devopsy.kinsta.cloud

Author: Mike Vizard

  • AWS Extends Cloud Security Reach to Include DevSecOps Tools to Scan Code

    AWS Extends Cloud Security Reach to Include DevSecOps Tools to Scan Code

    Amazon Web Services (AWS) this week made Amazon Inspector, a code scanning tool for surfacing vulnerabilities that is designed to be natively integrated with GitHub and GitLab platforms, generally available.

    Announced at the AWS re:Inforce 2025 conference, Amazon Inspector combines a static application security testing (SAST) tool for analyzing application source-code with a software composition analysis (SCA) tool for evaluating third-party dependencies and an ability to scan infrastructure as code (IaC) for valid definitions.

    Findings from these scans are then surfaced both in the Amazon Inspector console and within the source code management platform as fast feedback for the developers.

    Mitch Ashley, vice president and practice lead for software lifecycle engineering at The Futurum Group, said the expansion of the DevSecOps capabilities provided by AWS into code, dependencies, and IaC enable a critical ‘shift left’ for cloud security, fundamentally embedding vulnerability management earlier into the development lifecycle. That unified approach addresses a long-standing challenge for DevOps teams by accelerating feedback and fostering truly secure-by-design applications, he added.

    Additionally, AWS also revealed it has made available under an open source license a software package, dubbed @verifiedpermissions/authorization-clients-js, that enables developers to implement authorization in Express.js web application APIs in minutes. That approach reduces the custom authorization code that developers would have previously needed to create on their own.

    Finally, AWS demonstrated how it is internally using Amazon Q Developer, an artificial intelligence (AI) agent framework, to identify vulnerabilities in code as it is being developed.

    George Argyros, applied science manager of AWS, told conference attendees Amazon Q Developer makes it possible to “squash bugs” early in the application development process in a way that ultimately serves to improve the quality of the code being created. The overall goal is review code at the time a pull request is made and then surface recommendations to mitigate any issue, with Amazon Q Developer also being used to create and test any patch required.

    It’s not clear how widely the DevSecOps tool and platform being provided by AWS have been adopted, but it’s clear the cloud services provider is now moving well beyond securing infrastructure. It’s still the responsibility of organizations to secure the applications deployed on the cloud, but AWS is making the tools and services needed to achieve that goal more accessible.

    Hopefully, there will even come a day soon when application development teams are routinely using AI tools to prevent vulnerabilities and misconfigurations from being created in the first place.

    In the meantime, however, DevOps teams need to be sure to review the code being generated by AI tools that have been trained using examples of code that is of varying quality. In one instance, that code might be better than what some developers might write on their own. In other cases, segments of code with known vulnerabilities might have been copied multiple times over. In fact, about the only thing that is for certain is that there will soon be more code than ever to scan and review as developers continue to lean on AI tools to create code that they are becoming less inclined to write themselves.

  • New Relic Adds Support for Model Context Protocol to Observability Platform

    New Relic Adds Support for Model Context Protocol to Observability Platform

    New Relic this week added support for the Model Context Protocol (MCP) to its observability platform to surface insights into artificial intelligence (AI) agents and applications.

    Originally developed by Anthropic, MCP is rapidly becoming a de facto application programming interface (API) for enabling interoperability between AI agents and other sources of data.

    New Relic has now incorporated MCP with its application performance monitoring to surface insights into AI agents and applications alongside its ability to monitor and observe legacy applications.

    Previously, New Relic had added an ability to observe large language models (LLMs), but via MCP it’s now able to extend the reach of that capability to AI agents and applications that access those LLMs. That capability makes it possible to visualize specific usage and patterns of the entire lifecycle of an MCP request, including invoked tools, call sequences and execution durations.

    Additionally, DevOps teams can identify which prompts are being invoked and what choices were made by an AI agent along with surfacing latency, errors and other MCP performance issues.

    New Relic AI Monitoring MCP support is now available in Python Agent version 10.13.0, with additional languages coming soon.

    In general, New Relic reports it has seen a steady 30% growth in usage of its AI monitoring tools quarter-over-quarter for the past year. The company has also seen a 92% increase in the number of unique AI models being used. However, the ChatGPT models provided by OpenAI accounted for 86% of all the LLM tokens being generated.

    Nic Benders, chief technical strategist for New Relic, said that level of activity suggests that OpenAI is well on its way to becoming a de facto standard, even as the number of AI models being made available continues to rapidly increase.

    It’s not immediately clear why one LLM might be preferred over another but OpenAI, in addition to making a steady stream of investments, has successfully generated a significant amount of brand recognition. That helps make OpenAI one of the first platforms that most organizations are going to look to when building an AI application, said Benders.

    However, there are use cases, such as coding, that lend themselves, for the moment at least, better to coding, he added.

    Less clear is the degree to which the various AI models that are available will gain enough traction to warrant the ongoing level of investment required to sustain them. IT teams should carefully consider what foundations they want to build and deploy AI applications on for the long term, noted Benders.

    Additionally, not every AI application requires the latest, and most expensive, LLM, said Benders. The cost of previous generations of AI models has declined considerably as more advanced models have become available. Many applications, however, may not require access to a more advanced model, especially when a previous generation will enable a developer to automate a task at a much lower cost.

    Ultimately, observability platforms will play a critical role in enabling organizations to track which AI models are being used for which use cases. The challenge now is understanding not only which ones are gaining traction among application developers, but just as importantly, the symbiotic relationship that exists between AI models and the IT infrastructure upon which they depend.

  • Datadog Adds Raft of Additional AI Agents and Tools to Portfolio

    Datadog Adds Raft of Additional AI Agents and Tools to Portfolio

    Datadog at its DASH 2025 conference today previewed a raft of artificial intelligence (AI) agents that automate tasks ranging from assessing infrastructure alerts that normally require the expertise of a site reliability engineer (SRE), to fixing code and triaging cybersecurity issues using the company’s security information event management (SIEM) platform.

    In addition, Datadog is also adding Proactive App Recommendations that analyze telemetry data to suggest the next best action and APM Investigator to identify and trouble shoot bottlenecks impacting application performance.

    At the same time, Datadog is adding data observability tools, along with extensions to its service for monitoring large language models (LLMs), to add support for AI agents and previews of tools to test and validate the impact of prompt changes, model swaps or application changes on the performance of LLM applications. The company has also added an AI Agents Console to make it simpler to discover and invoke its AI agents. Datadog LLM Observability, now generally available, monitors the integrity of AI models and performs toxicity checks that look for harmful behavior across prompts and responses, while Datadog Workload Protection monitors interactions between LLMs and their host platforms. A Datadog Cloud Security and Sensitive Data Scanner (SDS) also enables organizations to meet compliance requirements.

    Datadog is also making generally available Datadog Code Security, a service that leverages AI to detect, prioritize and remediate vulnerabilities in their custom code and open-source libraries based on runtime threat activity and business impact. It has also extended the capabilities of its log management suite to run in an on-premises IT environment—meeting data sovereignty requirements in regulated industries—and to help reduce costs with a lower-cost archive tier of storage.

    Finally, Datadog has added a managed internal developer portal (IDP) that is integrated with the company’s core application performance monitoring platform. It provides a live system of record for telemetry data to surface what software is running, who is responsible for it, and how it is performing. There are also templates powered by Datadog’s App Builder and Workflow Automation to automate tasks such as creating the scaffolding for a new service along with engineering reports and scorecards to track compliance, reliability, security, observability, cost and other metrics.

    In general, Datadog is making use of a range of proprietary and open source LLMs, including one optimized for time-series data that it has developed. Over time, Datadog plans to mix and match LLMs to address specific use cases as additional AI advances are made.

    Michael Whetten, vice president of product for Datadog, said, for example, the latest Bits AI SRE, Bits AI Dev Agent and Bits AI Security Analyst agents not only extend the range of tasks being automated, but also enables them to query data, analyze anomalies or scale infrastructure using shared memory in a way makes it possible for AI agents to reuse functions. Datadog has also developed a Model Context Protocol (MCP) server to make it simpler for AI agents to consume its data and interoperate with each other. The overall goal is to not, for example, replace SREs, but rather augment their expertise in a way that makes it easier to manage complex IT environments, he added.

    It’s still early days so far as adoption of AI technologies across DevOps workflows is concerned, but a recent Futurum Research survey finds 41% of respondents expect generative AI tools and platforms will be used to generate, review and test code. In fact, arguably the challenge now is not so much deciding whether to use AI as much as it is determining where AI will have the biggest impact on improving both software quality and the speed at which applications are deployed.

  • How DevOps Strategy Is Evolving with Jim Cassens

    How DevOps Strategy Is Evolving with Jim Cassens

    Perforce Software CEO Jim Cassens dives into how the company’s overall approach to DevOps is evolving in the wake of a series of acquisitions.

    Cassens talks through the company’s recent spate of acquisitions and how thoughtful integration—not just portfolio expansion—is driving value for customers. He also highlights the growing role of synthetic data, AI-enhanced testing and how automation is shifting the responsibilities of development teams.

    A recurring theme is how generative AI is disrupting—not replacing—traditional developer roles. Cassens sees AI as a force multiplier, taking on repetitive, low-level tasks while freeing developers to focus on higher-order problems. But with that shift comes a challenge: How do early-career engineers gain the hands-on experience they need when entry-level work is being automated? That’s a question Cassens believes employers, not just universities, will need to answer.

    They also delve into the pressure DevOps teams face as pipelines become more brittle and overloaded. Cassens warns that the current approach to automation and scripting isn’t sustainable in a world where AI can flood pipelines with code at unprecedented volume. Organizations will need to rethink how they structure CI/CD, data management, and even pipeline observability.

    Finally, Cassens touches on the human element behind every digital transformation. As leaders weigh new tools and AI-powered workflows, he advises them to consider the fear and uncertainty many team members may be feeling—and to support them through education and open communication. The DevOps landscape may be changing fast, but people, not just platforms, will determine how successful the transition is.

  • How AI Is Transforming the Future of Software Development with Wing To

    How AI Is Transforming the Future of Software Development with Wing To

    Digital.ai CTO Wing To delves into how the way code is written, deployed and managed will fundamentally change in the artificial intelligence (AI) era.

    Cutting through the extremes, AI won’t erase entry-level dev jobs, nor will it fully replace senior developers. Instead, it’s changing what both groups focus on. Entry-level devs will need to learn how to effectively prompt, evaluate and refine AI-generated code, while senior devs may shift toward mentoring, reviewing AI-assisted output, and ensuring software quality. The fundamental knowledge of how systems work still matters—AI doesn’t remove the need for strong foundational skills.

    But AI does change the coding landscape. Developers are writing less and reading more. Reviewing AI-generated code—often verbose, not elegant—has become part of the job. And while some fear that the code is harder to debug, it may just be different: more mechanical, less idiosyncratic.

    From a DevOps perspective, AI introduces new challenges and opportunities. DevOps engineers are facing a surge in code volume and speed—often without a corresponding bump in quality. Automation, golden paths and better processes are essential to handle the influx of AI-assisted code. AI can also help streamline repetitive work: writing scripts, maintaining configurations, generating tests or spotting compliance risks.

    Eventually, DevOps teams may evolve into ecosystems of human engineers and collaborative AI agents. That vision’s still emerging, but orchestration between tools and agents is the next hurdle. The goal? To let developers and engineers focus more on creative, value-adding tasks—and less on toil.

    Still, AI must be used thoughtfully. It’s not a magic fix. It’s a power tool—one that needs skill, discipline and a good understanding of when (and how) to use it.