This article is based on reporting originally published by IT World Canada in January 2017, drawing on the F5 Networks 2017 State of the Application Delivery Report and CIO roundtables hosted in Toronto and Vancouver.
Security Overtakes Speed as DevOps Teams’ Primary Concern
For years, the dominant narrative around DevOps was velocity — ship faster, automate more, break down silos between development and operations. But heading into 2017, a different theme was pushing to the front: security.
According to the 2017 State of the Application Delivery Report by F5 Networks, security ranked as the number one priority among roughly 2,000 IT, networking, application, and security professionals surveyed worldwide. The shift was significant: organizations were no longer treating security as a downstream concern but recognising it as a foundational requirement that had to be addressed throughout the software delivery lifecycle.
“Security teams are expanding beyond traditional firewalls and the legacy enterprise perimeter as a response to hackers increasingly targeting the application.”
— F5 Networks, 2017 State of the Application Delivery Report
The Top Security Measures DevOps Teams Were Planning
The F5 survey identified the top three security investments that IT professionals planned to prioritise in 2017:
- DNSSEC protection — cited by 25% of respondents
- DDoS mitigation — cited by 21%
- Web Application Firewall (WAF) services — cited by 20%
The prominence of application-layer defences — WAF and DNSSEC — reflected a broader industry recognition that perimeter-based security was no longer sufficient. Attackers had shifted their focus from network infrastructure to application vulnerabilities, and defensive strategies had to follow.
Intent vs. Execution: The Security Gap in DevOps
Despite security being front-of-mind, the gap between stated intentions and actual practice was stark. HPE’s Application Security and DevOps Report, released in late 2016, found that:
- Only 20% of DevOps teams performed application security testing during the development phase.
- 17% of teams were not using any security technologies at all to protect their applications.
Serge Bertini, then Vice-President and General Manager of Canada for HPE, addressed this disconnect directly at the Toronto CIO roundtable. He described security in DevOps as an afterthought, with few teams embedding security checks into their code review and development lifecycle processes.
“Security in DevOps is an afterthought. Few people are starting to build this sort of ‘check in, check out’ of code as part of their development lifecycle.”
— Serge Bertini, HPE Canada
The Cost of Late-Stage Security Reviews
One of the clearest arguments for shifting security left — integrating it earlier in the development pipeline — is the cost of finding vulnerabilities late. Bertini put it plainly at the Toronto roundtable:
“It’s costly to wait until the end when my application is done to check it. If I have to delay my release by four to six weeks, that’s very costly.”
— Serge Bertini, HPE Canada
Jim Love, CIO of IT World Canada and roundtable moderator, reinforced the point:
“We know this ‘inspect at the end’ approach doesn’t work. We just have to fix it.”
— Jim Love, IT World Canada
This principle — often described today as “shift left” security — calls for integrating security testing, code scanning, and threat modelling into the earliest stages of development rather than treating security review as a gate at the end of the release process.
Challenges Roundtable Participants Identified
Senior Canadian IT managers at the Toronto and Vancouver roundtables — hosted by IT World Canada and sponsored by HP Enterprise — surfaced several real-world obstacles that complicated DevOps security even for organisations actively trying to address it.
1. Security Erodes After Initial Design
An IT manager from a utility services firm noted that even when security is built into an application’s design upfront, maintaining that posture throughout development is difficult. Changes accumulate mid-cycle, and the original security assumptions can quietly become invalid by the time the application ships.
2. Third-Party and Outsourcing Risk
An infosec director from a telecom services company at the Vancouver roundtable expressed concern about cloud infrastructure providers and how they manage their own infrastructure security. A participant from a large consulting firm noted that outsourcing development work to offshore teams introduces additional security governance challenges.
3. Organisational Silos Within DevOps
A participant from the financial payments sector described the coordination challenge when multiple departments operate independently within what is nominally a single DevOps practice: “DevOps with 10 different departments doing 10 different things, it’s hard.”
Bridging the Developer–Security Divide
Several roundtable participants pointed to communication and skill overlap as practical solutions to the developer–security divide.
- Soft skills for security professionals: Infosec practitioners need to communicate findings and requirements in language that business units can understand, not just technical jargon.
- Code literacy for security teams: One participant suggested that security professionals who can read and write code are better positioned to work alongside developers and catch vulnerabilities in context, rather than reviewing applications as a black box after delivery.
- Blurring organisational lines: Bertini summarised the broader structural challenge — “it seems like there’s the security team and the applications team and we’ve got to blur those lines” — an observation that anticipated the DevSecOps movement that would gain momentum in subsequent years.
Why This Still Matters
The challenges identified in 2017 did not disappear. The core tension between development velocity and security rigour remains an active problem in DevOps and platform engineering organisations. The specific solutions that emerged from this period — DevSecOps practices, automated security scanning in CI/CD pipelines, infrastructure-as-code security linting, and developer security training — are all direct responses to the gaps these surveys and roundtables made visible.
Understanding the documented state of DevOps security at this inflection point helps teams appreciate why practices like shift-left testing, SAST/DAST integration, and security champions programmes were developed — and why they continue to be necessary.
Source: IT World Canada. Original reporting based on the F5 Networks 2017 State of the Application Delivery Report and HPE Application Security and DevOps Report (2016).