devopsy.kinsta.cloud

Author: Brian Wald

Best of 2025: Five Trends That Will Drive Software Development in 2025

Over the past year, developers have eagerly adopted generative AI to accelerate coding and streamline their workflows. In GitLab’s latest DevSecOps survey, 78% of respondents said they are using AI for software development or plan to do so in the next two years.

In 2025, developers will broaden the scope of how they use AI with promising new applications for reducing technical debt and improving security. Developers will also use AI to modernize legacy applications that may be important to the business but were not previously considered critical enough to justify upgrading. AI will make app modernization financially viable for the first time — one of several ways that AI will start to reveal its ROI.

However, AI will not be the only big software story in 2025. Developers have long struggled with the busy work of managing too many disconnected software tools and frameworks. Next year, integrated development platforms will become more widespread, streamlining workflows and freeing developers’ time to do more engaging, important work. We will also see DevSecOps practices in embedded and IoT systems development increase, boosting security and productivity in this growing area.

The following are my top five predictions for the evolution of software development in 2025.

The ROI of AI-Based Software Development Tools Will Become Easier to Quantify

While organizations worldwide have quickly adopted AI for software development, many still struggle to measure its impact across diverse teams and business functions. Next year, organizations will become more sophisticated about measuring the return on their AI investments and better understand the value this technology can provide.

This starts with looking more closely at specific outcomes. Instead of asking a broad question like, ‘How is AI helping my organization?’ leaders should study the impact of AI on tasks, such as test generation, documentation or language translation, and measure the gains in efficiency and productivity for these activities.

By examining the tasks where AI excels, companies can more effectively quantify the ROI of AI initiatives and justify further investment in these technologies. With executive boards looking closely at AI costs and demanding accountability, more leaders will take this approach next year and provide concrete metrics for ROI.

Gen AI Will Make Large-Scale App Modernization Viable for the First Time

While app modernization has long been a stated goal for businesses, the cost of updating applications has been a significant barrier. Organizations have avoided modernizing smaller operational systems, such as internal portals and back-office tools because the expected benefits did not justify the expense. Tolerating a certain level of risk and inefficiency was considered the better option.

Generative AI will make wide-scale app modernization a reality. AI lowers the cost and complexity of re-architecting and updating older systems, making it feasible to see a meaningful ROI from modernization projects in as little as one year.

This shift finally makes large-scale application modernization practical for many essential but often overlooked systems that keep an organization running.

AI-Powered Vulnerability Remediation Will be a Game-Changer

While developers already work at breakneck speed today, technical debt is a persistent issue. The most worrying consequence of this debt is vulnerabilities that can creep into code and go unnoticed or unfixed. Next year, developers will expand their use of AI in software development to significantly reduce technical debt and increase the security of their code.

Technical debt often occurs when developers choose an easy or quick solution instead of a better approach that takes longer. Vulnerabilities result when the code is poorly structured, not sufficiently reviewed or when testing is rushed or incomplete.

Developers will tackle this head-on next year using AI-powered tools to assist with coding. These tools can automatically identify, explain and even fix vulnerabilities in the code they write. While these fixes will need to be reviewed and approved by a human, they can make development faster and highlight problems that make code less secure. The result will be more time for developers to focus on other important work while improving overall software security.

Embedded Systems Development Will be a Significant Focus in 2025

With nearly every device now powered by software, embedded systems and IoT development are outpacing traditional server-side software. As a result, organizations will pay increased attention to DevSecOps principles and tools to develop this type of software.

While DevOps combines development and operations into a more streamlined whole, DevSecOps embeds security into each step of the process. Embedded systems development needs to catch up with these principles, but that will finally change in 2025.

This shift will help developers address the unique challenges of embedded systems development, such as hardware-in-the-loop testing and the need to integrate software updates with diverse and constrained hardware environments.

A DevSecOps process is well-suited to address these challenges, thus software teams will evolve their practices and tools next year to accommodate the growth in IoT and embedded systems development.

Platform Engineering Will Relieve Much of the Burden on Developers

Unproductive tasks that consume significant time but go unseen by the broader organization are overextending developers. These tasks include orchestrating and maintaining tools, managing development processes and adapting to fast-changing needs.

Organizations can overcome these challenges by adopting integrated development platforms that handle these operational and security tasks at the portfolio level. Next year, we will see wider use of these platforms to relieve the burden on developers.

Integrating development, security and operations into a unified process has been an important transition to reduce silos among teams, but doing so created significant complexity. The shift left movement correctly identified the need for earlier involvement in critical processes, but it also unnecessarily burdened engineers.

In 2025, we will see a significant shift: Everything beyond application development will be abstracted to the portfolio level through centralized platforms, marking the decoupling of ‘development’ from ‘everything else.’”

Toward a More Secure, Productive Year

Pivotal trends championing efficiency, security and innovation will spur software development to evolve dramatically next year. Generative AI, a key player in this transformation, will expand its value by enhancing security and enabling large-scale application modernization while organizations begin to recognize its ROI.

Alongside AI, the focus on integrated development platforms will relieve developers from mundane tasks and allow them to concentrate on more rewarding work. The extension of DevSecOps to embedded and IoT development will continue the industry-wide commitment to security and productivity.

If 2024 was a year of experimentation and learning, 2025 will see many of these learnings coming to fruition, delivering on the promise to make software development more efficient, rewarding and secure.

December 25, 2025
Evolving Shift Left Security: A More Powerful Approach to Software Development Security

Enterprises today must contend with the dual challenge of maintaining robust security while enabling rapid software innovation. As cyberthreats become more sophisticated, the shift left approach to achieving this balance does not go far enough. Development teams need a more comprehensive approach to ensuring rock-solid security throughout the development life cycle, including later stages such as runtime and post-release. For several years, teams have been empowered to shift security left, embedding it earlier in the development process. By building security policies and tooling directly into the software development platform, every application within the portfolio benefits from the same consistent set of guardrails. This approach has ensured uniform compliance with security standards.

However, the shift left approach has also created new burdens for follow-on teams to manage. As applications move from development to deployment and production, developers’ security efforts do not always follow apps through their journey.

Beyond Shift Left Security

When implementing a software development platform, an organization can create templates for security tools and security-compliant workflows with policies baked in. These workflows are applied to projects, and the tools are universally available. Development teams eliminate duplicated efforts and overhead costs, and the business benefits from a proactive, holistic security posture across its entire software portfolio. Security remains everyone’s responsibility, but shifting security up the stack allows for more oversight and consistency across the organization. Most importantly, these security efforts ‘stick’ to a project from the first line of code to production and beyond.

Advantages of Shifting Security to the Application Layer

While shift-left security centers on securing code early in the development process, employing a ‘shift-up’ model ensure that security measures extend into later stages, such as deployment, runtime and post-release. Organizations can significantly reduce vulnerabilities that make it to production and are better prepared to mitigate those that do.

Early integration of security protocols helps ensure that all development activities comply with regulatory requirements, reducing the risk of fines, sanctions and any other negative impacts on the enterprise. More secure software also builds trust among customers, partners and stakeholders, enhancing the organization’s reputation and competitive position.

Here are three steps that development leaders can implement to evolve shift left security to cover the entire software development life cycle:

Develop Reusable, Automated Security Analyzers

Teams should build automated security testing components that are both reusable and adaptable across different projects and application architectures within a continuous integration (CI) environment. For instance, constructing modular components for SAST (static application security testing), DAST (dynamic application security testing), dependency scanning and container scanning ensures consistency and reduces the duplication of efforts.

By introducing an abstraction layer between analyzers and their pipeline implementations, results can be normalized before reaching development teams. This centralizes control over security rules and configurations and allows updates, replacements or additional analyzers to be integrated seamlessly without causing disruptions or rework downstream. Over time, this approach provides organizations with a more flexible, future-proof security framework that can evolve to meet changing requirements while maintaining a unified, organization-wide security posture.

Establish Global Security Policies as Guardrails

Overarching guidelines and protocols should guide and standardize security practices across all projects and teams within an organization. These policies act as guardrails by providing a structured framework, which ensures that projects adhere to a consistent level of security, while still allowing some flexibility to account for project needs or requirements.

The process begins with defining risk tolerance thresholds. Once these thresholds are set, security policies that align with regulatory requirements or internal compliance standards should be created. These policies should include mandatory tasks automatically applied to all projects, such as running security scans. The policies should be designed in a composable way to facilitate management across the portfolio and allow flexibility to meet diverse requirements.

Implement Contextual Approval Gating

Once security policies are enforced across projects, the next step is to prevent code promotion when security tools detect vulnerabilities or unacceptable risks. Results should be communicated to developers and approval gates used only when necessary. For example, if a SAST scanner detects a critical vulnerability, the developer must either resolve it or get approval from the security team before code promotion. Developers can continue without delay If no vulnerabilities are found, or the risk tolerance threshold is met. This approach maintains developer velocity while promoting responsible security practices.

Conclusion

Shift-up security transcends shift left by embedding enduring security measures throughout the software development life cycle. It reduces vulnerabilities, ensures compliance and builds trust through reusable security automation, global policies and contextual gating. It marks a proactive, sustainable approach to software development security — one that is crucial if enterprises are to maintain the balance between security and rapid innovation.

January 22, 2025
Five Trends That Will Drive Software Development in 2025

Over the past year, developers have eagerly adopted generative AI to accelerate coding and streamline their workflows. In GitLab’s latest DevSecOps survey, 78% of respondents said they are using AI for software development or plan to do so in the next two years.

In 2025, developers will broaden the scope of how they use AI with promising new applications for reducing technical debt and improving security. Developers will also use AI to modernize legacy applications that may be important to the business but were not previously considered critical enough to justify upgrading. AI will make app modernization financially viable for the first time — one of several ways that AI will start to reveal its ROI.

However, AI will not be the only big software story in 2025. Developers have long struggled with the busy work of managing too many disconnected software tools and frameworks. Next year, integrated development platforms will become more widespread, streamlining workflows and freeing developers’ time to do more engaging, important work. We will also see DevSecOps practices in embedded and IoT systems development increase, boosting security and productivity in this growing area.

The following are my top five predictions for the evolution of software development in 2025.

The ROI of AI-Based Software Development Tools Will Become Easier to Quantify

While organizations worldwide have quickly adopted AI for software development, many still struggle to measure its impact across diverse teams and business functions. Next year, organizations will become more sophisticated about measuring the return on their AI investments and better understand the value this technology can provide.

This starts with looking more closely at specific outcomes. Instead of asking a broad question like, ‘How is AI helping my organization?’ leaders should study the impact of AI on tasks, such as test generation, documentation or language translation, and measure the gains in efficiency and productivity for these activities.

By examining the tasks where AI excels, companies can more effectively quantify the ROI of AI initiatives and justify further investment in these technologies. With executive boards looking closely at AI costs and demanding accountability, more leaders will take this approach next year and provide concrete metrics for ROI.

Gen AI Will Make Large-Scale App Modernization Viable for the First Time

While app modernization has long been a stated goal for businesses, the cost of updating applications has been a significant barrier. Organizations have avoided modernizing smaller operational systems, such as internal portals and back-office tools because the expected benefits did not justify the expense. Tolerating a certain level of risk and inefficiency was considered the better option.

Generative AI will make wide-scale app modernization a reality. AI lowers the cost and complexity of re-architecting and updating older systems, making it feasible to see a meaningful ROI from modernization projects in as little as one year.

This shift finally makes large-scale application modernization practical for many essential but often overlooked systems that keep an organization running.

AI-Powered Vulnerability Remediation Will be a Game-Changer

While developers already work at breakneck speed today, technical debt is a persistent issue. The most worrying consequence of this debt is vulnerabilities that can creep into code and go unnoticed or unfixed. Next year, developers will expand their use of AI in software development to significantly reduce technical debt and increase the security of their code.

Technical debt often occurs when developers choose an easy or quick solution instead of a better approach that takes longer. Vulnerabilities result when the code is poorly structured, not sufficiently reviewed or when testing is rushed or incomplete.

Developers will tackle this head-on next year using AI-powered tools to assist with coding. These tools can automatically identify, explain and even fix vulnerabilities in the code they write. While these fixes will need to be reviewed and approved by a human, they can make development faster and highlight problems that make code less secure. The result will be more time for developers to focus on other important work while improving overall software security.

Embedded Systems Development Will be a Significant Focus in 2025

With nearly every device now powered by software, embedded systems and IoT development are outpacing traditional server-side software. As a result, organizations will pay increased attention to DevSecOps principles and tools to develop this type of software.

While DevOps combines development and operations into a more streamlined whole, DevSecOps embeds security into each step of the process. Embedded systems development needs to catch up with these principles, but that will finally change in 2025.

This shift will help developers address the unique challenges of embedded systems development, such as hardware-in-the-loop testing and the need to integrate software updates with diverse and constrained hardware environments.

A DevSecOps process is well-suited to address these challenges, thus software teams will evolve their practices and tools next year to accommodate the growth in IoT and embedded systems development.

Platform Engineering Will Relieve Much of the Burden on Developers

Unproductive tasks that consume significant time but go unseen by the broader organization are overextending developers. These tasks include orchestrating and maintaining tools, managing development processes and adapting to fast-changing needs.

Organizations can overcome these challenges by adopting integrated development platforms that handle these operational and security tasks at the portfolio level. Next year, we will see wider use of these platforms to relieve the burden on developers.

Integrating development, security and operations into a unified process has been an important transition to reduce silos among teams, but doing so created significant complexity. The shift left movement correctly identified the need for earlier involvement in critical processes, but it also unnecessarily burdened engineers.

In 2025, we will see a significant shift: Everything beyond application development will be abstracted to the portfolio level through centralized platforms, marking the decoupling of ‘development’ from ‘everything else.’”

Toward a More Secure, Productive Year

Pivotal trends championing efficiency, security and innovation will spur software development to evolve dramatically next year. Generative AI, a key player in this transformation, will expand its value by enhancing security and enabling large-scale application modernization while organizations begin to recognize its ROI.

Alongside AI, the focus on integrated development platforms will relieve developers from mundane tasks and allow them to concentrate on more rewarding work. The extension of DevSecOps to embedded and IoT development will continue the industry-wide commitment to security and productivity.

If 2024 was a year of experimentation and learning, 2025 will see many of these learnings coming to fruition, delivering on the promise to make software development more efficient, rewarding and secure.

January 17, 2025