This article draws on findings originally reported by HelpNetSecurity.com, sourced from the 2019 Accelerate State of DevOps Report by DORA and Google Cloud.
Open Source Adoption Is Now a Competitive Differentiator
The 2019 Accelerate State of DevOps Report, produced by DevOps Research and Assessment (DORA) in partnership with Google Cloud, identified a clear pattern: elite and high-performing DevOps teams rely heavily on open source software, while the strongest concentration of fully proprietary software is found in low performers.
Among the headline findings: elite performers—the highest-performing cohort—nearly tripled in proportion year-over-year, and this group was approximately 1.75 times more likely to make extensive use of open source software compared to low performers. High performers were also 1.5 times more likely to plan further expansion of their open source usage.
These numbers signal something important: open source adoption is not just a cost-cutting measure. For top teams, it is a deliberate, strategic decision that directly correlates with delivery performance.
Why Proprietary Software Holds Teams Back
Dr. Nicole Forsgren, lead research scientist for the 2019 Accelerate State of DevOps Report, offered a pointed analysis of what the data shows about proprietary software:
“Proprietary software may be valuable, but it comes at great cost to maintain and support. It’s no surprise that the highest performers have moved away from this model. Companies should be thoughtful about which software provides strategic value to organizations, and which is merely utility. By addressing their utility needs with COTS solutions and minimizing customization, high performers save their resources for strategic software development efforts.”
Dr. Nicole Forsgren, Lead Research Scientist, 2019 Accelerate State of DevOps Report
The practical implication: organizations should audit their software stack and categorize tools as either strategic (worth building and customizing) or utility (best handled by commodity or open source solutions). Over-investing in proprietary customization for utility software drains engineering capacity that could drive competitive advantage.
Key Benefits of Open Source in a DevOps Context
- Faster time to delivery: Open source libraries, frameworks, and tools give teams a proven foundation to build on, reducing the time spent solving already-solved problems.
- Community-driven innovation: Bugs are found and fixed faster; new features emerge from a global contributor base rather than a single vendor’s roadmap.
- Customizability: Access to source code allows organizations to adapt software to specific business requirements without waiting for a vendor release cycle.
- Talent and recruiting: Engineers are drawn to shops that use technologies they know and can showcase publicly.
- Security transparency: Visible source code enables community auditing, though this benefit requires active governance of dependencies.
Sacha Labourey, CEO of CloudBees, summarized the compounding nature of these benefits:
“Open source provides a jumpstart in developing applications and accelerating time to delivery. It also enables organizations to benefit from the innovation of a larger community, as well as contribute their own innovation back to the community. Everyone benefits.”
Sacha Labourey, CEO, CloudBees
Adoption Beyond Tech: Financial Services as a Case Study
One of the more telling signals in the 2019 report is that open source adoption is accelerating even in highly regulated industries. Financial services firms—historically among the most cautious technology adopters due to compliance, audit, and risk requirements—are increasingly treating open source as an enabler rather than a liability.
Dinesh Keswani, CTO of Shared Services at HSBC, described the shift in thinking:
“Financial services organizations like ours see open source and the cloud as strategic opportunities to embrace, rather than a risk to shy away from. The use of open platforms for our DevOps teams enables us to innovate on new applications, especially in the banking retail space, and rearchitect legacy applications to be more agile in the cloud. Creating new services that can be deployed on demand and easily updated are less of a risk than maintaining monolithic applications that can’t be changed.”
Dinesh Keswani, CTO Shared Services, HSBC
This reframing—from “open source is risky” to “unmaintainable monoliths are riskier”—reflects a maturing understanding of operational risk in enterprise IT.
Open Source Governance: The Caveat Teams Cannot Ignore
Enthusiasm for open source must be paired with disciplined dependency management. Derek Weeks, VP and DevOps advocate at Sonatype, flagged a critical operational concern:
“All companies are now software companies. In the race to out-innovate competitors they’ve put open source software at the core of their digital transformations as the only way to truly keep up in today’s world. But, open source doesn’t come without the need to consider quality across suppliers. As the need for open source in the enterprise grows, companies must understand what open source they’re using and where it is being used.”
Derek Weeks, VP and DevOps Advocate, Sonatype
In practice, this means maintaining a software bill of materials (SBOM), scanning dependencies for known vulnerabilities, and establishing policies for how quickly critical patches must be applied. Tools such as dependency auditing utilities integrated directly into CI/CD pipelines have become a standard part of high-maturity DevOps workflows.
Open Source and Multi-Cloud Architectures
The move toward open source is closely tied to the rise of multi-cloud strategies. John Coyle, VP of Business and Corporate Development at Sumo Logic, pointed to Kubernetes as the most visible example of this convergence:
“In an effort to address and overcome complexities, we are seeing a dramatic shift in the future of the modern application stack as companies look to multi-cloud and open source technologies, like Kubernetes. Open source empowers our customers to scale and build at the rate they need, with the support of the community as opposed to a siloed approach that limits the growth that could be achieved otherwise.”
John Coyle, VP Business and Corporate Development, Sumo Logic
Kubernetes—itself a CNCF open source project—has become the de facto orchestration layer for containerized workloads across cloud providers. Its adoption illustrates how open source projects, when backed by large communities and vendor-neutral governance, can become critical infrastructure rather than experimental tooling.
Practical Takeaways for DevOps Teams
- Audit your proprietary dependencies. Identify which proprietary tools deliver genuine strategic value versus those serving commodity functions that open alternatives could cover at lower total cost.
- Invest in open source governance. Adopt SBOM practices and integrate dependency scanning into your CI/CD pipeline before open source sprawl makes this unmanageable.
- Contribute upstream where possible. Teams that contribute back to the open source projects they depend on gain influence over project direction and build engineering reputation.
- Treat open source adoption as a team capability. The DORA data suggests open source usage is correlated with high performance, but causation likely runs through the broader engineering culture that chooses and governs these tools effectively.
- Re-evaluate “regulated industry” assumptions. If HSBC is running DevOps on open platforms, the compliance argument against open source deserves fresh scrutiny in your own organization.
The 2019 Accelerate State of DevOps data makes a compelling case: high-performing teams treat open source not as a cost measure but as a strategic capability. The question for most organizations is no longer whether to use open source in DevOps workflows—it is how to govern and extend that usage responsibly.