The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, and Synadia announced that the NATS project will continue to thrive in the cloud native open source ecosystem of the CNCF with Synadia’s continued support and involvement.
DEVOPSdigest asked experts from across the IT industry for their opinions on what steps in the SDLC should be automated. Part 2 covers the coding process.
Start with Steps You Should Be Automating in the SDLC - Part 1
CODING
Companies should automate development as much as possible without compromising security. Key to this is reducing the amount of manual coding through low-code platforms, or eliminating it entirely with a no-code system.
Colin Earl
CEO, Agiloft(link is external)
Automation has permeated many aspects of the software development life cycle. You need infrastructure? Operating systems? Applications? No problem — all it takes is the click of a button. Testing? Deployment? Monitoring? Plenty of automation going on there also. But what about that large bit in the middle — the development. Most organizations still write code by hand and this is biggest opportunity when we're talking about automation. Low-code or high-productivity platforms help organizations bring automation to this, the most significant part of the SDLC, through a visual assembly approach to development. This isn't about replacing developers. This is automation to empower developers to do more — to focus on delivering business value instead of the syntax of a language that, in a few years, will probably be considered "legacy technology."
Mike Hughes
Principal Platform Evangelist, OutSystems(link is external)
CODE CHECK IN AND CHECK OUT
As part of your DevOps process, an area that would benefit from automation: Code check in and check out process to eliminate circumventing critical tests and steps in the CICD pipeline.
Jeanne Morain
Author and Strategist, iSpeak Cloud(link is external)
FIXING ERRORS
The bureaucratic toil associated with large-scale software efforts should be fully automated. Adherence to policy and governance practices is important for scaling software development, but it often results in a lot of toil for human developers. This toil — fixing small errors detected by linters, almost-but-not-quite adhering to the style guide — is the kind of thing that is tedious to do manually. It adds friction to development, which slows things down. It's important, but not urgent, so it tends to get put off unless you have super-human levels of discipline.We have robots to vacuum the lint off our floors, so why not do the same thing with the codebase? Automated repairs of common errors are like Roombas for code: they keep things clean so developers are free to work on other, more interesting, tasks.
Ryan Day
Co-Founder and COO, Atomist(link is external)
THE BUILD
The most straightforward and valuable area to automate is the build, deploy. These tasks provide the greatest opportunity to remove waste and also highlight potential friction points when deploying into production. Removing people from these activities not only increases quality but improves the architecture by shining a spotlight on the way in which the software is constructed. Great way to test this automation is to get EVERYONE in the team to do the build and NOT leave it to a single person, or small group. That would ensure that the kick off process is simple, documented and with luck transparent to everyone.
Dave West
CEO and Product Owner, Scrum.org(link is external)
DevOps groups should seek to automate processes that eliminate "spaghetti code" that agile programming is supposed to address in the code-building practice itself. Lack of standardized workflows can slow down the overall development process with bad check-ins, integration errors and Q/A out of sync with production. To begin with, they should automate the multitude of objects, packages and pieces of code that need to stay working together.
Steve Garrison
VP Marketing, ZeroStack(link is external)
API MANAGEMENT
Automating the API management process will help developers increase their velocity of pushing out new API releases as well as streamline access to partner API clients. Developers should look to API automation for creating or importing their own API definitions when rapid releases are demanded. Developers should choose an API gateway that can effortlessly scale with their business needs as well snap into their existing DevOps workflow.
Nick Tran
VP, Developer Relations, Akamai(link is external)
When an API signature changes, or an API version is retired, the application could become unstable or lose functionality. Implementing automated identification of API dependencies and monitoring for changes in signature and availability help insulate from API contract issues. When coupled with an understanding of data flowing to and from the API, supporting increasingly complex data management and privacy regulations becomes simpler.
Tim Mackey
Technology Evangelist, Synopsys(link is external)
APPLICATION WORKFLOW
Companies should automate testing of workflows, making sure these processes function properly and nothing is broken or missed when the code comes together.
Anand Subramanian
SVP of Delivery, Ness(link is external)
One area getting more focus from DevOps teams is automating and orchestrating the workflows that actually run the application in the operational stage. Too often application workflow orchestration is still being done right before release to production. This typically causes a fire-drill because the workflows were not tested with the rest of the code through the earlier phases. DevOps teams are now adopting a Jobs-as-Code approach that simply adds application workflow instrumentation as a code artifact with the business logic. This means one complete code set flows through the full CI/CD automation pipeline and is ready for production, with automation and orchestration governance already built it. Avoiding the fire-drill means DevOps teams avoid unplanned rework and deliver the business service into production faster.
Gur Steif
President, Digital Business Automation, BMC Software(link is external)
PROJECT MANAGEMENT
Other non-obvious, but extremely helpful automation can be applied around software project management like automated state transition for tasks on a project board (e.g. move all newly added issues to "To-do" or to move all reopened issues to "In-Progress").
Lee Calcote
Head of Technology Strategy, SolarWinds(link is external)
Read Steps You Should Be Automating in the SDLC - Part 3, covering the development environment and the infrastructure.
Industry News
RapDev announced the launch of Arlo, an AI Agent for ServiceNow designed to transform how enterprises manage operational workflows, risk, and service delivery.
Check Point® Software Technologies Ltd.(link is external) announced that its Quantum Firewall Software R82 — the latest version of Check Point’s core network security software delivering advanced threat prevention and scalable policy management — has received Common Criteria EAL4+ certification, further reinforcing its position as a trusted security foundation for critical infrastructure, government, and defense organizations worldwide.
Postman announced full support for the Model Context Protocol (MCP), helping users build better AI Agents, faster.
Opsera announced new Advanced Security Dashboard capabilities available as an extension of Opsera's Unified Insights for GitHub Copilot.
Lineaje launched new capabilities including Lineaje agentic AI-powered self-healing agents that autonomously secure open-source software, source code and containers, Gold Open Source Packages and Gold Open Source Images that enable organizations to source trusted, pre-fixed open-source software, and a software crawling and analysis engine, SCA360, that discovers and contextualizes risks at all software development stages.
Check Point® Software Technologies Ltd.(link is external) launched its inaugural AI Security Report(link is external) at RSA Conference 2025.
Lenses.io announced the release of Lenses 6.0, enabling organizations to modernize applications and systems with real-time data as AI adoption accelerates.
Sonata Software has achieved Amazon Web Services (AWS) DevOps Competency status.
vFunction® announced significant platform advancements that reduce complexity across the architectural spectrum and target the growing disconnect between development speed and architectural integrity.
Sonatype® introduced major enhancements to Repository Firewall that expand proactive malware protection across the enterprise — from developer workstations to the network edge.
Aqua Security introduced Secure AI, full lifecycle security from code to cloud to prompt.
Salt Security announced the launch of the Salt Model Context Protocol (MCP) Server, giving enterprise teams a novel access point of interaction with their API infrastructure, leveraging natural language and artificial intelligence (AI).
The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of in-toto, a software supply chain security framework developed at the NYU Tandon School of Engineering.
SnapLogic announced the launch of its next-generation API management (APIM) solution, helping organizations accelerate their journey to a composable and agentic enterprise.