This article is based on industry analysis and expert commentary originally published on TechBeacon, drawing on the 2019 Accelerate State of DevOps Report by DevOps Research and Assessment (DORA) and insights from practitioners across the industry.
DevOps Goes Mainstream—Now What?
2019 marked a turning point for DevOps adoption. According to DevOps Research and Assessment (DORA), 2019 saw the pool of “elite” DevOps performers triple compared to previous years. Nicole Forsgren, founder of DORA and then head of the Research and Strategy Group for Google Cloud, put it plainly when commenting on the 2019 Accelerate State of DevOps Report:
“For the last year or two, we’ve heard from several industry analysts that DevOps has ‘crossed the chasm,’ and now our data supports that.”
Nicole Forsgren, founder of DORA
With DevOps now mainstream, the conversation shifts from whether to adopt it to how to mature it. Industry insiders point to a common theme: more standardization and governance, without sacrificing the speed and flexibility that made DevOps valuable in the first place. The trends below reflect that maturation—squeezing more efficiency from once-experimental programs, building in resilience, tightening compliance, and tying delivery more directly to business outcomes.
1. Customer-Centric Development
Value stream management gained significant traction as organizations tried to map product strategy against the real value software delivers. The next evolutionary step is removing abstraction layers between developer-led product teams and the end customer—a shift often called customer-centric development.
Antony Edwards, COO of Eggplant Software, describes this as adding better customer-oriented feedback loops from production back into the development process:
“They will start trying to plug marketing and end-user experience monitoring (EUEM) tools into the development process.”
Antony Edwards, COO, Eggplant Software
Edwards notes that development teams may passively resist this integration, potentially triggering a re-organization of software development and marketing functions. He argues that combining customer-centric development with microservices and automated pipelines pushes the developer role further away from pure coding and toward product design—analogous to how CAD tools shifted architecture from materials engineering to design thinking.
Jai Schniepp, Director of Product for secure DevOps platforms at Liberty Mutual, echoes this view. She predicts that mature DevOps teams will think less about delivering feature requests and more about solving real problems for internal and external customers:
“Given the empowerment DevOps teams have to own, run, and manage the end-to-end delivery of an application, engineers will request more control over how problems are solved.”
Jai Schniepp, Director of Product, Liberty Mutual
2. Standardization on Kubernetes
Container adoption reached a tipping point, and with it came the consolidation of orchestration platforms. The acquisition of Docker Enterprise by Mirantis in late 2019 was widely seen as a signal that Kubernetes had won the container orchestration market. For DevOps teams, this means less time evaluating competing platforms and more time building robust Kubernetes-based workflows.
D. Collin Bachi, a DevOps engineer at Stoplight, summarizes the case for Kubernetes standardization:
“A Kubernetes configuration bundle contains everything needed to deploy, operate, and scale modern containerized applications. It is highly unlikely that any alternative will emerge to replace it.”
D. Collin Bachi, DevOps Engineer, Stoplight
Bachi identifies three factors driving Kubernetes standardization:
- Cloud-agnosticism: Kubernetes runs consistently across AWS, Azure, GCP, and on-premises environments, reducing vendor lock-in.
- Template-friendliness: Helm charts and other templating tools make it easier to codify and share deployment patterns.
- Ecosystem growth: A rapidly expanding set of integrations, operators, and community-backed tools reinforces Kubernetes as the default platform.
For teams still evaluating alternatives, the practical implication is clear: investing deeply in Kubernetes expertise and tooling is a safe long-term bet.
3. A Shift from Reliability to Resilience Engineering
Site Reliability Engineering (SRE) matured significantly as a discipline, but some analysts believe the field is about to evolve further. Charles Betz, Principal Analyst at Forrester Research, predicts a shift in focus from reliability—preventing failures—to resilience—recovering from them faster:
“Beyond site reliability engineering and chaos engineering lies resilience engineering. Resilience engineering combines academic disciplines from industrial engineering to human factors to cognitive psychology and beyond, but it’s no ivory tower.”
Charles Betz, Principal Analyst, Forrester Research
The philosophical underpinning is significant: resilience engineering accepts that failure is inevitable in complex systems. Rather than spending unlimited resources trying to prevent every failure mode, teams instead optimize for mean time to recovery (MTTR)—shortening the window between incident and resolution.
Betz predicted that this shift would help operations teams cut time spent on unplanned work by as much as 20%. Practically, this means investing in better observability, runbooks, automated remediation, and blameless post-mortems—all of which contribute to shorter recovery times rather than purely preventative controls.
4. Continuous Governance and Compliance
Traditional plan/build/run operating models rely on stage gates—manual checkpoints where governance and compliance are verified before moving to the next phase. As DevOps accelerates delivery, those gates become bottlenecks. The emerging answer is continuous governance: embedding policy enforcement directly into automated pipelines.
Forrester’s Betz describes a world where automated platforms subsume much of the governance burden through templated environments that are automatically monitored for policy drift. Tim Hinrichs, CTO and co-founder of Styra, frames the problem clearly:
“The whole microservices world is about delivering apps faster, but right now the growing gap between DevOps’ new ‘everything-as-code’ approach and security/compliance teams causes significant delays when moving into production.”
Tim Hinrichs, CTO and Co-founder, Styra
The solution gaining traction is compliance as code—encoding security and audit requirements into scripts, playbooks, and pipeline checks so that compliance is verified continuously rather than manually at audit time. Dave Klein, Senior Director of Architecture and Engineering at Guardicore, notes that developers are taking on more of this responsibility:
- Embedding kernel, distribution, and application patching checks into automated workflows.
- Using ID labels and tags for granular application tracking, complementing traditional CMDB-based asset management.
- Integrating policy-as-code tools (such as Open Policy Agent) into CI/CD pipelines to catch violations before they reach production.
The practical outcome: auditors can query automated reports rather than requiring developers to manually walk them through containerized environments—saving time on both sides.
5. Security Champion Programs as the Bedrock of DevSecOps
Shifting security left—integrating it earlier in the development lifecycle—is well-established advice. The challenge is executing it at scale across large engineering organizations. One of the most effective tactics emerging in practice is the security champion program: embedding security-minded developers within product teams to act as a bridge between engineering and security.
These programs typically combine:
- Formalized security training tailored to developers
- Gamified skills progression and achievement levels
- Hackathons focused on identifying and fixing vulnerabilities
- Paired coding sessions where developers and security professionals work side by side
Klein describes one particularly effective approach observed at a large national insurance company:
“The most novel thing I’ve observed this year at a large national insurance company, both profound and simple, was a series of training sessions where application developers and security professionals were paired up to better understand each others’ roles.”
Dave Klein, Senior Director of Architecture and Engineering, Guardicore
In these paired sessions, developers coded while security professionals observed and commented on security hygiene in real time. The learning ran both ways: security experts deepened their understanding of modern coding practices, while developers internalized security thinking. Klein argues this mutual understanding is the foundation of genuine DevSecOps adoption.
Organizations including Comcast and Target have used similar approaches to build security champion programs at scale. Australian telecommunications company Telstra reported a 20–30% improvement in secure coding skills among its developers after implementing such a program, according to Suzanne Dyke, Senior DevOps Security Specialist at Telstra, speaking at the AllDayDevOps conference:
“When I’ve spoken to developers, they’ve told me that, before the program, they didn’t really think about security while they were delivering software, but now they do.”
Suzanne Dyke, Senior DevOps Security Specialist, Telstra
Dyke emphasizes that the biggest win is cultural: security champion programs bridge the gap between development and security teams, replacing adversarial dynamics with collaborative ones.
What These Trends Mean for Your Team
The common thread running through all five trends is maturation without stagnation. As DevOps becomes the default mode of software delivery, the differentiator shifts from simply having a DevOps practice to operating one that is customer-aligned, secure by design, resilient under failure, and continuously compliant.
For teams at any stage of the DevOps journey, the practical takeaways are:
- Close the loop with customers. Instrument your applications to capture real user behavior and feed that signal back into your development priorities.
- Standardize on Kubernetes. Reduce platform decision fatigue and invest in Kubernetes expertise, tooling, and governance.
- Design for recovery, not just reliability. Measure MTTR alongside availability, and run chaos engineering exercises to validate your recovery playbooks.
- Encode your policies. Move security and compliance checks into your pipelines so that governance happens continuously rather than at audit time.
- Build security champions. Invest in paired learning programs that build security fluency across your engineering organization, not just within a dedicated security team.
Technology will continue to evolve rapidly, but teams that build these practices into their culture will be better positioned to adapt—regardless of what the next wave of tooling looks like.