Few Companies Are Securing Cloud-Native Apps with DevSecOps
October 24, 2019

Only 8 percent of companies are securing 75 percent or more of their cloud-native applications with DevSecOps practices today, with that number jumping to 68 percent of companies securing 75 percent or more of their cloud-native applications with DevSecOps practices in two years, according to a new survey by Enterprise Strategy Group (ESG) and Data Theorem entitled Security for DevOps – Enterprise Survey Report.

The study results also revealed that API-related vulnerabilities are the top threat concern (63 percent of respondents) when it comes to serverless usage within organizations.

“This study reveals that while organizations have started, there is more work to be done when it comes to securing their cloud-native apps with the benefits DevSecOps offers,” said Doug Cahill, Senior Analyst and Group Practice Director of Cybersecurity for ESG. “Fundamental changes to application architectures and the infrastructure platforms that host them are antiquating existing cybersecurity technologies and challenging traditional approaches to protecting business-critical workloads. Organizations should consider newer approaches to securing their cloud-native apps, particularly solutions that address API-related vulnerabilities, which tops respondents’ minds when identifying their top threat concern.”

Additional key findings of the study include:

■ API security was the top area reported for current or projected incremental spend; and API security was reported as most important by respondents among the cloud-native application security controls, at 37 percent.

■ 82 percent of surveyed organizations have different teams assigned to secure cloud-native apps. Of this group, 50 percent of respondents’ organizations plan to merge these responsibilities in the future, while 32 percent of respondents’ organizations do not plan to merge these responsibilities.

■ More than half of respondents indicated their organization’s software developers are already using serverless functions to some extent, with another 44 percent either evaluating or planning to start using serverless within the next two years.

■ When asked what are the most important pre-deployment cloud-native application security controls, software vulnerability scanning of registry-resident container images was the top answer at 26 percent from respondents. The next most important pre-deployment cloud-native application security control was API vulnerability management, at 25 percent.

■ Deployment flexibility and support for all types of servers and compute platforms were the top two answers (both at 38 percent) when indicating the most important attributes of products used to secure cloud-native apps.

“ESG’s industry report is aligned with what we’ve long suspected with organizations, and with what we have witnessed in the industry,” said Doug Dooley, Data Theorem COO. “Production workloads are shifting to public cloud platforms, and organizations are quickly adopting serverless functions. They need to understand the associated risks and new threat model they are facing, and the means of addressing these cloud native and API risks.”


Methodology: ESG completed its research for the report this summer to determine the composition of cloud-native applications, their challenges, and future priorities for securing cloud-native applications. Overall, the study analyzed responses from 371 IT and cybersecurity professionals at organizations in North America responsible for evaluating, purchasing, and managing cloud security technology products and services. These organizations are mature cloud users in terms of public cloud services and/or containers. Survey participants represented a wide range of industries, including manufacturing, financial services, health care, communications and media, retail, government, and business services.

Share this

Industry News

December 02, 2021

Mirantis announced DevOpsCare, powered by Lens, a vendor-agnostic, fully-managed CI/CD (continuous integration/continuous deployment) product for any Kubernetes environment, offering developers higher levels of productivity more quickly.

December 02, 2021

The D2iQ Kubernetes Platform (DKP) is now available in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services, Inc. (AWS).

December 01, 2021

Bugcrowd announced the availability of Bugcrowd's cybersecurity solutions on the AWS Marketplace, providing customers with easy access, simplified billing, quick deployment, and streamlined license management.

December 01, 2021

Kublr received Microsoft Azure Arc-enabled Kubernetes validation, including for Azure Arc-enabled Kubernetes for Data Services.

December 01, 2021

CloudSphere achieved Amazon Web Services (AWS) Migration and Modernization Competency for discovering, planning, and helping enterprise customers move business services to AWS to reduce cost, increase agility and improve security.

November 30, 2021

JFrog introduced a new container registry and package manager for running JFrog Artifactory with Kubernetes clusters on-premises, in the cloud, or both.

November 30, 2021

Docker announced the availability of Docker Official Images directly from Amazon Web Services (AWS).

November 30, 2021

Weaveworks announced the general availability of Weave GitOps Enterprise, a GitOps platform that automates continuous application delivery and Kubernetes operations at any scale.

November 30, 2021

Amazon Web Services announced AWS Mainframe Modernization, a new service that makes it faster and easier for customers to migrate mainframe and legacy workloads to the cloud, and enjoy the superior agility, elasticity, and cost savings of AWS.

November 29, 2021

Quali announced the newest release of Torque Enterprise, which includes enhanced integration with Terraform, new custom tagging capabilities, and improved cost visibility dashboards, unleashing an entirely new level of self-service access to application environments on demand.

November 29, 2021

Vertical Relevance (VR), a financial services-focused consulting firm, achieved Amazon Web Services (AWS) DevOps Competency status.

November 18, 2021

Loft Labs announced the launch of Loft version 2 with a focus on ease of use that overcomes the major complaint that Kubernetes is complex and hard to set up.

November 18, 2021

Perforce Software announced new functionality to speed remediation of discovered defects in automated scans.

November 18, 2021

Lacework raised $1.3 billion in growth funding at a valuation of $8.3 billion.

November 17, 2021

Parasoft announced the 2021.2 release of Parasoft C/C++test, the unified C and C++ development testing solution for embedded applications.