12 DevSecOps Trends to Watch Right Now - Part 1
August 05, 2021

Jayne Groll
DevOps Institute

Baking security into your software and apps from the beginning is more important than ever. Without security, your development lifecycle is open to bugs and vulnerabilities putting your organization and customers at risk. DevSecOps is an augmentation of DevOps, allowing for security practices to be integrated into the DevOps approach. This approach shifts security to the left ensuring that security is implemented in the beginning of the development lifecycle.

While DevSecOps practices are still evolving, there are many trends to keep an eye on. I asked several speakers and sponsors for the upcoming SKILup Day(link is external) as well as several DevOps Institute Ambassadors to weigh in on the hottest DevSecOps trends. Here's what they shared:

Sponsor, Kendall Miller(link is external)
President, Fairwinds

The answer is in the question itself, the merging of security into DevOps, when historically it's been a separate practice. Now people are realizing that separating security is a mistake — it all needs to be paired together out of the gate. In the same way that the merging of dev and ops requires great tooling but leads to organizational change and efficiency gains, the addition of security also requires great tooling … but leads to incredible organizational change. So the trend is the merging itself and the tools that make the merge possible. It's really hard to bolt security on afterwards, and as the world increasingly adopts tools like Kubernetes, service ownership is increasingly common, and it must include security from the get-go.

Sponsor, Guy Eisenkot(link is external)
VP of Product, Bridgecrew by Prisma Cloud

One of the biggest DevSecOps trends is shifting anything, and everything left. To make it easier, faster, and cheaper to address vulnerabilities and misconfigurations, security and compliance teams are looking for ways to collaborate with DevOps and engineering to embed guardrails earlier in the DevOps lifecycle. Whether that's in the IDE or part of build pipelines, getting early feedback helps minimize context-switching for engineers, saves DevOps time prioritizing fixes for issues found in runtime, and reduces risk.

The key for this to be successful, however, is to strike a healthy balance between enforcing security policies and moving fast. If security feedback becomes too noisy, engineers will ignore it, and if it becomes a blocker, they'll find a way around it. Either way, friction will ensue, and you'll end up having to scale back your DevSecOps efforts.

Sponsor, Rob Cuddy(link is external)
Global Application Security Evangelist, HCL Software DevOps

The top trend is getting developers more involved in threat modeling activities and collaborating on them with security professionals. In 2019 Puppet Labs identified this as the #1 practice for having an impact and improving security posture. (page 35 of the 2019 State of DevOps Report)

Sponsor, Yasser Fuentes(link is external)
Cloud Workload Security Technical Product Manager, Bitdefender

Security must now keep up with DevOps and the software delivery lifecycle and cadence acceleration. As a result, key areas such as Compliance, Vulnerability Management, Identity Access Management, Encryption and overall built-in security have to move at this same very high speed, otherwise non-secure code would end up deeming their software as unusable and off-market. One of the most feasible solutions (at least at a glance) for CISOs has been the adoption of the shared-ownership model of security, which facilitates application component owners to detect and fix their own related vulnerabilities. The same is true as per software intended to be sold to and used by the US Government - requirements oblige software companies to report, mitigate and fix any related vulnerabilities. However, the reality is that this is not and won't be by any means even close to 50 percent of what's required in order to ensure that the application is secure.

Sponsor, Joni Klippert(link is external)
Co-Founder and CEO, StackHawk

The number of API-related security incidents is on the rise with Peloton, Coursera, and the latest Experian breach being recent examples from the last 12 months. And API security risk is going to get worse – Gartner cites that by 2022, API abuses will be the attack vector most responsible for data breaches.

Leading DevSecOps teams are beginning to awaken to the threat of API security, and updating their programs accordingly. Teams are proactively implementing processes to manage core API security principles like access control, rate limiting, data exposure testing, and vulnerability testing, in CI/CD to find issues before they are released to prod.

Like application security, API security doesn't have a silver bullet. DevSecOps teams need to implement the right tools from the planning stages of development to make sure their APIs are protected.

Stephen Walters(link is external)
Sales Engineer, Everbridge

In my opinion, the top trend in DevSecOps right now is organizations and groups trying to understand exactly what it means to them. Just as we had many years of people asking the question, "What is DevOps?" before finally realizing that there is not an all conclusive answer, but merely a base construct and an ideology, so we are seeing the same happen with DevSecOps. Yes, this time we have a slight jump on that, but the greatest challenge now, as then, is the cultural change that many traditional operators are having to face in the way they conduct their roles in day-to-day security.

For example, in traditional models, security has operated, or been made to operate, in a way that reflects its culture - closed, secretive and isolated from other functions - the greatest silo of siloes. That has to change in a DevSecOps culture, where security must be open, integrated and part of the enterprise ecosystem. That is a seismic change for many and it requires a lot of effort upfront from all parties.

Learn more about DevSecOps and similar topics, by registering for an upcoming SKILup Day(link is external). Or, start your upskilling journey by learning more about the benefits of DevOps Institute membership(link is external).

Go to 12 DevSecOps Trends to Watch Right Now - Part 2, providing even more expert opinions on DevSecOps.

Jayne Groll is CEO of DevOps Institute
Share this

Industry News

May 20, 2025

Google unveiled a significant wave of advancements designed to supercharge how developers build and scale AI applications – from early-stage experimentation right through to large-scale deployment.

May 20, 2025

Red Hat announced Red Hat Advanced Developer Suite, a new addition to Red Hat OpenShift, the hybrid cloud application platform powered by Kubernetes, designed to improve developer productivity and application security with enhancements to speed the adoption of Red Hat AI technologies.

May 20, 2025

Perforce Software announced Perforce Intelligence, a blueprint to embed AI across its product lines and connect its AI with platforms and tools across the DevOps lifecycle.

May 20, 2025

CloudBees announced CloudBees Unify, a strategic leap forward in how enterprises manage software delivery at scale, shifting from offering standalone DevOps tools to delivering a comprehensive, modular solution for today’s most complex, hybrid software environments.

May 20, 2025

Azul and JetBrains announced a strategic technical collaboration to enhance the runtime performance and scalability of web and server-side Kotlin applications.

May 19, 2025

Docker, Inc.® announced Docker Hardened Images (DHI), a curated catalog of security-hardened, enterprise-grade container images designed to meet today’s toughest software supply chain challenges.

May 19, 2025

GitHub announced that GitHub Copilot now includes an asynchronous coding agent, embedded directly in GitHub and accessible from VS Code—creating a powerful Agentic DevOps loop across coding environments.

May 19, 2025

Red Hat announced its integration with the newly announced NVIDIA Enterprise AI Factory validated design, helping to power a new wave of agentic AI innovation.

May 19, 2025

JFrog announced the integration of its foundational DevSecOps tools with the NVIDIA Enterprise AI Factory validated design.

May 15, 2025

GitLab announced the launch of GitLab 18, including AI capabilities natively integrated into the platform and major new innovations across core DevOps, and security and compliance workflows that are available now, with further enhancements planned throughout the year.

May 15, 2025

Perforce Software is partnering with Siemens Digital Industries Software to transform how smart, connected products are designed and developed.

May 15, 2025

Reply launched Silicon Shoring, a new software delivery model powered by Artificial Intelligence.

May 15, 2025

CIQ announced the tech preview launch of Rocky Linux from CIQ for AI (RLC-AI), an operating system engineered and optimized for artificial intelligence workloads.

May 14, 2025

The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the launch of the Cybersecurity Skills Framework, a global reference guide that helps organizations identify and address critical cybersecurity competencies across a broad range of IT job families; extending beyond cybersecurity specialists.

May 14, 2025

CodeRabbit is now available on the Visual Studio Code editor.

The integration brings CodeRabbit’s AI code reviews directly into Cursor, Windsurf, and VS Code at the earliest stages of software development—inside the code editor itself—at no cost to the developers.