Few Companies Are Securing Cloud-Native Apps with DevSecOps
October 24, 2019

Only 8 percent of companies are securing 75 percent or more of their cloud-native applications with DevSecOps practices today, with that number jumping to 68 percent of companies securing 75 percent or more of their cloud-native applications with DevSecOps practices in two years, according to a new survey by Enterprise Strategy Group (ESG) and Data Theorem entitled Security for DevOps – Enterprise Survey Report.

The study results also revealed that API-related vulnerabilities are the top threat concern (63 percent of respondents) when it comes to serverless usage within organizations.

“This study reveals that while organizations have started, there is more work to be done when it comes to securing their cloud-native apps with the benefits DevSecOps offers,” said Doug Cahill, Senior Analyst and Group Practice Director of Cybersecurity for ESG. “Fundamental changes to application architectures and the infrastructure platforms that host them are antiquating existing cybersecurity technologies and challenging traditional approaches to protecting business-critical workloads. Organizations should consider newer approaches to securing their cloud-native apps, particularly solutions that address API-related vulnerabilities, which tops respondents’ minds when identifying their top threat concern.”

Additional key findings of the study include:

■ API security was the top area reported for current or projected incremental spend; and API security was reported as most important by respondents among the cloud-native application security controls, at 37 percent.

■ 82 percent of surveyed organizations have different teams assigned to secure cloud-native apps. Of this group, 50 percent of respondents’ organizations plan to merge these responsibilities in the future, while 32 percent of respondents’ organizations do not plan to merge these responsibilities.

■ More than half of respondents indicated their organization’s software developers are already using serverless functions to some extent, with another 44 percent either evaluating or planning to start using serverless within the next two years.

■ When asked what are the most important pre-deployment cloud-native application security controls, software vulnerability scanning of registry-resident container images was the top answer at 26 percent from respondents. The next most important pre-deployment cloud-native application security control was API vulnerability management, at 25 percent.

■ Deployment flexibility and support for all types of servers and compute platforms were the top two answers (both at 38 percent) when indicating the most important attributes of products used to secure cloud-native apps.

“ESG’s industry report is aligned with what we’ve long suspected with organizations, and with what we have witnessed in the industry,” said Doug Dooley, Data Theorem COO. “Production workloads are shifting to public cloud platforms, and organizations are quickly adopting serverless functions. They need to understand the associated risks and new threat model they are facing, and the means of addressing these cloud native and API risks.”


Methodology: ESG completed its research for the report this summer to determine the composition of cloud-native applications, their challenges, and future priorities for securing cloud-native applications. Overall, the study analyzed responses from 371 IT and cybersecurity professionals at organizations in North America responsible for evaluating, purchasing, and managing cloud security technology products and services. These organizations are mature cloud users in terms of public cloud services and/or containers. Survey participants represented a wide range of industries, including manufacturing, financial services, health care, communications and media, retail, government, and business services.

Share this

Industry News

November 14, 2019

Raytheon Company is collaborating with Red Hat to develop a new, security-focused software development solution, known as DevSecOps, for enterprise environments.

November 14, 2019

Fugue has open sourced the Fugue Rego Toolkit (Fregot) to enhance the experience working with the Rego policy language.

November 14, 2019

Sysdig announced Sysdig Secure 3.0 to provide enterprises with threat prevention at runtime using Kubernetes-native Pod Security Policies (PSP).

November 13, 2019

Testim introduced the Testim Development Kit, a new way for developers to quickly create resilient tests directly in code.

November 13, 2019

Rollbar announced an error monitoring solution for Salesforce’s Apex platform.

November 13, 2019

StackRox announced version 3.0 of the StackRox Kubernetes Security Platform.

November 12, 2019

VMware announced rapid advancement of VMware Tanzu, a new portfolio of products and services designed to transform the way enterprises build, run and manage software on Kubernetes.

November 12, 2019

SmartBear released ReadyAPI 3.0. This latest release addresses the increasing requirement for organizations to consistently deliver high-quality APIs in order to meet accelerated business demands within compressed release cycles.

November 12, 2019

Aqua Security announced its expansion into cloud security posture management (CSPM) with its acquisition of CloudSploit.

November 07, 2019

To help developers increase the speed and quality of their SQL coding, enhance efficiency, and take advantage of the latest improvements in SQL Server, Redgate has released a major upgrade for its most popular tool, SQL Prompt.

November 07, 2019

CloudBees announced a partnership with Atos and VMware surrounding a solution to help customers adopt DevOps best practices at scale on Atos’ recently announced Atos Digital Hybrid Cloud (DHC) powered by VMware Tanzu and CloudBees cloud native continuous integration/continuous delivery (CI/CD) enterprise solution.

November 07, 2019

Fugue announced the release of the Fugue Best Practices Framework to help cloud engineering and security teams identify and remediate dangerous cloud resource misconfigurations that aren’t addressed by common compliance frameworks.

November 06, 2019

Red Hat and the Quarkus community announced Quarkus 1.0.

November 06, 2019

Copado announced its Winter 20 release to provide Salesforce customers the fastest path to continuous innovation.

November 06, 2019

Applause announced its new solution for AI training and testing.