devopsy.kinsta.cloud

Author: Jenn Yarnold

How Data, Empathy and Visibility Are Redefining DevOps Maturity

Amy Carrillo Cotten shares her perspective on how DevOps teams are evolving in an era defined by AI acceleration, rapid release cycles, and shifting engineering priorities. Drawing from her experience leading engineering transformation initiatives, Cotten emphasized that while automation continues to drive efficiency, true DevOps maturity still depends on people, processes, and the right mindset.

Cotten noted that many organizations are still struggling to balance speed and quality. The drive to ship code faster often outpaces efforts to measure impact or ensure that teams have the skills needed to validate AI-assisted development. She pointed out that engineering success isn’t just about writing more code — it’s about understanding how that code contributes to business outcomes and user experience.

The discussion also touched on the widening skill gap as AI and automation reshape development workflows. Cotten highlighted that leaders must focus not only on reskilling technical teams but also on creating a culture of continuous improvement — one that integrates data-driven insights into how engineers collaborate, communicate, and measure productivity.

She also underscored the importance of operational visibility across the DevOps lifecycle. Without unified insights into performance metrics and workflow health, teams risk falling back into silos that undermine agility. By building stronger feedback loops between developers, QA, and operations, organizations can ensure that innovation doesn’t come at the expense of reliability.

Ultimately, Cotten said, the future of DevOps will hinge on empathy, transparency, and discipline. Technology may continue to evolve, but sustainable delivery still depends on teams that understand how to move fast — responsibly.

October 31, 2025
The New Metrics of DevOps: Speed, Trust and Transparency

At swampUP 2025, Alan sits down with Aman Sardana and Vijay Kumar Soni to talk through one of the defining challenges of modern software delivery—how DevOps practices must evolve to accommodate the growing influence of artificial intelligence across the software development lifecycle. They explore the intersection of automation, security and scalability as organizations rethink their pipelines to handle AI-driven workloads and agentic development patterns.

The rapid integration of AI into coding, testing, and deployment workflows has significantly accelerated release velocity, but it has also increased complexity. Traditional CI/CD models are now being stress-tested by AI-generated code, model deployment requirements, and the need for continuous governance. The emerging consensus is that future-ready DevOps teams must combine automation with observability, policy enforcement, and risk management — effectively treating AI systems as first-class citizens within the software pipeline.

They also address the growing need for explainability and traceability as AI systems become embedded into infrastructure management and application delivery. Teams can no longer rely solely on deterministic systems; instead, they must design feedback loops that account for dynamic, probabilistic outcomes generated by AI. This requires enhanced collaboration between platform engineers, data scientists, and security teams to ensure consistency and reliability.

Ultimately, there’s a new reality for DevOps: speed alone is no longer the primary benchmark of success. In the AI era, the goal is responsible acceleration — maintaining trust, transparency, and control even as automation and AI agents transform how code, infrastructure, and models move from design to production. The next generation of DevOps will be defined not only by how fast organizations can deliver, but by how intelligently and securely they do it.

October 23, 2025
How DevOps Is Evolving for the Age of Intelligent Automation

At swampUP 2025 in Napa Valley, Alan sat down with Vishal Raina and Shibashis Mishra to discuss how DevOps is adapting to a new era defined by artificial intelligence, automation, and digital transformation at scale. As organizations embed AI across their software delivery pipelines, the conversation has shifted from simple productivity gains to questions of governance, trust, and long-term sustainability.

They discuss the growing need for DevOps teams to balance rapid innovation with responsible automation. While AI and machine learning tools have made it easier to generate, deploy, and test code, they’ve also introduced new challenges — from security risks and model drift to explainability and regulatory compliance. The key, they noted, lies in integrating responsible AI practices directly into existing DevOps workflows rather than treating them as separate initiatives.

They also explore the evolution of intelligent automation and its impact on modern engineering culture. Traditional DevOps principles of speed and collaboration are being redefined by AI systems that learn, adapt, and sometimes act autonomously. To keep pace, teams are building new layers of observability, policy enforcement, and model lifecycle management — effectively creating an “AI-ready DevOps” discipline that blends governance with scalability.

One message was clear: the future of DevOps isn’t just about moving faster; it’s about moving smarter. By embedding ethical design, transparency, and accountability into every stage of the pipeline, organizations can unlock the full potential of AI without compromising stability or security. As AI-driven development continues to accelerate, the next evolution of DevOps will be measured not only by deployment frequency but by how well it maintains control, compliance, and trust across increasingly intelligent systems.

October 23, 2025
Strengthening Software Trust in Modern DevOps Workflows

At swampUP 2025 in Napa Valley, Alan Shimel sat down with Tariq Shaukat, CEO of Sonar, and Gal Marder, EVP of Strategy at JFrog, for a discussion on how partnerships across the DevOps and AI ecosystems are reshaping the way software is built, secured and delivered.

Shaukat emphasized that Sonar’s relationship with JFrog is rooted in shared values around trust, transparency, and code quality. As AI continues to accelerate software creation, both companies see a growing need for solutions that help developers not only move faster but also maintain the highest levels of security and reliability. “It’s never been about how fast developers type,” Shaukat noted. “It’s about ensuring that what’s being built is safe, verifiable, and ready for production.”

The discussion also touched on the rising influence of AI in DevOps workflows and the responsibility that comes with it. Shaukat and Marder agreed that as teams adopt AI tools to generate, test, and deploy code, governance must evolve to keep pace. That’s where the partnership between Sonar and JFrog becomes especially relevant—bridging code integrity with artifact management, vulnerability detection, and software supply chain security.

Marder added that this collaboration exemplifies JFrog’s broader strategy to build a unified, secure DevOps ecosystem powered by trusted partnerships. Together, Sonar and JFrog are working to redefine how software quality and trust are measured in an era where AI agents, automation, and human developers all share the same pipeline.

October 14, 2025
Secure Governance and Scalable Management for AI Models

At swampUP 2025, Yuval Fernbach, vice president and CTO of MLOps at JFrog, and Adel El Hallak, senior director of product for NVIDIA AI Enterprise, discuss how JFrog is integrating machine learning operations (MLOps) into its platform strategy. Fernbach, who joined JFrog through its acquisition of Qwak, outlined how JFrog is extending its mission beyond artifact management to embrace AI-driven software supply chain automation. The goal, he noted, is to enable developers to build, deploy, and govern AI models with the same level of trust and traceability that JFrog has long brought to binary and container management.

They discussed the rapid convergence of MLOps and DevOps, a shift that is redefining how teams manage the entire software and model delivery lifecycle. As organizations accelerate their adoption of generative AI and large language models (LLMs), the challenge is no longer just building or training models—it’s governing and managing them at scale. AI introduces new forms of technical debt, compliance requirements, and operational risk that traditional software management frameworks were never designed to handle. Every model carries dependencies, training data, and inference patterns that must be tracked, versioned, and secured across environments. Without unified governance, enterprises risk exposing sensitive data, violating regulations, or deploying unverified models that behave unpredictably in production.

The energy at swampUP reflects an industry in transition—where every team, from developers to platform engineers, is rethinking their toolchains for the AI era. As Fernbach and others shared, JFrog’s latest innovations are designed to bridge that gap, ensuring that software—and now models—move from experimentation to production with speed, security, and confidence.

October 14, 2025
How Graph Intelligence Is Transforming Software Supply Chain Visibility

At swampUP 2025 in Napa Valley, longtime JFrog collaborator and Java community veteran Stephen Chin talks about the evolution of software delivery, the fusion of graph intelligence with DevOps, and the growing need for integrated security across the software supply chain.

Chin, who has worn many hats across his career — from developer advocate to founder and now technologist working at the intersection of graph data and DevOps — has seen firsthand how the field has shifted since the first swampUP event a decade ago. What began as a small, casual gathering of early DevOps adopters has evolved into a global conversation about automation, AI and security at scale.

In his latest work, Chin is exploring how graph intelligence can be used to map and understand complex DevOps environments — from dependencies and artifacts to vulnerabilities and trust relationships. He described how visualizing these relationships in graph form gives teams a clearer view of their entire software supply chain, helping them detect risk patterns and respond to incidents faster.

The conversation turned toward what Chin jokingly dubbed “DevGraphIntelOps” — a synthesis of graph data, intelligence, and DevOps principles aimed at securing modern, AI-driven workflows. As organizations embrace agentic automation and complex multi-repository systems, understanding the connections between components has become mission-critical.

Reflecting on the past ten years of swampUP, Chin noted that while tools and trends have evolved, the core DevOps ethos remains the same: collaboration, transparency, and continuous improvement. The next frontier, he said, will be about context and visibility — knowing not just what’s running in production, but how every component connects across the entire ecosystem.

October 6, 2025
Building Faster, Safer Pipelines Through Practical Automation

At swampUP 2025, Alan Shimel spoke with Hariharan Ragothaman, a technologist and repeat attendee who has taken his passion for DevOps automation to the next level. While not a JFrog employee, Ragothaman has been a frequent participant in the JFrog community, first attending swampUP 2023 and returning this year to present a framework he developed to optimize infrastructure deployments.

Ragothaman’s project focuses on improving accessibility, security and speed in the deployment process—three areas that often compete for attention in enterprise DevOps environments. Using JFrog’s platform as a foundation, he built a framework designed to dramatically reduce the time it takes to bring new services into production without compromising on compliance or control. The result, he explained, is a more efficient, secure, and transparent pipeline that helps teams move from code to deployment faster and with greater confidence.

What makes Ragothaman’s approach particularly compelling is its emphasis on practical, repeatable automation. By embedding quality checks and security policies directly into the framework, teams can accelerate delivery while maintaining strong governance. His work aligns closely with JFrog’s broader vision for end-to-end trust and automation across the software supply chain—a theme echoed throughout this year’s conference.

Beyond his technical presentation, Ragothaman reflected on the collaborative spirit of swampUP, describing it as a unique space where practitioners can share real-world solutions and learn from one another. For him, the event isn’t just about product announcements—it’s about community, experimentation, and the drive to keep improving how software gets delivered.

His takeaway: innovation in DevOps doesn’t just come from platforms; it also comes from practitioners who use those platforms to reimagine what’s possible.

October 6, 2025
Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning
DevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds us how fragile the system really is.

It wasn’t a zero-day in Kubernetes or a cloud misconfiguration that caught my eye. It was a worm. Not a metaphorical one, not a cute “bug.” A self-replicating, credential-stealing worm slithering through npm, GitHub, and CI/CD pipelines. Its name: Shai-Hulud, after the sandworms of Dune. And like those great worms of Arrakis, this one tunneled through the ground beneath our feet — our supply chain.

How Shai-Hulud Struck

Security researchers at Wiz, Zscaler and StepSecurity described how the worm infected 200+ npm packages and over 500 versions in just a few days. Some of those packages had millions of weekly downloads.

Once installed, the malware pulled in TruffleHog to scan for secrets in environment variables and config files. It stole GitHub tokens, dumped them into a public repo called Shai-Hulud, and then planted malicious GitHub Actions workflows for persistence. In some cases, it even migrated private repos to public forks — broadcasting secrets to the world.

Charlie Eriksen from Aikido summed it up: “At least 187 code packages … have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub.” That’s not a nuisance. That’s a supply chain wildfire.

Why This is a DevOps Problem

You could argue this is just another npm mess. “Don’t use random packages,” “lock dependencies,” “scan for secrets.” We’ve heard it all before. But if you’re in DevOps, you can’t shrug this one off.

Why? Because Shai-Hulud didn’t just target developers at their laptops. It went straight after the DevOps machinery: the pipelines, the tokens, the workflows. That’s our house. That’s our responsibility.

Think about what DevOps has become. CI/CD pipelines aren’t side projects — they’re the factories. Every commit goes in, every release comes out. If attackers compromise that factory, they don’t just own one app, they own everything that factory produces.

This worm was tailor-made for that reality.

Lessons for the DevOps Community

So what do we do about it? A few takeaways hit me square in the face:
1. Long-lived tokens are suicide notes. If your pipelines still rely on credentials that never expire, you’re inviting attackers to take up permanent residence. Shift to OIDC or short-lived tokens.
2. Pipelines must be locked down. Too many orgs let builds run with full internet access, install scripts from who-knows-where, and treat CI environments as disposable. They’re not disposable—they’re crown jewels. Lock them down.
3. Provenance is not optional. If you can’t prove where an artifact came from, you shouldn’t be shipping it. Signed builds, SBOMs, attestations — call it bureaucracy if you want, but it’s the only way to stop worms from tunneling in.
4. Golden paths need teeth. DevOps teams love paved roads, but paved roads without guardrails are just fast lanes to compromise. Harden your templates. Don’t make security an optional checkbox.
5. Continuous verification beats once-a-year audits. Secret scanning, anomaly detection, policy enforcement — these need to be continuous. A worm doesn’t wait for your quarterly review.
A Pattern We’ve Seen Before

If all this feels eerily familiar, it should. Every era of computing has had its worm moment. Networks had SQL Slammer. Email had ILOVEYOU. Mobile had Stagefright. And now, the DevOps era has Shai-Hulud.

The pattern is always the same: systems grow fast, guardrails lag, and attackers exploit the gap. Worms are the blunt instruments that expose just how thin our defenses really are.

Shimmy’s Take

For me, Shai-Hulud is more than a clever name in the npm registry. It’s a warning shot across the bow of DevOps. We’ve built incredible factories of automation, but too many of them are made of cardboard and duct tape.

The bad news? Worms thrive in that environment. The good news? We know what to do. Kill the zombie tokens. Lock down the build rooms. Demand provenance. Make golden paths truly golden.

DevOps was always supposed to be about culture and discipline, not just tooling. Shai-Hulud is reminding us of that in the harshest way possible. If we treat pipelines as disposable plumbing, they’ll fail us. If we treat them as infrastructure, they can withstand worms.

The spice — the code — must flow. But it’s up to us in DevOps to make sure it flows safely, not straight into the desert for the worms to feast on.
October 1, 2025
DORA 2025: Faster, But Are We Any Better?
Let’s be real, folks — few reports in our industry carry the weight and staying power of the DORA report. For over a decade now, the “Accelerate State of DevOps” and its successors have shaped how we think about performance, culture and the DNA of high-functioning software teams. The famous four key metrics — deployment frequency, lead time for changes, mean time to restore, and change failure rate — are practically the commandments of DevOps. They gave us a language, a framework, and frankly, a way to separate myth from measurable progress.

I can tell you firsthand: I’ve seen DORA findings cited in boardrooms, in funding decks, and at just about every major DevOps event since 2014. When the report first showed that elite performers could deploy hundreds of times per day with lower failure rates than their peers, it blew the doors off the old “faster means sloppier” mindset. That single data-driven insight legitimized what a lot of us had been preaching but couldn’t prove. DORA turned DevOps from a movement into a management conversation.

Which brings us to 2025. The newest DORA report — the “State of AI-Assisted Software Development” — lands at a time when AI is eating everything from code generation to documentation to operations. And just like those early DORA reports reframed speed versus stability, this one is reframing what AI is actually doing to our software delivery pipelines. Spoiler alert: It’s not as simple as “AI makes everything better.”

Adoption Outpaces Trust

Here’s the headline: A full 90% of respondents say they’re now using AI in their work, and most believe it’s boosting productivity. That’s near-universal adoption, folks. But here’s the rub — about a third admit they don’t trust AI-generated code.

That’s the kind of tension that defines inflection points. Remember when we first started adopting CI/CD pipelines? Everyone set them up because it was the thing to do, but very few trusted them enough to deploy to production on a Friday afternoon. Same story here. AI is table stakes already, but confidence hasn’t caught up with usage.

And if your engineers don’t trust the code, what do you really have? You’ve got more friction, not less.

Faster, Yes. Safer? Not So Much

Now here’s the counterintuitive part. For the first time, DORA shows AI adoption is linked to higher throughput. That’s right — teams using AI are moving work through the system faster than those who aren’t.

But before you pop the champagne, look at the other half of the finding: Instability is still higher in AI-heavy teams. Faster, yes. Safer? Not so much.

If you’ve been around the block, this won’t shock you. We saw the same thing in the early days of automation — speed without discipline just meant you hit the wall quicker. To borrow a metaphor, AI is rocket fuel. But without a guidance system, you’re just accelerating toward the cliff.

Platforms Make or Break the AI Payoff

Here’s a finding that shouldn’t surprise anyone who’s been paying attention: Platform quality is the difference-maker. A full 90% of organizations now have internal platforms, and three-quarters have dedicated platform teams. But the data shows a stark divide. High-quality platforms amplify AI’s benefits across the board. Low-quality platforms? AI impact is negligible.

Truth is, this aligns perfectly with the rise of platform engineering as a discipline. We’ve been saying it for years — platforms are the backbone of modern DevOps. Now DORA is proving it with data. If your internal platform stinks, all the AI in the world won’t save you. In fact, it’ll probably just make the stink spread faster.

VSM: The Unsung Hero

Another gem buried in the report is the role of value stream management. AI tends to deliver “local optimizations” — an engineer codes faster, a test suite runs quicker — but without VSM, those wins don’t always roll up into business outcomes. With VSM in place, AI-driven productivity gains translate into measurable improvements at the team and product level.

That, to me, is vintage DORA. Remember when they proved that culture — psychological safety, autonomy, collaboration — wasn’t just a warm fuzzy HR concept but directly correlated with elite performance? Same here. VSM turns AI from a toy into a force multiplier.

The User-Centric Reality Check

One more finding worth calling out: Teams that adopt AI without a strong user focus actually see performance harm. When you center the user, AI’s impact is strongly positive. When you don’t, it can backfire.

Think about that. All the talk about AI copilots and generative magic means nothing if the work isn’t aligned with what the end user actually needs. It’s a classic reminder that DevOps has always been about delivering value, not just velocity.

So What Does it all Mean?

Pulling back, here’s how I see it:
- The trust gap is real. AI may be everywhere, but confidence will take years of scars and stories to catch up.
- Speed without stability is the oldest tradeoff in software, and AI hasn’t rewritten that law yet.
- Platforms and VSM aren’t optional—they’re the levers that turn AI adoption into real organizational performance.
- User focus matters more than ever. AI without empathy just means scaling the wrong work faster.
If this all sounds familiar, it should. The early DORA reports shattered the myth that speed and stability were opposites. The 2025 report is showing us that AI doesn’t change the fundamentals — it just raises the stakes.

What You Should Do Next

So what’s a DevOps leader supposed to do with all this? Here’s my playbook:
1. Get your platform house in order. Don’t bolt AI onto a shaky foundation.
2. Double down on VSM. Make sure productivity gains aren’t just treadmill miles.
3. Define trust boundaries. Engineers should know when AI output is acceptable and when it needs review.
4. Invest in rollback and safety nets. The faster you go, the better your brakes need to be.
5. Keep the user at the center. AI is only as good as the product direction it’s pointed toward.
Shimmy’s Take

At the end of the day, DORA has always been the sober voice in a hype-driven industry. Back in 2014, it told us faster could be safer. In 2025, it’s telling us AI can be faster, but not necessarily safer — at least not yet.

If you’ve got your fundamentals in place — platforms, pipelines, VSM and a relentless focus on users — AI can give you a serious edge. But if you’re hoping AI will fix broken culture or bad process, I’ve got news for you. I’ve seen this movie before, and it doesn’t end well.
September 29, 2025
MLOps at Scale: How Community Is Driving AI Into Production

At swampUP 2025, Alan caught up with Demetrios Brinkmann, founder of the MLOps Community, to discuss the growing gap between AI research and real-world production deployments. Brinkmann leads a global network of more than 100,000 developers dedicated to bridging that divide, helping teams move beyond flashy demos and academic models to systems that deliver tangible business value.

The MLOps Community provides multiple ways for practitioners to engage: a Slack workspace, curated one-on-one matches, in-person meetups, workshops, conferences, virtual events, a newsletter, and a popular podcast. The goal, Brinkmann explained, is to raise the overall level of education and awareness across the field while connecting practitioners who are tackling similar challenges in bringing AI and ML into production.

One of the recurring themes is the operational complexity of scaling AI workloads. Many organizations can train models, but deploying them reliably, monitoring performance, and ensuring governance at scale requires different skill sets and tools. The community’s role is to share hard-won lessons from practitioners and highlight emerging best practices in areas like observability, CI/CD for ML models, and managing technical debt created by fast-moving experimentation.

Brinkmann noted that with the rise of generative and agentic AI, the stakes are even higher. Teams are under pressure to move fast, but deploying AI without proper guardrails risks security lapses, compliance failures, and business disruptions. The MLOps Community’s mission is to give practitioners a space to navigate these issues openly and collaboratively, rather than reinventing the wheel in isolation.

As Brinkmann put it, AI won’t transform industries unless it can be reliably operationalized — and that’s where communities like his make the difference.

September 26, 2025