes Research, told UC Today that the deal is a logical fit, noting that many contact center platform providers already integrate Google Cloud’s contact center technology into their own offerings. This means Verizon is building on a technology foundation that has already achieved meaningful adoption across the industry.

Conversational AI Will Augment — Not Replace — Human Agents

Seth Miller, CEO of VerbalWare and a chatbot industry expert, offered a measured take on the partnership’s potential. He described the Verizon–Google deal as “a win all around,” particularly in the context of the COVID-19 pandemic, which strained customer service teams across industries while simultaneously raising customer expectations.

“COVID has, and will continue to be, a wake-up call for the economy. Customer service teams have shrunk, but customers expect a superlative experience.”

Seth Miller, CEO, VerbalWare

Miller argued that conversational AI will not fully replace human agents but can absorb a large volume of routine, repetitive queries — freeing agents to handle higher-complexity interactions that genuinely require human judgment. He also stressed that companies deploying these systems will need to invest in retraining agents to design conversation flows and work alongside NLU platforms effectively.

Broader Google Cloud Enterprise Momentum

The Verizon announcement was part of a wider wave of enterprise commitments to Google Cloud. Other organizations reported to have adopted Google Cloud technology around the same period include Deutsche Bank, Goldman Sachs, and Telefónica — one of the world’s largest telecom operators by subscriber count.

At Google Cloud Next ’20, Google also announced BigQuery Omni, a multi-cloud analytics solution built on the Anthos hybrid and multi-cloud platform. BigQuery Omni allows users to run analytics workloads against data stored across multiple cloud environments using a consistent interface — addressing a real operational challenge for enterprises with data distributed across AWS, Azure, and Google Cloud.

“We’re honored to see organizations across every industry place their trust in Google Cloud, as we partner to solve real-world business problems.”

Thomas Kurian, CEO, Google Cloud

Key Takeaways for DevOps and Platform Engineers

• Dialogflow is the underlying conversational AI platform. If you’re evaluating NLU frameworks for contact center or chatbot use cases, it’s worth assessing alongside alternatives such as Amazon Lex and Microsoft Bot Framework.
• Google CCAI is designed to integrate with existing telephony infrastructure, not replace it wholesale — making incremental adoption feasible.
• Real-time agent assist is increasingly table-stakes for enterprise contact center AI — evaluate vendors on the quality of their suggestion latency and knowledge retrieval accuracy.
• BigQuery Omni signals Google’s intent to compete for analytics workloads even when data lives outside GCP — a significant architectural consideration for multi-cloud strategies.
• Workforce planning matters: AI deployment in contact centers requires parallel investment in agent training and conversation design skills, not just technology procurement.

The widespread shift to remote and distributed work has further widened the gap. Distributed teams rely more heavily on asynchronous collaboration tools, make more frequent changes to shared code bases, and must integrate work across more diverse environments—all of which demands a broader and more fluid skill set than a co-located team might require.

Organizations that successfully close the IT skills gap can accelerate their transformation efforts and build the organizational resilience needed to weather future disruptions. Doing so requires three things: understanding why specific skills are rising in demand, selecting tools that reduce the burden of constant retraining, and cultivating a lasting culture of learning.

Why These Skills Are Rising in Demand

Before investing in any upskilling program, it pays to understand the forces driving skill requirements. Without that context, training budgets get wasted on skills that may fade from relevance quickly.

Governance, Risk, and Compliance (GRC)

The surge in demand for GRC skills is a direct consequence of an increasingly complex regulatory landscape. Regulations such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require that privacy and risk controls be woven into software from the ground up—not bolted on after deployment. DevOps teams do not necessarily need to become legal experts, but they do need to internalize privacy-by-design and security-by-design philosophies. Developers who understand data classification, consent management, and audit logging are better equipped to ship compliant software without depending entirely on specialist compliance teams at release time.

Process and Knowledge Skills

The growing emphasis on process and knowledge skills tracks closely with the broader adoption of Site Reliability Engineering (SRE) practices. SRE introduces discipline around service-level objectives, error budgets, alert monitoring, and escalation runbooks—all of which demand explicit process thinking. Engineers who invest in understanding on-call workflows, incident response playbooks, and blameless postmortem practices will find these skills increasingly transferable across organizations as SRE continues to mature.

Collaboration and Integration Skills

As distributed teams become the norm, the ability to collaborate effectively through asynchronous tooling matters more than ever. Higher volumes of pull requests, code reviews, and merge conflicts are practical indicators that teams need stronger skills in version control workflows, branch strategies, and CI/CD pipeline hygiene. These are not glamorous skills, but they compound in value as team size and code base complexity grow.

Choosing Tools That Reduce Skill Variability

Because in-demand skills can shift from year to year, organizations that build their workflows around tools requiring constant retraining face an uphill battle. A more sustainable approach is to invest in tools that abstract away repetitive complexity and remain stable across different environments.

• Container orchestration for multi-cloud portability: Many organizations now run workloads across multiple cloud providers to maximize availability and avoid vendor lock-in. Container-based workflows—using platforms such as Kubernetes—let teams deploy consistently across cloud environments without needing deep provider-specific expertise for every project. This reduces the surface area of skills that must be maintained per cloud vendor.
• Automation for compliance and governance tasks: Manual compliance checks, data-privacy audits, and risk assessments are time-consuming and error-prone. Tools that automate policy enforcement, audit trail generation, and vulnerability scanning let engineers focus on product work rather than on learning the specifics of each regulatory framework by hand.
• Low-friction CI/CD pipelines: Pipelines that are well-documented, version-controlled, and designed with sensible defaults lower the learning curve for new team members and reduce the cognitive overhead of onboarding to new projects.

The principle here is straightforward: every task that a tool can handle reliably is a task that no longer needs to be a human skill requirement. This does not eliminate the need for upskilling, but it does let engineers concentrate their learning energy on higher-order, durable capabilities.

Building a Sustainable Culture of Learning

Technology alone cannot close the skills gap. Organizations also need deliberate cultural practices that encourage continuous learning, even—and especially—in distributed or remote environments where informal knowledge transfer is harder to facilitate.

Leadership Commitment

Learning culture starts at the top. Engineering managers and department leaders who actively protect time for training—blocking out hours for online courses, funding conference attendance, and visibly participating in learning themselves—signal that skill development is a legitimate use of work time, not something engineers must squeeze into personal hours. Without this signal, upskilling programs often atrophy despite good intentions.

Structured Learning Events

Ad hoc learning is valuable but insufficient on its own. Structured events create shared context and reinforce a team-wide growth mindset. Consider incorporating:

• Internal hackathons: Time-boxed, problem-focused events that encourage engineers to experiment with unfamiliar tools or domains in a low-stakes setting. Hackathons reinforce agile thinking and surface creative solutions that routine project work rarely produces.
• Tech talks and internal demos: Short, regular sessions where team members share what they have learned—from a conference talk, a new library, or a post-incident review—democratize knowledge and reduce information silos.
• Blameless postmortems: Beyond their operational value, postmortems are a structured learning mechanism. Reviewing what went wrong, why, and how processes will change transforms incidents into durable institutional knowledge.
• Mentorship pairing: Pairing senior engineers with less experienced colleagues on specific skills—even asynchronously—accelerates knowledge transfer in ways that courses alone cannot replicate.

Continuous Process Inspection

Agile and DevOps both emphasize continuous improvement, and this principle applies equally to the learning process itself. Teams that regularly reflect on which skills are proving most valuable, which training investments delivered results, and where knowledge gaps are causing friction will be better positioned to adapt their upskilling strategy as requirements evolve.

A People-Process-Technology Framework for Closing the Gap

Closing the DevOps skills gap is not a one-time project. Technologies such as multi-cloud infrastructure and edge computing are maturing rapidly, and each wave of adoption brings new skill requirements in its wake. Organizations that treat upskilling as a sustained, strategic priority—rather than a reactive response to individual job vacancies—will build more adaptable engineering organizations over time.

The practical path forward combines three elements working in concert:

1. People: Invest in individuals through structured learning programs, mentorship, and leadership that models continuous development.
2. Process: Embed learning into everyday workflows through postmortems, retrospectives, and structured knowledge sharing.
3. Technology: Select tools that reduce skill complexity and automate repetitive tasks, freeing engineers to focus on durable, high-value capabilities.

Simply telling developers to learn new skills without explaining why those skills matter—or without providing the time, resources, and tooling to support that learning—is a short-sighted and ultimately ineffective approach. The organizations most likely to thrive are those that understand the root causes of shifting skill requirements and equip their teams accordingly, building not just competency for today, but adaptability for whatever comes next.

Source: This article draws on themes originally reported at insights.dice.com and the DevOps Institute’s Upskilling Reports.

The disruption caused by the Covid-19 pandemic accelerated this shift, forcing companies to lean on cloud platforms to enable remote work at scale. What had been a gradual trend became an immediate operational necessity. That urgency has made the development of in-house cloud skills not just desirable, but essential.

The Problem With IT Outsourcing as a Cloud Strategy

Many organizations have historically responded to digital transformation pressures by outsourcing their IT departments, assuming that this makes them effectively “digital.” Fred Flack, Head of Talent Academy at CloudStratex, argues this is a fundamental mistake.

“Digital knowledge is leased,” Flack explains, “and any advantage they enjoy from it will disappear when they can no longer afford to pay, putting them right back at square one.”

True digital capability requires ownership. Organizations moving toward cloud-only operations have, in Flack’s view, a duty of responsibility to their employees — to keep them upskilled, or reskilled where necessary, rather than paying lip service to digital training programs.

Practically, this means two things: making targeted digital hires despite the competitive talent market, and engaging specialist IT training organizations that can qualify existing staff and help build an internal digital knowledge hub with a culture of continuous improvement.

Cloud Roles Are Becoming Software Development Roles

One of the clearest signals that cloud talent development needs to evolve is the changing nature of cloud engineering itself. As cloud environments grow more complex, the skill profile of a cloud practitioner increasingly overlaps with that of a software developer.

There is still a meaningful crossover with traditional IT: cloud engineers need to understand hardware, infrastructure, and troubleshooting. But the weight has shifted. Organizations recruiting for cloud roles are now, in many cases, looking for developer competencies.

Simon Utting, COO at Amito, puts it plainly: “With the cloud environment becoming increasingly complex feature-wise, staying ahead of competitors, maintaining platforms and scaling requires consistent automation. This brings us back to coding. Make sure your team is on a pathway of continually developing these skills.”

Utting also identifies Linux expertise as a specific gap, noting that the majority of his company’s client base runs on Linux and that qualified Linux talent is currently difficult to find. Security is another emerging priority: “Tying security into your cloud talent development is going to be huge in the next couple of years as cyber security becomes more sophisticated — your team needs to know how to respond to it effectively.”

Culture and Continuous Learning Matter More Than Certifications

Certifications have their place — they provide a common benchmark and a basis for conversations in interviews — but they are not the end goal. The organizations building the strongest cloud teams are those investing in learning culture, not just training programs.

Utting describes what he looks for when hiring: “Personally, I’m far more interested in curiosity, a desire to solve a problem, being self-starters — this talent goes much further as you develop it.”

Sean Farrington, SVP EMEA at Pluralsight, echoes this view, highlighting the operational challenge of maintaining cloud skills once people are in post. “Businesses need the ability to accurately map skill levels and proficiencies within teams and put in place tailored learning pathways to address knowledge gaps,” he says.

This requires rethinking how learning is delivered. Pluralsight’s own research found that 40% of IT professionals prefer learning online — through self-paced or instructor-led courses — over classroom-based formats. Farrington draws the practical conclusion: “The ability to upskill on demand and in bite-sized chunks is likely to keep cloud computing talent motivated, current and project-ready.”

Simon Ratcliffe, Principal Consultant at hybrid IT services provider Ensono, agrees. He argues that the organizational culture must catch up with the technology itself: “It is no longer enough to produce a list of technical requirements and pattern match applicants to skills. We must adopt a far more people-centric approach to recruitment and development right across the organisation. The speed, agility and freedom to fail provided by the cloud are worthless without an underlying culture that accepts this.”

Making the Cloud Career Path Visible and Appealing

There is an often-overlooked dimension to the cloud talent shortage: perception. Cloud engineering competes for attention against roles in artificial intelligence, machine learning, and cyber security — areas that currently attract significant media coverage and are seen as more prestigious by many early-career technologists.

Farrington identifies this directly: “Half the battle with developing cloud computing talent is showing bright employees that there is a long, enriching career in the cloud. As technology leaders, we must show them that the cloud is the engine room for tomorrow’s innovation; helping build our smart cities by underpinning big data, AI, IoT or 5G applications.”

This is a legitimate leadership challenge. If cloud is positioned internally as infrastructure plumbing rather than as a foundation for innovation, it will continue to struggle to attract the best candidates.

Building a Talent Pool Designed for Constant Change

Because cloud technology evolves so rapidly, Ratcliffe argues that chasing specific technical skills is a losing strategy. The skills that are in demand today may be commoditized or obsolete within a few years.

Instead, he advocates for building a talent pool around diverse thinking and a genuine passion for continuous learning: “The days of a couple of technical courses a year for staff are long gone. Learning is constant, consistent, on the job and flexibility needs to be built into the culture to allow for this.”

The practical implication is that organizations need to stop treating cloud talent development as a periodic HR exercise and start treating it as an ongoing operational discipline — one that is embedded in how teams are structured, how work is done, and how success is measured.

Key Takeaways for Engineering and DevOps Leaders

• Don’t mistake outsourcing for digital capability. Leased digital knowledge creates dependency, not competitive advantage.
• Hire and develop for developer competencies. Automation, coding, and Linux skills are increasingly central to cloud roles.
• Embed security in cloud talent development from the outset, not as an afterthought.
• Build learning pathways that match how engineers actually learn — online, self-paced, and in manageable increments.
• Prioritize curiosity and learning agility over certification checklists when assessing candidates.
• Communicate the career opportunity in cloud clearly. Position it as foundational to AI, IoT, and smart infrastructure — not just as back-end infrastructure work.
• Make learning continuous and culturally normal, not an annual compliance activity.

Original reporting by Information Age. Quotes attributed to Simon Ratcliffe (Ensono), Fred Flack (CloudStratex), Simon Utting (Amito), and Sean Farrington (Pluralsight).

What Red Hat Integration Is

Red Hat launched Red Hat Integration as a consolidated suite of integration and event-processing technologies designed for container-based environments. The suite targets organizations that need to create, extend, and deploy integration services across hybrid and multi-cloud infrastructures without being locked into a single platform or deployment model.

The solution is positioned as agile, distributed, and API-centric, giving development and operations teams a consistent way to connect applications and share data regardless of where those workloads run—on-premises, in a public cloud, or across multiple clouds simultaneously.

Why Enterprise Integration Has Had to Evolve

Enterprise IT integration is not a new problem, but the dominant architectural patterns have shifted dramatically over the past decade. Monolithic middleware platforms and point-to-point ESB (Enterprise Service Bus) topologies have given way to a landscape defined by three core primitives:

• Microservices – independent, loosely coupled services that can be developed, deployed, and scaled separately.
• APIs – the contracts that allow those services (and external systems) to communicate in a standardized way.
• Containers – the packaging model that makes microservices portable and environment-agnostic.

Kubernetes has become the de facto orchestration standard for managing containerized workloads at scale. As organizations migrate to or build on Kubernetes, their integration layer must follow—moving from centralized, server-based middleware to distributed, cloud-native integration patterns.

Key Capabilities of Red Hat Integration

Red Hat Integration bundles several upstream open-source projects and Red Hat-productized components into a single subscription. Core capabilities include:

• Apache Camel / Camel K – A lightweight, Kubernetes-native runtime for Camel integration routes. Camel K allows developers to run integration code directly on Kubernetes without writing boilerplate Deployment manifests.
• AMQ Streams (Apache Kafka on Kubernetes) – Red Hat’s productized distribution of the Strimzi project, which provides Kubernetes Operators for deploying and managing Apache Kafka clusters natively.
• AMQ Broker – An enterprise-grade messaging broker based on Apache ActiveMQ Artemis, supporting AMQP, MQTT, STOMP, and other protocols.
• 3scale API Management – Tools for publishing, securing, and analyzing APIs at scale.
• Debezium – An open-source change data capture (CDC) platform that streams database changes as events to downstream consumers.
• Service Registry – A schema and API artifact registry (based on Apicurio) that enforces data contracts between producers and consumers in event-driven systems.

Strimzi: Running Apache Kafka on Kubernetes

One of the most technically significant components highlighted in the launch is the Strimzi project, which underpins AMQ Streams. Strimzi provides a set of Kubernetes Operators that automate the deployment, configuration, and lifecycle management of Apache Kafka clusters on Kubernetes.

Running Kafka on Kubernetes introduces real operational complexity—stateful workloads, persistent storage, inter-broker networking, and rolling upgrades all require careful handling. Strimzi encodes that operational knowledge into Kubernetes Custom Resource Definitions (CRDs) and Operators, allowing teams to manage Kafka clusters declaratively using the same kubectl or GitOps workflows they use for the rest of their platform.

Red Hat is a contributor to the upstream Strimzi project, which is hosted under the Cloud Native Computing Foundation (CNCF) sandbox. AMQ Streams is the supported, enterprise-ready productization of that upstream work.

Integration as a Competitive Differentiator

Beyond the technology stack, the business driver is speed. The ability to rapidly respond to changing market conditions—shipping new features, incorporating user feedback, or connecting a newly acquired system—depends on how quickly integration work can be done. Tightly coupled, centralized integration layers become bottlenecks; distributed, API-driven integration patterns remove them.

Cloud-native integration aligns the integration layer with the same principles that govern modern application architecture:

• Decentralized ownership – individual product teams own and operate their integration routes, reducing dependency on a central middleware team.
• Event-driven architecture – systems react to events in near real-time rather than polling or relying on scheduled batch jobs.
• Self-service API exposure – API management tooling lets teams publish and consume APIs without going through a central gateway bottleneck.
• Observability built in – metrics, tracing, and logging can be emitted from integration components and scraped by the same tools (Prometheus, Jaeger, etc.) used across the rest of the Kubernetes platform.

Deployment Model

Red Hat Integration is designed to run on Red Hat OpenShift, Red Hat’s Kubernetes distribution, but many of the underlying components—Camel K, Strimzi, Debezium—are standard Kubernetes-compatible projects that can run on any conformant cluster. The full productized suite with enterprise support is available as part of a Red Hat subscription.

Organizations evaluating the suite should assess which components they actually need. A team that already runs Apache Kafka may only need Camel K for lightweight integration routing; a team starting from scratch may want the full stack including API management and a service registry for schema governance.

Summary

Red Hat Integration consolidates Apache Camel, Apache Kafka (via Strimzi), change data capture (via Debezium), API management, and schema registry capabilities into a single, Kubernetes-native integration platform. For DevOps and platform engineering teams building or migrating to cloud-native architectures, it represents a shift from centralized middleware toward distributed, operator-managed, event-driven integration—one that aligns more naturally with how modern containerized applications are built and operated.

The Evolving Role of the CISO

Managing an effective application security program often feels like operating in an ungoverned frontier. CISOs face a mounting set of challenges: championing cybersecurity across business units, unifying development and security teams, managing complex distributed infrastructure, and satisfying increasingly stringent regulatory requirements—all while keeping pace with accelerating software delivery cycles.

The CISO role itself has a relatively short history. The position is widely credited as first being established at Citicorp in 1994 following a high-profile breach, when Steve Katz became the first person to hold the title. What began as a largely technical position has since evolved into a strategic enterprise leadership role. The focus has shifted from checkbox compliance toward genuine risk management—and today, ensuring secure software development ranks among the top priorities for most CISOs.

The business case is clear: higher-quality, secure software drives greater productivity and lowers the total cost of ownership (TCO) of a vulnerability management program. When CISOs can frame security in terms of software quality and business outcomes, they are better positioned to drive organizational alignment.

What Is DevSecOps and Why Does It Matter?

DevSecOps is the practice of integrating security directly into the DevOps pipeline—rather than treating it as a gate at the end of the software development lifecycle (SDLC). The goal is to build a culture of continuous, consistent vulnerability identification and remediation, where security is everyone’s responsibility from day one of development.

Introducing security earlier in the SDLC—often called “shifting left”—reduces the cost and complexity of fixing vulnerabilities. Defects caught during development are significantly cheaper to remediate than those discovered in production. More importantly, a mature DevSecOps practice reduces the attack surface by eliminating vulnerabilities before software ever ships.

Core Principles of a DevSecOps Culture

Building a DevSecOps practice requires more than adding security tools to a CI/CD pipeline. It demands a shift in culture, process, and strategy. The following principles provide a practical framework for getting there:

1. Customer-Focused Security Strategy

Security exists to protect assets, but businesses must also take on calculated risk to grow revenue. These goals are not mutually exclusive. CISOs should align security programs with business objectives and customer needs, making security controls understandable to non-security stakeholders. When security is positioned as an enabler—rather than a blocker—adoption across the organization improves significantly.

2. Scale Through Automation

Security cannot be an obstacle to delivery speed. As development cycles shorten, manual security processes become bottlenecks. Scaling effectively means reducing manual effort through SDLC automation and continuous scanning. Automated security testing—integrated into build and deployment pipelines—enables faster vulnerability detection and remediation without slowing engineering teams.

3. Objective, Actionable Criteria

Teams need to make fast, confident decisions about security issues. That requires clear, objective criteria to prioritize vulnerabilities: which to fix now, which to schedule, and which represent acceptable risk. Security scorecards and risk-based prioritization frameworks give engineering and security teams shared visibility and a common language for decision-making.

4. Proactive Threat Hunting

A reactive incident response process is necessary but not sufficient. DevSecOps teams should integrate proactive, internal security testing throughout the development process—identifying vulnerabilities before they can be exploited. This includes static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and infrastructure-as-code scanning, each providing actionable remediation guidance as close to the point of code creation as possible.

5. Continuous Detection and Remediation

Continuous integration and continuous delivery (CI/CD) require continuous security. This means real-time monitoring and analysis across the entire SDLC, not periodic point-in-time assessments. A complete feedback loop—from detection through remediation to verification—allows teams to measure security posture over time and make data-driven forecasts about defensive controls and business risk.

Building Organizational Alignment Around Security

One of the most persistent debates in application security is ownership: should developers own security, or should security engineers? The honest answer is both. Application security must be a coordinated, collaborative effort spanning Dev, Sec, and Ops—and it must extend across the entire organization, not just the engineering department.

The key to winning developer buy-in is to remove friction. Developers generally want to write secure code; they need the right tooling and context to do it. Rather than handing teams a list of secure coding standards to memorize, give them instrumented tooling that identifies defects in their workflow and tells them how to fix them. When remediation guidance is contextual and immediate, quality improves organically over time.

Framing security as a quality initiative—rather than a compliance exercise—also helps. Teams that think of secure code as high-quality code are more likely to internalize security practices than teams who view security as an external constraint imposed by another department.

Maintaining a Current Security Posture

DevSecOps is not a one-time transformation—it is an ongoing practice. As your organization evolves and the external threat landscape shifts, your security posture must keep pace. This requires:

• Continuous visibility into vulnerabilities across all environments and pipeline stages
• Regular review of information security policies to ensure they reflect current threats and business context
• Proactive introduction of new controls as new attack surfaces emerge (cloud-native infrastructure, third-party dependencies, API sprawl)
• Ongoing training so that developers and operations engineers remain current on secure practices and emerging threats

The Path Forward: DevSecOps as Competitive Advantage

The journey to a mature DevSecOps practice is not trivial, but the destination is worth the effort. Organizations that successfully integrate security into their development culture gain more than a reduced attack surface—they gain a genuine competitive advantage. Secure software ships with fewer costly post-release fixes, earns greater customer trust, and moves through compliance audits more efficiently.

The place to start is not with a sweeping organizational overhaul. Begin by integrating automated security scanning into existing pipelines, establish shared metrics between security and engineering teams, and make vulnerability data visible and actionable for the developers closest to the code. From there, the culture shift follows the tooling.

Security is no longer a gate at the end of the SDLC. In a DevSecOps organization, it is woven into every commit, every build, and every deployment. That is what it means for secure DevOps to be the new sheriff in town.

Eficode Earns Gartner Recognition for DevOps Value Stream Management

Eficode, a Helsinki-based DevOps services and platform company, has been recognized as a Sample Vendor in the Gartner Hype Cycle for Agile and DevOps, 2020. The annual Hype Cycle report covers the key methodologies, tools, and platforms that organizations use to support and scale DevOps initiatives. The 2020 edition was authored by Gartner analysts George Spafford and Joachim Herschmann and published on July 15, 2020.

What Is the Gartner Hype Cycle?

The Gartner Hype Cycle is a graphical representation of the maturity, adoption, and business applicability of specific technologies and methodologies. It is designed to help technology leaders understand how a given tool or approach will evolve over time, enabling more informed deployment decisions aligned with business objectives. Each edition of the Hype Cycle covers dozens of technology categories across varying stages of maturity.

Important disclaimer from Gartner: Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications represent the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

DevOps Value Stream Management Platforms: Why They Matter

Eficode was specifically recognized in the category of DevOps Value Stream Management Platforms (VSMP). According to the report, VSMPs provide visibility and traceability across every stage of the software delivery lifecycle — from initial ideation through development, release, and production, and extending to capturing customer feedback.

Hassan Ennaciri, Senior Director and Analyst at Gartner, is quoted in the report explaining the strategic value of VSMPs:

“To scale agile and DevOps practices, organizations need a DevOps VSMP that provides visibility into higher-level metrics. DevOps VSMPs serve as an orchestrator by integrating with existing DevOps tools. They provide product teams with flexibility and freedom in selecting their tools by simplifying integration with existing DevOps toolchains or value stream delivery platforms (VSDPs).”

Hassan Ennaciri, Senior Director & Analyst, Gartner

This framing reflects a broader industry shift: as DevOps toolchains grow more complex and involve more teams, the need for a unifying platform that can orchestrate, measure, and visualize the entire software delivery pipeline becomes critical.

Eficode ROOT: The Platform Behind the Recognition

The recognition centers on Eficode’s ROOT DevOps Platform, which is designed to help organizations manage their software delivery processes and DevOps toolchain integrations. According to Eficode CEO Ilari Nurmi:

“We have built the Eficode ROOT DevOps Platform to help organizations manage their software delivery and DevOps toolchain. With Eficode ROOT, our customers deliver customer value faster, manage quality- and compliance-related risks, and improve the much-needed visibility into software development. We are thrilled that Gartner, the world’s leading research and advisory company, has recognized Eficode in their report. We view it as a great testament to the work we are doing.”

Ilari Nurmi, CEO, Eficode

The ROOT platform is positioned as an integration layer that connects best-of-breed DevOps tools into a coherent, measurable value stream — rather than replacing individual tools, it orchestrates them and adds cross-tool visibility.

Notable Customer Use Cases

Eficode has worked with organizations across multiple industries in their DevOps transformations. Customers referenced in the announcement include:

• Sennheiser — embedded software development
• DNA (now part of Telenor) — telecommunications
• OP — financial services

At the time of the announcement, Eficode had also recently signed an agreement with Bankdata, one of Denmark’s largest financial technology companies, to deliver the Eficode ROOT DevOps Platform. Bankdata selected Eficode for its ability to integrate best-in-class individual software development and operations tools into a continuous value stream.

Key Takeaways for DevOps Teams

• The Gartner Hype Cycle for Agile and DevOps, 2020 explicitly called out DevOps Value Stream Management Platforms as a distinct and important technology category.
• VSMPs address the orchestration and visibility gap that emerges when organizations scale DevOps across many teams and tools.
• Analyst recognition of this category signals growing enterprise demand for end-to-end software delivery observability — not just CI/CD automation.
• Organizations evaluating DevOps toolchains should consider how individual tools connect into a coherent value stream, and what visibility exists across that stream.

Source and Attribution

Gartner, Inc., Hype Cycle for Agile and DevOps, 2020, by George Spafford and Joachim Herschmann, July 15, 2020. Original press release via PR Newswire, August 4, 2020.

Oh, to have the problems Jeff Bezos has. You have to feel pretty good if you’ve got a business running at a $43-billion annualized rate and it’s getting knocked for growing “only” 29%.

Such is the case with Amazon’s AWS cloud-computing unit, which for the past few years has been not only the fastest-growing business but also the biggest net-profit contributor within Bezos’s company.

But that long-running and remarkable narrative got obliterated last week when Amazon reported that Q2 revenue for AWS rose 29% to $10.8 billion, but that Amazon’s overall revenue surged 41% to $88.9 billion.

So how did this happen? I’ll offer up 3 ideas for what drove this, but my primary point is this: anyone who thinks that AWS is “in trouble” or “struggling” because this massive and world-renowned business in the biggest growth market the tech industry has ever known grew “only” 29% is nuts.

Look at what some competitors did in the same quarter:

• Mighty Microsoft: its commercial-cloud business grew 30% to $14.3 billion
• Feisty IBM (yes, “Feisty IBM!”): its cloud business grew 30% to $6.3 billion
• Surging Google Cloud: its Q2 revenue jumped 43% to $3.0 billion

Now, Amazon didn’t get to be Amazon by being satisfied with simply matching the results of its competitors. And no doubt Bezos is having some very frank conversations with AWS leader Andy Jassy about strategic moves to push that growth mark back above 30%.

But it is possible that no company in any industry has ever had a quarter like parent-company Amazon just had. So here are my 3 ideas for what’s really going on at Amazon and why 29% growth to $10.8 billion might seem to some to be lackluster.

1. Amazon’s overall business is exploding.

Amazon is perfectly situated to meet the demands of our COVID-driven world.  Consider:

• In just two months—March and April—Amazon hired 175,000 people. That’s an average of almost 3,000 people per day. And with demand staying strong, the company plans to make 125,000 of them full-time employees.
• Prime membership is rising across the world, and the volume of streaming video served by Amazon doubled in Q2.
• Demand from consumers has been so strong that Amazon actually reduced marketing expenditures in an effort to “manage” (aka “slow down”) demand. On last week’s earnings call, CFO Brian Olsavsky said, “We cut marketing probably by about a third in Q2, mainly because we’re trying to manage demand. It started to normalize and get back to somewhat normal levels at the end of Q2, and therefore, we’ll see a higher level in Q3. But certainly, marketing costs were lower.”

2. Online grocery-store revenue *tripled* year over year.

Olsavsky: “We’re reaching more customers with our grocery offerings. Online grocery sales tripled year-over-year. … The number of Whole Food stores that you can pick up deliveries on tripled this quarter.”

3. AWS: in the past year, revenue has grown by $10 billion.

Against fierce and relentless competition, AWS continues to be one of the most successful tech companies of the past decade and the category king. But like every company in the Cloud Wars Top 10, AWS needs to not only innovate and grow in the areas it’s always been in, but also expand into new segments to create more revenue opportunities and broader solutions for customers.

Olsavsky said that in a surprising twist, AWS salespeople are even helping customers consume *smaller amounts* of AWS services. “Companies are working really hard right now to cut expenses, especially in the more-challenged businesses like hospitality and travel but pretty much across the board.

“We’re helping them. We’re actively, with our sales force, looking for ways that we can help them save money. This includes things like scaling down the usage where it makes sense or benchmarking their workloads against our architectural best practices. So that’s not going to help our usage growth in the short run, but it will help those customers save money.

“And we think that’s the right thing to do, not only for their success and so they can come out of this in a better shape but also for the long-term health of our relationship with them as an AWS provider.”

Also, Olsavsky pointed out that the revenue backlog for AWS grew 65% year-over-year and 21% quarter-over quarter.

Final thought

Whatever you might think of Amazon, the cold reality is that it operates and is growing at a scale few companies have ever even approached.

That holds true for its AWS unit as well, although clearly AWS is not nearly as differentiated and dominant as it was just a few years ago.

Other players in the cloud-infrastructure space that AWS created 15 years ago and has led ever since have branched out into new areas and/or taken new approaches. And not just fellow cool kids Microsoft and Google Cloud—look at Oracle and IBM, written off by many as old-world fuddy-duddies that could never compete in the cloud.

But much to their credit, both IBM and Oracle are doing well in the cloud with new products (Red Hat hybrid cloud for IBM, Autonomous Database and Gen2 IaaS for Oracle) that are competing lustily against AWS.

I’m betting that the greatly intensified competition within Amazon will sharpen Andy Jassy’s appetite for reclaiming the right to be called the growth driver of the entire Amazon organization.

But he’d better move fast—incredibly fast—because everyone else in the Cloud Wars is sure as hell doing so.

Overview

Datadog, the monitoring and security platform for cloud applications, announced native support for ingesting log data via Amazon Kinesis Data Firehose. The integration allows customers to stream logs from AWS services directly into Datadog without deploying or maintaining standalone log forwarder infrastructure in their environment.

What Is Amazon Kinesis Data Firehose?

Amazon Kinesis Data Firehose is a fully managed AWS service that reliably captures, transforms, and loads streaming data into data lakes, data stores, and analytics tools. It acts as a centralized collection point for log and event streams produced by multiple AWS services, then routes that data to configured destinations — including third-party monitoring platforms such as Datadog.

AWS services that can deliver logs through Kinesis Data Firehose include:

• Amazon CloudWatch Logs — application and infrastructure log groups
• Amazon API Gateway — access and execution logs
• AWS Lambda — function invocation and error logs
• Amazon EC2 — system and application logs forwarded via CloudWatch agents

How the Datadog Integration Works

With Kinesis Data Firehose configured as the delivery stream and Datadog set as the destination, log data flows from AWS services to Datadog entirely through the AWS Management Console and APIs. Teams no longer need to deploy and manage a separate Lambda-based log forwarder or custom pipeline to get AWS log data into Datadog.

Once logs arrive in Datadog, they are available through the platform’s full suite of Log Management capabilities.

Key Log Management Features Unlocked

Real-Time Visibility with Live Tail

Engineers can observe streaming log events as they arrive using Datadog’s Live Tail, making it possible to troubleshoot issues in real time without waiting for indexing cycles.

Logging Without Limits

Datadog’s Logging without Limits feature allows teams to ingest all logs and then apply dynamic indexing filters to control which logs are stored and searchable long-term. This decouples ingestion volume from cost, letting teams keep high-value logs while reducing spend on verbose but low-priority data.

Automatic Parsing and Metadata Enrichment

Datadog automatically parses structured and semi-structured log formats from AWS services and enriches each event with additional contextual metadata, reducing the manual pipeline work typically required before logs become queryable.

Log Analytics and Generated Metrics

Log Analytics enables high-cardinality queries across large log volumes, making it easier to surface patterns in error rates, latency distributions, or security events. Teams can also generate metrics directly from log data to track long-term trends without retaining the raw log events.

Correlation with Metrics and Traces

Logs ingested via Kinesis Data Firehose can be correlated with infrastructure metrics and distributed traces already flowing into Datadog, giving engineers a unified view of availability, performance, and security across their AWS environment.

What This Means for DevOps and Platform Teams

Before this integration, sending AWS service logs to Datadog typically required deploying a Lambda function (the Datadog Forwarder) and managing its configuration, permissions, and scaling. Kinesis Data Firehose as a native delivery mechanism reduces operational overhead significantly: the delivery stream is a managed AWS resource, and routing changes can be made from the AWS console without touching custom code.

For teams already using Kinesis Data Firehose for other data pipelines, this also means log routing to Datadog can be added as another destination within an existing stream configuration.

Official Statements

“With support for this new feature, customers can now send their AWS logs and telemetry to Datadog without setting up any additional infrastructure, which will make analysis and troubleshooting within Datadog’s cloud monitoring platform easier.”

— Ilan Rabinovitch, Vice President, Product and Community, Datadog

“Combined with Amazon Kinesis Data Firehose, Datadog’s log management offering can help customers gain a better understanding of the availability and security of their cloud infrastructure.”

— Doug Yeum, Head of Worldwide Channel and Alliances, Amazon Web Services

Getting Started

To configure this integration, you create a Kinesis Data Firehose delivery stream in the AWS Management Console, select Datadog as the HTTP endpoint destination, and provide your Datadog API key. CloudWatch Logs subscription filters or other AWS service log delivery settings can then point to that Firehose stream. Refer to the Datadog documentation on Kinesis Firehose log ingestion for current setup steps, as configuration details may have evolved since the original announcement.

The Growing Divide Between DevOps Haves and Have-Nots

Organizations that have fully embraced DevOps best practices are beginning to see measurable financial and operational advantages over competitors that have not made comparable investments. That is the central finding of a global survey of 400 IT executives and practitioners, commissioned by New Relic and conducted by Longitude, a research unit of the Financial Times Group.

The survey segments respondents into leaders and laggards based on their application development maturity. The data suggests the gap between these two groups is widening — and that the COVID-19 pandemic accelerated the divergence.

Who Are the DevOps Leaders?

The survey identifies 25% of respondents as DevOps leaders — organizations that treat software quality and delivery speed as strategic priorities rather than operational concerns. Key characteristics of this group include:

• 90% identify the development and deployment of higher-quality software as a strategic business priority.
• 98% have adopted continuous integration and continuous delivery (CI/CD) pipelines.
• 94% have made observability a core part of their software development process.
• 96% have adopted a cloud-native approach to application development, with leaders running an average of 66% of their software and systems in the cloud.

Tangible Business Outcomes for Leaders

Adopting these practices is not just a technical improvement — it correlates with measurable business results. Over a third of DevOps leaders (more than 33%) report that their organizations have seen revenue increase by 10% or more over the preceding three years, a figure they attribute at least in part to their software delivery capabilities.

Operational Efficiency: Innovation Over Fire-Fighting

One of the starkest contrasts between leaders and laggards is how developer time is spent. Among leaders, an average of 77% of developer time is dedicated to innovation rather than fixing defects, incidents, or technical debt.

This is enabled in large part by a proactive approach to system reliability:

• 78% of leaders discover system and software interruptions through observability platforms before end users report them.
• 99% of leaders say they can quickly understand the impact of changes made to software.
• 83% of leaders experience fewer than five major software or system outages per month.
• 75% of leaders achieve an average incident resolution time of under 30 minutes.

Advanced Practices: Chaos Testing and Automated Remediation

DevOps leaders are not just adopting mainstream practices — they are pushing further into advanced reliability engineering. The survey finds that among leaders:

• 77% have adopted chaos testing — deliberately injecting failures into systems to validate resilience.
• 89% have implemented automated remediation, reducing the need for manual intervention when issues occur.

These practices directly support the short resolution times and low outage rates reported above, and represent a level of maturity that most laggard organizations have not yet reached.

Cloud Adoption: High, But Not Without Friction

Even among leaders, cloud adoption is not frictionless. The survey identifies security concerns and regulatory compliance as the top barriers to greater cloud adoption — consistent with what practitioners typically encounter when migrating regulated workloads or operating in highly scrutinized industries.

Organizational Structure: Smaller Teams, Broader Tooling

Buddy Brewer, then Global VP and General Manager for Digital Experience Monitoring at New Relic, noted in commentary accompanying the survey that organizations are increasingly focusing their DevOps investments on applications that are most critical to the business — particularly digital engagement tools that became essential during the COVID-19 pandemic.

He also observed that IT organizations are restructuring into smaller, cross-functional teams to improve collaboration during build and deployment cycles. As team structures flatten and distribute, those teams require access to a broad portfolio of cloud-based tools to manage complex, highly distributed applications effectively.

The Widening Gap — and the Pandemic Effect

The survey paints a clear picture: as DevOps leaders advance further along the maturity curve, the gap between them and laggards grows wider, not narrower. The pandemic accelerated this dynamic. Organizations that already had mature DevOps processes were better positioned to adapt quickly to remote work, shifting customer demands, and digital-first service delivery. Many doubled down on their DevOps investments as a direct response.

For laggards, the calculus is difficult. Budget constraints during an economic downturn make it harder to invest in modernizing tools and processes — but continued reliance on outdated approaches risks making recovery even more difficult once conditions improve. Organizations that delay DevOps transformation may find the gap has become structurally harder to close.

Key Takeaways for DevOps Practitioners

• CI/CD and observability are table stakes for DevOps leaders — near-universal adoption among the top quartile suggests these are no longer differentiators but baseline expectations.
• Proactive incident detection via observability platforms — rather than waiting for user complaints — is a defining trait of high-performing teams.
• Chaos engineering and automated remediation are the practices that separate mature organizations from intermediate ones.
• Developer time allocation matters: organizations that protect innovation time by minimizing reactive work see compounding returns in delivery speed and product quality.
• Security and compliance remain real constraints even for cloud-native leaders and should be treated as first-class architecture concerns, not afterthoughts.

Source: Original survey findings reported via devops.com, based on research by Longitude on behalf of New Relic (published 2020).

What Is IT/DevOps Incident Management Software?

Incident management software helps engineering and IT operations teams detect, triage, communicate, and resolve service disruptions as quickly as possible. In a DevOps context, these tools sit at the intersection of monitoring, alerting, on-call scheduling, and post-incident review—forming a critical layer of the reliability engineering stack.

Core capabilities typically include:

• Alert aggregation: Collecting signals from monitoring tools (Datadog, Prometheus, Nagios, etc.) and reducing noise through deduplication and grouping.
• On-call scheduling and escalation policies: Ensuring the right engineer is notified at the right time.
• Incident communication: Status pages, Slack/Teams integrations, and stakeholder notifications.
• Runbooks and automation: Linking alerts to documented response procedures or triggering automated remediation.
• Post-incident review (PIR): Capturing timelines, contributing factors, and action items to drive continuous improvement.

Key Platforms in the Incident Management Market

The market research report highlighted the following vendors as notable players. Below is an independent summary of each platform’s positioning and primary strengths.

PagerDuty

PagerDuty is one of the most widely adopted on-call and incident response platforms in the DevOps space. It offers deep integrations with observability and monitoring tools, flexible escalation policies, and an Event Intelligence layer that applies machine learning to reduce alert noise. PagerDuty is particularly strong for engineering-led organizations running complex, distributed services.

Freshservice

Freshservice is an IT service management (ITSM) platform from Freshworks that includes incident management as part of a broader ITIL-aligned service desk. It is well-suited to IT operations teams that need to manage incidents alongside change, problem, and asset management workflows. Its interface is considered approachable for teams without heavy DevOps tooling experience.

Samanage (now SolarWinds Service Desk)

Samanage was an ITSM and asset management platform that has since been rebranded as SolarWinds Service Desk. It provides incident ticketing, service catalog, and IT asset management in a single interface, targeting mid-market IT departments.

Jira Service Management (formerly Jira Service Desk)

Atlassian’s Jira Service Management combines ITSM capabilities with the developer tooling ecosystem (Jira Software, Confluence, Bitbucket). Teams already using Jira for project tracking often find the transition to Jira Service Management natural. Its incident management features have expanded significantly since its rebranding, including native on-call scheduling and alert management following Atlassian’s acquisition of Opsgenie.

Opsgenie (Atlassian)

Opsgenie is a dedicated on-call alerting and incident response platform acquired by Atlassian. It competes directly with PagerDuty, offering alert routing, on-call schedules, escalation policies, and integrations with a wide range of monitoring and ITSM tools. Organizations using the Atlassian ecosystem often pair Opsgenie with Jira Service Management.

VictorOps (now Splunk On-Call)

VictorOps, acquired by Splunk and rebranded as Splunk On-Call, focuses on collaborative incident response. It provides timeline-based incident management, chat-ops integrations, and on-call scheduling. Organizations already using Splunk for log analysis may benefit from the tighter integration.

NinjaRMM (now NinjaOne)

NinjaRMM (rebranded NinjaOne) is primarily a Remote Monitoring and Management (RMM) platform targeting managed service providers (MSPs) and internal IT teams managing endpoints and infrastructure. Its incident-related capabilities are oriented toward device health monitoring, automated remediation scripts, and ticketing, rather than the developer-focused on-call workflows of PagerDuty or Opsgenie.

ServiceNow

ServiceNow is an enterprise ITSM platform with a comprehensive incident management module aligned to ITIL practices. It is common in large enterprises where IT operations, security operations, and HR workflows are managed on a unified platform. Implementation typically requires dedicated configuration and administration resources.

Other Vendors Mentioned

• Symantec: Known primarily for cybersecurity products; its incident management capabilities are security-incident focused rather than general IT/DevOps incident response.
• Web Help Desk (SolarWinds): A ticketing and ITSM tool for IT teams, covering incident and request management with asset tracking.
• DERDACK Enterprise Alert: An alerting and incident notification platform, often used in critical infrastructure and OT/IT environments, with strong mobile and escalation features.
• SunView ChangeGear: An ITSM platform offering incident, change, and problem management, positioned for mid-to-large IT organizations.

How to Evaluate Incident Management Tools

When selecting an incident management platform, consider the following dimensions:

1. Team Context: DevOps vs. ITSM

Developer and SRE teams typically prioritize low-latency alerting, CLI/API access, and integrations with observability tools. IT operations and service desk teams often need ITIL-aligned workflows, approval processes, and asset management. Platforms like PagerDuty and Opsgenie lean toward the former; ServiceNow and Freshservice toward the latter.

2. Integration Ecosystem

Check whether the platform integrates natively with your existing monitoring stack (e.g., Prometheus/Alertmanager, Datadog, Grafana, New Relic), communication tools (Slack, Microsoft Teams), and version control or CI/CD systems.

3. On-Call Scheduling Flexibility

Evaluate support for multi-layer escalation policies, rotation schedules (daily, weekly, follow-the-sun), override management, and holiday scheduling.

4. Alert Noise Reduction

Alert fatigue is a significant operational risk. Look for platforms that offer alert grouping, deduplication, suppression windows, and machine-learning-based event correlation.

5. Post-Incident Review Support

Blameless post-mortems drive reliability improvements over time. Check whether the platform provides automated incident timelines, action item tracking, and reporting to support a continuous improvement culture.

6. Pricing Model

Most platforms use per-user or per-seat pricing. Clarify whether pricing scales with number of services, integrations, or alert volume, as these can significantly affect total cost for larger environments.

Market Segments and Regional Adoption

According to the report summary, the global IT/DevOps Incident Management Software market was analyzed across the following regions: North America, Asia Pacific, Europe, the Middle East & Africa, and Latin America. North America has historically been the largest market for DevOps tooling adoption, driven by the concentration of technology companies and enterprises with mature SRE practices. Asia Pacific is a significant and growing region, with large-scale digital transformation initiatives in markets such as India, China, Japan, and Australia.

Specific market-size figures and growth rate projections from the cited report are not reproduced here, as independent verification of those numbers was not possible at the time of writing.

Summary

The incident management software market includes a wide range of tools, from developer-focused on-call platforms (PagerDuty, Opsgenie, Splunk On-Call) to full ITSM suites (ServiceNow, Freshservice, Jira Service Management) and RMM tools (NinjaOne). The right choice depends on team composition, existing tooling, compliance requirements, and the complexity of your service architecture. Evaluating tools with a proof-of-concept integration against your actual alert sources and on-call workflows is strongly recommended before committing to a platform.

The DevOps Tool Market in 2020: Context and Drivers

By 2020, the global market for DevOps tooling had grown from a niche concern of platform engineers into a mainstream enterprise procurement category. Organisations across IT, telecommunications, financial services, and government were actively consolidating or expanding their DevOps toolchains to accelerate software delivery, improve reliability, and reduce the cost of change.

The COVID-19 pandemic added new urgency to digital transformation initiatives. Remote-first operations, rapid scaling of online services, and pressure on IT budgets all influenced purchasing decisions. According to the 2020 market research report from Qurate Business Intelligence, analysts expected the DevOps tool market to maintain steady growth through the forecast period (to 2024–2026), with COVID-19 accelerating some adoption vectors while creating short-term budget constraints in others.

Key Vendors in the DevOps Tool Market

The competitive landscape in 2020 included a broad mix of dedicated DevOps specialists, open-source-backed commercial vendors, and large enterprise software houses. The following companies were identified as significant market participants:

• Puppet Labs – Configuration management and infrastructure-as-code automation
• Chef (now Progress Chef) – Infrastructure automation and compliance
• Docker Inc. – Container runtime and developer tooling
• Red Hat – OpenShift Kubernetes platform, Ansible automation
• Atlassian – Jira, Bitbucket, Confluence for planning and source control
• SaltStack – Event-driven automation and configuration management
• CA Technologies (Broadcom) – Value stream management and release automation
• Rackspace – Managed cloud and DevOps services
• XebiaLabs (now Digital.ai) – Release orchestration and DevOps intelligence
• VersionOne (now Digital.ai) – Agile and SAFe planning tools
• Cisco – Network automation, AppDynamics APM
• CollabNet – Agile lifecycle management and source control
• HP (Micro Focus) – Application lifecycle management and testing tools
• IBM – IBM DevOps toolchain, UrbanCode Deploy
• Microsoft – Azure DevOps, GitHub Actions, Azure Pipelines
• Spirent Communications – Network and application test automation
• VMware – Tanzu portfolio, vRealize automation
• DBmaestro – Database DevOps and release automation

The market showed clear consolidation trends: XebiaLabs and VersionOne both became part of Digital.ai, while Broadcom absorbed CA Technologies and VMware. This consolidation reflected enterprise buyers’ preference for integrated platform vendors over point solutions.

Product Category Breakdown

The research report segmented DevOps tools into three maturity-aligned categories:

DevOps Ready

Tools classified as DevOps Ready provide foundational capabilities — source control, basic CI, ticketing — that are prerequisites for a DevOps practice but do not enforce DevOps workflows on their own. Most legacy ALM and SCM tools fall into this tier.

DevOps Enabled

DevOps Enabled tools actively support continuous integration, automated testing, and pipeline orchestration. They are designed with DevOps workflows in mind and include native integrations across the software delivery chain. Jenkins, GitLab CI, and Azure Pipelines are representative examples.

DevOps Capable

DevOps Capable tools provide end-to-end value stream visibility, AI-assisted insights, policy-as-code enforcement, and cross-team governance. These are typically enterprise platforms targeting large organisations pursuing DevOps at scale or regulated environments requiring audit trails.

Target Industry Verticals

DevOps tooling adoption was analysed across the following industry segments:

• IT (Software and Services) – The largest and most mature adopter segment, driven by SaaS vendors and managed service providers.
• Telecom – Network function virtualisation and 5G rollouts increased demand for automated infrastructure pipelines.
• BFSI (Banking, Financial Services, and Insurance) – Compliance requirements and modernisation of legacy systems drove selective but high-value adoption.
• Government and Public Sector – Digital government initiatives and cloud migration programmes created procurement opportunities, albeit with longer sales cycles.
• Others – Healthcare, retail, manufacturing, and education represented an emerging cohort accelerated by pandemic-era digitalisation.

Regional Market Breakdown

The report provided regional segmentation across five major geographies:

• North America (United States, Canada, Mexico) – Historically the largest revenue region, home to most major vendors and early enterprise adopters.
• Europe (Germany, UK, France, Russia, Italy, Turkey, and others) – Strong growth driven by cloud migration and GDPR-compliant toolchain modernisation.
• Asia-Pacific (China, India, Japan, Australia, South Korea, Vietnam, Malaysia, Philippines, Thailand, Indonesia) – Fastest-growing region, led by India’s large software services sector and China’s tech expansion.
• South America (Brazil and others) – Emerging market with growth concentrated in financial services and e-commerce.
• Middle East and Africa (GCC countries and Egypt) – Government-driven smart city and digital transformation programmes supported gradual adoption.

COVID-19 Impact on the DevOps Tool Market

The pandemic affected the DevOps tool market in contradictory ways:

Accelerating factors

• Remote development teams required stronger automation and asynchronous collaboration tools, increasing demand for CI/CD platforms and chat-integrated DevOps workflows.
• Rapid scaling of e-commerce, streaming, and healthcare platforms exposed gaps in manual deployment practices, making the case for automated pipelines urgent.
• Cloud adoption accelerated as on-premises procurement cycles stalled, benefiting SaaS-delivered DevOps platforms.

Constraining factors

• Enterprise IT budget freezes in sectors like travel, hospitality, and retail delayed planned toolchain consolidation projects.
• Supply chain disruptions affected hardware-dependent testing and staging environments.
• Professional services engagements required to deploy and configure complex DevOps platforms were harder to execute without on-site access.

Key Market Questions for Decision-Makers

Whether evaluating DevOps tools as a buyer or tracking the market as an analyst or investor, the following questions frame the strategic landscape:

• Which toolchain components — CI, CD, monitoring, security scanning, planning — deliver the highest ROI for organisations at different maturity levels?
• How are large vendors (Microsoft, IBM, Red Hat) competing with specialist platforms (XebiaLabs, DBmaestro) on integration breadth versus depth?
• What regulatory requirements in BFSI and government are shaping product roadmaps for audit, traceability, and policy enforcement features?
• How is open-source adoption (Jenkins, GitLab CE, Argo CD) affecting commercial licensing revenue for paid DevOps platforms?
• What is the impact of platform consolidation (acquisitions, mergers) on long-term vendor risk for enterprise buyers?

Summary

The global DevOps tool market in 2020 was characterised by a maturing ecosystem of vendors spanning configuration management, CI/CD, container orchestration, testing, and value stream management. COVID-19 created both headwinds and tailwinds, net-positive for cloud-delivered platforms and automated pipeline tooling. The market remained highly competitive, with consolidation reshaping the vendor landscape and cloud-native toolchains gaining ground against legacy ALM platforms.

Organisations evaluating DevOps tooling should prioritise integration flexibility, vendor stability (given ongoing M&A activity), and alignment with their specific compliance and scalability requirements rather than relying solely on market share rankings.

Source: Market research data referenced from Qurate Business Intelligence / 3wnews.org (original report published June 2020). Vendor categorisations and regional descriptions reflect publicly available information as of the original publication date.

The Record-Breaking Attack

In its Q1 2020 AWS Shield Threat Landscape Report, Amazon Web Services disclosed that it had successfully mitigated a distributed denial-of-service (DDoS) attack peaking at 2.3 terabits per second (Tbps) in February 2020. At the time of disclosure, this was the largest DDoS attack ever publicly recorded. The attack lasted approximately three days, and AWS services remained online throughout, with no customer-visible disruption reported.

Attack Vector: CLDAP Reflection

The attack used a technique known as a Connection-less Lightweight Directory Access Protocol (CLDAP) reflection attack. Understanding how this works is important for any team designing DDoS-resilient infrastructure.

How CLDAP Reflection Works

1. Spoofed request: The attacker sends a CLDAP query to a publicly accessible LDAP server, but forges the source IP address to be the victim’s IP address.
2. Amplified response: The LDAP server sends its response — which is significantly larger than the original request — to the victim’s IP address rather than the attacker’s.
3. Volumetric flood: By repeating this across thousands of misconfigured LDAP servers simultaneously, attackers generate a massive flood of traffic directed at the target.

The amplification factor in CLDAP attacks can be very high, meaning attackers with relatively modest bandwidth can generate disproportionately large attack volumes. This makes CLDAP reflection particularly efficient as a DDoS vector.

Second Most Common Vector: SYN Flood Attacks

The AWS Q1 2020 report identified SYN flood attacks as the second most common DDoS vector observed during the quarter. A SYN flood exploits the TCP three-way handshake:

• The attacker sends a large number of TCP SYN packets to a target server, typically with spoofed source IP addresses.
• The server responds to each SYN with a SYN-ACK packet, allocating state for each half-open connection while waiting for the final ACK.
• Because the ACK never arrives (the source IP is fake), the server’s connection table fills up with half-open connections.
• Legitimate clients are unable to establish new connections, effectively taking the service offline.

Putting the Scale in Context

While the 2.3 Tbps headline figure is striking, the AWS report provides important context for everyday operations:

• Smaller volumetric events dominate in practice. According to the report, the 99th-percentile network volumetric event in Q1 2020 peaked at 43 Gbps — well below the record attack but still large enough to disrupt most unprotected origins.
• Multi-vector attacks are common. Whether at record scale or routine scale, attackers routinely combine techniques: ACK floods, SYN floods, UDP floods, NTP amplification, TCP resets, SSDP reflection, and CLDAP reflection are all frequently combined.

Historical Record Context

Before the AWS incident, the publicly known record for a DDoS attack was a 1.2 Tbps attack targeting GitHub in March 2018, which also used memcached amplification. The AWS attack nearly doubled that figure.

Around the same period, a separate report by Fahmida Y. Rashid at Duo Security detailed a DDoS attack against a web host protected by Akamai Technologies that peaked at 1.44 Tbps — the largest Akamai had mitigated at that time. That attack lasted approximately 90 minutes, with smaller follow-up attacks continuing afterward. It similarly involved volumetric floods using ACK, SYN, UDP, NTP, TCP reset, and SSDP packets, along with CLDAP reflection — underlining how attackers routinely combine multiple vectors.

What This Means for DevOps and Cloud Teams

The AWS Q1 2020 report and this attack carry several practical lessons:

• Managed DDoS protection is not optional at scale. Absorbing 2.3 Tbps requires infrastructure and scrubbing capacity that no single organization can self-provision cost-effectively. Managed services like AWS Shield Advanced, Akamai Prolexic, or Cloudflare Magic Transit exist specifically for this purpose.
• Plan for the 99th percentile, not just the average. Even at 43 Gbps, an unprotected origin would be overwhelmed. Use always-on traffic baseline analysis to detect anomalies early.
• Patch and restrict LDAP/CLDAP exposure. CLDAP reflection attacks depend on misconfigured, publicly reachable LDAP servers. Audit your network perimeter to ensure LDAP (UDP port 389) is not exposed to the public internet unnecessarily.
• Layer your defenses. Because multi-vector attacks are common, effective DDoS response requires protection at the network layer (L3/L4) and the application layer (L7) simultaneously.
• Review threat reports regularly. Cloud providers publish periodic threat landscape reports. Reading them keeps your team aware of evolving attack patterns and helps prioritize defensive investments.

Further Reading

For teams responsible for cloud infrastructure security, the following resources are worth reviewing:

• AWS Shield Threat Landscape Reports (published periodically by AWS Security)
• CISA guidance on DDoS attack mitigations
• IETF documentation on CLDAP and UDP-based amplification vectors