This article is based on DevOps trend predictions originally published in early 2017, drawing on commentary from CA Technologies executives. It remains relevant as a historical benchmark for how DevOps priorities have evolved.
What Is DevOps and Why Did It Matter in 2017?
DevOps describes the cultural and operational relationship between software development and IT operations teams in an enterprise. Rather than treating these disciplines as separate silos, DevOps promotes continuous collaboration, shared tooling, and faster feedback loops. The goal is greater organisational agility: the ability to ship higher-quality software more frequently and reliably.
By 2017, many organisations had adopted foundational DevOps practices—continuous integration, automated builds, and cloud deployment pipelines. The emerging question was: what comes next? Three themes rose to the top of the agenda: testing, security, and metrics.
“As organizations race to deliver innovations to market, they will find that ensuring the quality, security and performance of their applications are just as important as speed. DevOps plays a pivotal role in making sure these happen as businesses put software at the core of their DNA to survive and thrive in today’s application economy.”
Richard Gerdis, Vice President, DevOps, Asia Pacific & Japan, CA Technologies
1. Continuous Testing Across the Entire Pipeline
One of the most persistent anti-patterns in traditional software delivery was treating testing as a single, late-stage gate—typically performed by a dedicated QA team just before release. This approach creates several compounding problems:
- Defects discovered late are far more expensive to fix.
- A bottleneck at the QA phase slows the entire pipeline.
- Rapidly changing customer expectations mean existing, already-tested code can become functionally incorrect without anyone noticing.
The 2017 prescription from practitioners was straightforward: shift testing left and make it continuous. In practice, this means:
- Rigorous testing at every stage of the development lifecycle—from unit tests written alongside code to integration tests triggered on every commit.
- Shared ownership between developers and QA engineers. Developers write and run tests; QA engineers focus on exploratory, performance, and acceptance testing rather than acting as the sole testing layer.
- Visibility into test results for operations teams, enabling them to evaluate quality in context of production behaviour, not just pre-release snapshots.
This model—sometimes called continuous testing—aligns test coverage with deployment frequency. The faster you ship, the more automated your safety net needs to be.
2. Security Moves into the Pipeline: The Rise of DevSecOps
The increasing sophistication of cyber threats in 2017 forced a rethinking of where security fits in the delivery lifecycle. Historically, security reviews happened after development was complete—often performed by a separate security team whose findings could delay or derail a release.
The emerging answer was DevSecOps: the unification of development, operations, and security into a single, collaborative workflow. The core principle is that security is not a gate to pass through at the end; it is a property that must be built into every stage of the pipeline.
Key practices advocated at the time included:
- Deploying within a hardened architecture. Code quality alone is not sufficient; the infrastructure, networking, and access controls surrounding the application must also meet a security baseline before deployment.
- Treating security testing as a specialised discipline. Security-related testing involves unique tooling (static analysis, dynamic analysis, dependency scanning), specialist knowledge, and regulatory constituencies that differ from standard functional testing. Integrating these into the CI/CD pipeline—rather than bolting them on at the end—reduces the cost and friction of remediation.
The DevSecOps movement has only accelerated since 2017. Today, practices such as software composition analysis (SCA), secrets scanning, and infrastructure-as-code security scanning are considered standard components of a mature pipeline.
3. Metrics: Making DevOps Outcomes Measurable
The third major trend was a growing consensus that DevOps success needed to be measured, not just felt. With more pipeline data available than ever before, teams had the raw material to answer questions that had previously been answered only by intuition:
- Where are the bottlenecks in our delivery process?
- Which teams or practices are producing the most reliable outcomes?
- Where do we need coaching or process intervention?
Two categories of metrics were identified as particularly valuable:
Collective (Team-Level) Metrics
Collective metrics measure the performance of the pipeline and the team as a whole. Examples include deployment frequency, lead time for changes, mean time to recovery (MTTR), and change failure rate—what the DevOps Research and Assessment (DORA) programme would later popularise as the Four Key Metrics. These help organisations identify systemic bottlenecks and optimise resource allocation across the entire value stream.
Individual Metrics
Individual metrics track contribution and quality at the engineer level. When used carefully—and combined with psychological safety—they can surface coaching needs and help replicate the behaviours that lead to good outcomes. When misused, they create perverse incentives. The 2017 consensus was that individual metrics should inform coaching, not performance reviews.
A broader goal articulated at the time was industry-wide agreement on common metrics standards. Shared benchmarks would allow organisations to compare their DevOps maturity against peers, not just against their own historical baselines.
How These Trends Have Evolved
Looking back from the present, all three trends identified in 2017 proved accurate in direction, even if the specific tooling and terminology have evolved:
- Testing has become increasingly automated and AI-assisted, with continuous testing platforms integrated directly into IDEs and CI systems.
- DevSecOps is now a widely recognised discipline with its own toolchain, certification programmes, and dedicated engineering roles.
- Metrics have been formalised through frameworks such as DORA and SPACE, giving teams shared vocabularies for measuring engineering effectiveness.
For teams building or refining their DevOps practice today, these three pillars—quality through continuous testing, security as a first-class pipeline concern, and data-driven improvement through metrics—remain as relevant as they were in 2017.