Over 90% of Technical Decision Makers Say Policy as Code Is a Vital, Strategic Priority to Replace Homegrown Authorization
March 05, 2024

Christopher Hendrix

Modernizing access control and authorization is one of the next big frontiers for the software industry. Policy as code is being explored by the industry as an alternative or expansion upon the long-term standards of role-based access control and entitlements. With policy as code, policies can be managed and automated using code written in a high-level language. It is a programmatic method of uniformly defining and enforcing policies throughout cloud native applications and their infrastructure. Below is a summary of some of the key findings from Styra’s 2023 State of Policy as Code Report.

Homegrown Authorization Is Insufficient and Policy as Code Is Vital

86% face challenges with implementing authorization. The biggest challenges were:

■ Lack of alignment between teams (e.g., different or individualized approaches to authorization, 34%)

■ Lack of visibility into … implementation, enforcement, monitoring, and reporting (31%)

■ Lack of consistent or centralized policy development and management lifecycle; difficulty meeting security, compliance, or auditability requirements (29%)

61% agree homegrown authorization is inefficient and wastes the developer’s time.

Many agree that policy as code is a vital component of preventive security and compliance at scale (94%), speeds up time to market (96%), and makes work easier for developers (91%).

Policy as Code Is Expanding with Open Policy Agent Leading the Way

55% write and enforce policy as code to manage authorization in their day-to-day work, while only 41% are using homegrown authorization solutions. Even still, it’s a relatively new adoption, with 51% having only adopted policy as code in the past two years.

The growth of policy as code was made possible by open source tools such as the Open Policy Agent (OPA), with 46% of those who use policy as code relying on OPA in some form, more than triple the usage of the next leading technology.

Organizations Are Trying to Scale Policy as Code Adoption

Even for those organizations who have adopted policy as code, they are still working to scale their usage:

■ More teams

■ More infrastructure — currently, 66% use it for AWS CloudFormation checks, 60% for HashiCorp Terraform checks, 45% for infrastructure compliance monitoring

■ More applications — currently, 55% are securing API gateways, 52% implement role-based access control (RBAC), 46% implement attribute-based access control (ABAC)

■ More production and mission-critical systems — currently, only 30% are using for most or all non-mission and mission-critical systems, with 57% in a more limited capacity and 9% exploring but have not yet deployed in production

83% of organizations plan to invest somewhat or significantly more in policy as code.

High-revenue organizations show a more sophisticated, mature approach to policy as code compared to lower-grossing companies. Organizations that make $500 million or less in revenue are most likely to use policy as code in production, but only with limited non-mission critical systems. On the flip side, organizations making $501 million or more are most likely to use policy as code in a significant capacity, with both non-mission and mission-critical systems.

Organizations Need Help with Their Policy as Code Adoption

94% of organizations view policy as code as a strategic priority. However, adopting policy as code is complex — socially and technically.

The biggest social barriers include the complexity of digital transformation projects (28%), organizational resistance to change (27%), and a lack of awareness of policy as code (26%).

The biggest technical barriers include writing efficient policies as code (27%), and data fetch latency (26%)

The expansion and growing maturity of Policy as Code points to significant tailwinds for modernizing and transforming current authorization approaches. Policy as Code enables organizations to reify their current access control models as code — role-based, attribute-based, entitlements, and relationship-based — while setting them up to develop more mature policies using more fine-grained rules and contextual data. The findings from Styra’s State of Policy as Code Report show that we can expect to see an acceleration of this modernization transformation.

Christopher Hendrix is a Director of Product Management at Styra
Share this

Industry News

April 11, 2024

Check Point® Software Technologies Ltd. announced new email security features that enhance its Check Point Harmony Email & Collaboration portfolio: Patented unified quarantine, DMARC monitoring, archiving, and Smart Banners.

April 11, 2024

Automation Anywhere announced an expanded partnership with Google Cloud to leverage the combined power of generative AI and its own specialized, generative AI automation models to give companies a powerful solution to optimize and transform their business.

April 11, 2024

Jetic announced the release of Jetlets, a low-code and no-code block template, that allows users to easily build any technically advanced integration use case, typically not covered by alternative integration platforms.

April 10, 2024

Progress announced new powerful capabilities and enhancements in the latest release of Progress® Sitefinity®.

April 10, 2024

Buildkite signed a multi-year strategic collaboration agreement (SCA) with Amazon Web Services (AWS), the world's most comprehensive and broadly adopted cloud, to accelerate delivery of cloud-native applications across multiple industries, including digital native, financial services, retail or any enterprise undergoing digital transformation.

April 10, 2024

AppViewX announced new functionality in the AppViewX CERT+ certificate lifecycle management automation product that helps organizations prepare for Google’s proposed 90-day TLS certificate validity policy.

April 09, 2024

Rocket Software is addressing the growing demand for integrated security, compliance, and automation in software development with its latest release of Rocket® DevOps, formerly known as Aldon®.

April 09, 2024

Wind River announced the latest release of Wind River Studio Developer, an edge-to-cloud DevSecOps platform that accelerates development, deployment, and operation of mission-critical systems.

April 09, 2024

appCD announced its generative infrastructure from code solution now supports Azure Kubernetes Service (AKS).

April 09, 2024

Synopsys announced the availability of Black Duck® Supply Chain Edition, a new software composition analysis (SCA) offering that enables organizations to mitigate upstream risk in their software supply chains.

April 09, 2024

DataStax announced innovative integrations with API extensions to Google Cloud’s Vertex AI Extension and Vertex AI Search, offering developers an easier time leveraging their own data.

April 08, 2024

Parasoft introduced C/C++test CT, a comprehensive solution tailored for large teams engaged in the development of safety- and security-critical C and C++ products.

April 08, 2024

Endor Labs announced a strategic partnership with GuidePoint Security.

April 08, 2024

Hasura announced the V3 of its platform, providing on-demand API composability with a new domain-centric supergraph modeling framework, a distributed supergraph execution engine and a rich and extensible ecosystem of open source connectors to address the challenges faced during integration of data and APIs.

April 04, 2024

DataStax has entered into a definitive agreement to acquire AI startup, Logspace, the creators of Langflow, an open source visual framework for building retrieval-augmented generation (RAG) applications.1