Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Can the Linux desktop installed base ever break the mythical 10% barrier? Google has been refactoring ChromeOS, and GNOME is working on new window manager ideas. (more…)
In my recent blog, Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I indicated that AI could assist in shifting the wisdom of production to the left. In this blog, I’ll explain in more detail how AI-engineered tools can be used to improve the pillar that I call SRE culture.
Shifting the “wisdom of production” to the left is all about bringing production considerations into the development process as early as possible. Here are some use cases where AI can help facilitate this shift, along with specific challenges and AI tools that can assist.
Predicting System Behavior: Predicting system behavior under various conditions can be difficult, especially as systems grow more complex. AI can help by analyzing historical data and predicting system behavior. Tools like Splunk can use machine learning to provide these predictions and facilitate earlier decision-making.
Automated Code Reviews: Manually reviewing code for potential production issues can be time-consuming and error-prone. AI can automate this process, identifying potential issues more quickly and accurately. Tools like DeepCode or Codota use AI to analyze code and identify potential issues.
Security Vulnerability Detection: Identifying security vulnerabilities early in the development process can prevent costly and damaging breaches in production. AI can analyze code to identify potential vulnerabilities that might be missed by human reviewers. Tools like Snyk or WhiteSource can help with this.
Performance Optimization: Predicting how code changes will impact performance can be challenging. AI can analyze changes and predict their impact on system performance. Tools like Akamas leverage AI to automate the performance optimization process.
Dependency Analysis: Identifying how changes in one part of a system will impact other parts can be difficult. AI can analyze system dependencies and predict the impact of changes. Tools like FOSSA can help in automating dependency analysis and identifying potential issues.
Resource Allocation: Predicting resource needs for new features or changes can help prevent resource shortages in production. AI can analyze resource usage patterns and predict future needs. Tools like Turbonomic or Densify use AI to optimize resource allocation.
User Experience Optimization: Predicting how changes will impact the user experience can help prevent negative impacts in production. AI can analyze user behavior and predict the impact of changes on user experience. Tools like FullStory or Crazy Egg can provide AI-driven insights into user behavior.
A practical implementation roadmap for introducing AI tools to help shift wisdom to the left may include the following steps.
Identify Needs and Goals: Start by identifying the areas where shifting wisdom to the left could have the most impact. This might include areas where issues are frequently discovered late in the development process or where manual processes are time-consuming or error-prone. Define clear goals for what you hope to achieve by introducing AI in these areas.
Research Tools: Once you’ve identified your needs and goals, research the AI tools available that could help meet those needs. Consider factors like the tool’s capabilities, integration with your existing systems, cost and support options.
Evaluate Tools: Based on your research, select a few tools to evaluate more thoroughly. This could involve setting up trials or demos, speaking with the tool’s developers or other users and assessing how well the tool meets your needs.
Pilot Implementation: Once you’ve selected a tool, start with a pilot implementation on a small scale. This will allow you to learn how to use the tool, identify any potential issues or obstacles and understand the tool’s impact before rolling it out more broadly.
Training: Provide training for your team on the new tool. This could include formal training sessions as well as ongoing support as they start using the tool.
Monitor and Adjust: After the tool has been implemented, monitor its use and impact. This could involve tracking metrics related to your initial goals, as well as soliciting feedback from your team. Use this information to make any necessary adjustments to your use of the tool.
Expand Use: Once you’re satisfied with the results of your pilot implementation, expand the use of the tool to other areas of your organization. Continue to monitor its use and impact and make any necessary adjustments.
Repeat: Technology is constantly evolving, and there may be new tools or features that could further improve your ability to shift wisdom to the left. Periodically revisit your needs and goals, and repeat this process to continuously improve your processes.
Shifting the wisdom of production to the left is an essential strategy for modern IT organizations, but it’s a journey that requires thoughtful planning, the right tools, and a commitment to continuous learning and improvement. As we’ve explored, there are several compelling use cases for leveraging AI in this transformative process. Whether it’s predicting system behavior, automating code reviews, detecting security vulnerabilities, optimizing performance, analyzing dependencies, managing resources or enhancing the user experience, AI tools are helping organizations tackle these challenges more efficiently and effectively.
While embarking on this journey may seem daunting, a well-crafted implementation roadmap can help make the process manageable and rewarding. By identifying specific needs and goals, researching and evaluating the right tools, piloting their implementation, providing comprehensive training and consistently monitoring and adjusting their usage, organizations can successfully adopt AI tools to shift the wisdom of production to the left. With continued effort and commitment, this transformation can lead to more informed decision-making, more efficient processes and, ultimately, better outcomes in production.
A survey of 404 IT professionals conducted by Snyk found the use of artificial intelligence (AI) to write code is creating a security paradox. On one hand, just over three-quarters of respondents (77%) said AI tools improve code security. At the same time, however, 59% are concerned that AI tools trained using general-purpose large language models (LLMs) will introduce security vulnerabilities that first appeared in the code used to train them.
The challenge with general-purpose LLMs is that they are trained using a combination of excellent, mediocre and flawed code. As a result, any recommendation surfaced has the potential to be a suboptimal security result.
Randall Degges, head of developer relations for Snyk, said that as AI tools increase the velocity at which applications can be constructed, it’s probable that DevOps teams will discover more vulnerabilities in their code.
In general, 61% of respondents also noted that automation has increased the number of false positives, with 62% of respondents reporting that at least one out of every four vulnerability alerts they received from automation tools were false positives. Well over a third (35%) said false positives represented over half of the vulnerability alerts.
On the plus side, however, more organizations are paying closer attention to application security issues in the wake of several high-profile breaches of software supply chains and disclosures of vulnerabilities. A full 96% reported their organizations are addressing supply chain security problems on an ad hoc basis, yet only half have a formalized supply chain security strategy in place.
The survey also finds 87% of respondents work for organizations impacted by a software supply chain security issue in the last year, with 61% having implemented new tools and processes as a result.
A total of 62% of respondents work for organizations that have a software life cycle assurance process in place, but only 42% of organizations are using software bills of materials (SBOMs). In addition, only 40% have formal security ratings for the open source packages that developers employ, and 31% ignore risks that arise from indirect dependencies.
However, only 40% of organizations have embedded security testing tools into their integrated development environments (IDEs), with 40% not using software composition analysis (SCA) or static application security testing (SAST) tools at all. In fact, even though 80% of respondents reported working for organizations that ship code daily, only 27% claim to continuously audit their code.
As a result, many vulnerabilities remain unpatched, with Java (42%) and JavaScript (31%) topping the list in terms of code with the most ignored vulnerabilities.
Finally, the survey also noted that vulnerabilities involving open source code are now being remediated faster than proprietary code. Maintainers of open source software are now paying more attention to cybersecurity issues thanks in part to the tools and best practices provided by the Open Source Security Foundation (OpenSSF), said Degges.
There will, of course, come a day when AI is more widely used to analyze vulnerabilities in code. In effect, AI will be used to solve some of the security issues general-purpose LLMs create. In the meantime, however, DevSecOps teams would be well-advised to proceed with caution.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: A big-tech consortium goes toe-to-toe with Google Maps, and a big-tech consortium tries to fool AI regulators. (more…)
Many organizations are experiencing deficits in technical skills and gaps in productivity that ultimately harm their bottom line. To overcome those obstacles and drive growth, businesses can use generative AI tools like ChatGPT and Bard to handle large volumes of data and increase the speed and output of basic tasks without draining valuable human capital. Already, businesses are finding that saving time is one of the most valuable benefits generative AI can deliver. However, there must be oversight of deployments to avoid recurring pitfalls, as the technology contains just as much risk as it does opportunity.
Generative AI provides developers with helpful task automation while simultaneously creating new challenges. Security, bias and IP questions have DevOps teams scratching their heads at how to best ethically and operationally implement generative AI. Developers must embrace these challenges to remain competitive in an increasingly automated and technologically-driven world.
Generative AI’s ability to understand and solve code-related issues makes it an ideal tool to help software developers optimize code for faster feature development and quicker releases. By identifying where it can contribute to tasks, like legacy code conversion or automation of processes, companies can free up valuable developer time for building the tools that can grow the business or drive new initiatives. An added benefit is that development teams can automate the coding of new applications or systems by updating old code or re-using existing examples.
ChatGPT, for example, can also turbocharge development time by scouring swathes of information on GitHub and other forums to find examples of whatever a coder is trying to build. A 2022 study published in the Proceedings of the Association for Computing Machinery on Programming Languages (PACMPL) found that developers could code faster and work more efficiently thanks to generative AI. Tedious searches in tech forums and manual copy-and-paste procedures are replaced by simply asking the right questions (via prompts).
However, generative AI tools are not closed systems. As users enter data into ChatGPT, it is saved and aggregated to continuously train the language model, opening the door for potential leaks of sensitive company information. There is a serious, potential risk of employees using AI tools as sensitive data already makes up 11% of what employees paste into ChatGPT.
As a third-party system, AI tools absorb every query, comment and question without any privacy guardrails for users. If an AI bot’s security is compromised, businesses can unintentionally hand over data to bad actors. Even without a hacker’s involvement, sharing confidential customer or partner information may violate contractual agreements and create long legal battles. Developer teams must remain conscious of AI’s security risks.
It is of utmost importance that businesses make reliable, fair and traceable decisions based on the latest facts. Currently, ChatGPT-4 hasn’t reached the maturity level necessary to be trusted by most companies without significant verification measures. Already, testers have persuaded ChatGPT to make statements that are either inaccurate, biased or both.
One key concern in generative AI is the ingrained and accidental bias in answers due to the human-generated content used to train large language models. ChatGPT works by searching for textual content relating to the question and recombining it for a distillation. In an almost democratic way, the majority opinion will dominate. For instance, if most people believe that the Swedish are hard drinkers, ChatGPT will say so. While the technology provides remarkably accurate responses in an alarmingly convincing way, it’s important to remember that it’s not always the most reliable or balanced source that wins.
Furthermore, OpenAI, the creator of ChatGPT, has explicitly stated that its goal is to create a system where queries can be pre-processed before they are fed to the neural net. Answers can then be post-processed before being shown to users. But this safeguard lacks clarity around its objectives and opens the door for ideological or political manipulation.
Companies considering implementing AI tools must carefully examine their potential applications to ensure they avoid scenarios where bias can result in insights and output that could end up harming the company and its reputation.
Enterprises are looking for tools to integrate generative AI into existing business processes to enhance numerous functions and deliver greater value to their customers. While the technology still isn’t capable of replacing human developers responsible for updating and maintaining largescale software, updates to generative AI tools and integrations are occurring at a rapid pace, leaving businesses to determine which programs are most viable for developer function.
As the economy continues to tumble closer to a recession, companies seek ways to minimize costs. And those looking to use generative AI to work with the source code and technical documentation the company uses to run its own operations—rather than the open source code tools like ChatGPT provide—face budgetary decisions. Implementing generative AI programs into the business model can be extremely costly if done wrong, leaving executives to weigh the benefits of adopting the tech versus the cost of trying to hire a full team of developers.
For businesses looking to build the connected experiences their employees, partners and customers desire, generative AI is a great resource to accomplish this. However, it’s just one piece of the puzzle that is a modern enterprise. These tools can only deliver smart answers if they get smart questions and businesses connect their internal processes and applications to enable machine learning on accurate and holistic datasets.
Although AI poses many benefits for developers, such as increased efficiency, accuracy and the ability to handle large amounts of data, they must be wary of the potential security, ethical and budgetary concerns that impact employees, customers and the enterprise as a whole.
However, once the concerns are overcome or managed, the power of large language models will be leveraged in all kinds of technology and business use cases. Certainly a truly transformational shift and a step change towards a world where technology and software play an unprecedented role in business and society.
In my recent blog, Revolutionizing the Nine Pillars of SRE with AI-Engineered Tools, I indicated that AI could analyze application and infrastructure performance data to identify optimization opportunities and predict capacity requirements. In this blog, I explain in more detail how AI-engineered tools can be used to improve the pillar that I call performance management of apps and infrastructure.
Performance management in the SRE context generally refers to monitoring, analyzing and optimizing the performance of IT systems to ensure they are functioning efficiently and effectively to meet the needs of users and the business.
Performance Monitoring and Analysis: With the complexity and scale of modern IT systems, manually sifting through performance data to find issues can be like finding a needle in a haystack. AI can help identify patterns and anomalies that might indicate a performance problem. Tools like Dynatrace and Datadog use AI to analyze performance data and automatically alert you to potential issues.
Capacity Planning: Predicting future capacity needs is often more of an art than a science, but AI can help make these predictions more accurate. Machine learning algorithms can analyze historical usage data and predict future capacity needs based on patterns and trends in this data. A tool like Amazon Forecast can generate accurate capacity forecasts based on time-series data.
Load Testing and Stress Testing: AI can enhance these testing techniques by dynamically generating realistic load and stress scenarios based on real-world usage patterns. AI can also analyze the results of these tests to identify potential bottlenecks. Tools like BlazeMeter with Taurus provide capabilities for AI-enhanced load and stress testing.
Performance Optimization: AI can identify optimization opportunities that humans might miss. Machine learning algorithms can analyze performance data to identify inefficient operations or configurations that are impacting performance. Tools like Akamas leverage AI to automate the performance optimization process.
Performance Modeling: Traditional performance modeling techniques can struggle to accurately model the behavior of complex, distributed systems. AI can analyze historical performance data to create more accurate models of system behavior. Tools like BMC’s TrueSight Capacity Optimization employ AI to enhance performance modeling capabilities.
Implementing AI in any area brings its own set of challenges, and performance management is no exception. Here are some potential challenges and ways to overcome them:
Data Quality and Management: AI relies heavily on data to provide accurate predictions and optimizations. If the data is inaccurate, incomplete or not representative of the system’s behavior, the AI’s effectiveness will be limited. To overcome this, it’s important to implement robust data management and governance practices. Regularly review and clean your data to ensure its accurate and relevant.
Skills Gap: Implementing AI often requires a specific set of skills in data science, machine learning and AI, which may not be present in existing SRE teams. Investing in training and upskilling for existing team members, as well as considering hiring or partnering with AI experts, can help fill this gap.
Resistance to Change: As with any major change, there can be resistance from team members who are comfortable with existing practices. Open communication about the benefits of AI and how it can make their jobs easier and providing the necessary training can help overcome this resistance.
Integration with Existing Systems: AI tools need to be able to integrate with existing systems to access necessary data and take actions based on its analysis. Choosing AI tools with robust integration capabilities and planning for potential integration challenges can help overcome this issue.
Cost: Implementing AI can require significant investment in tools, infrastructure and skills. Careful planning and budgeting as well as calculating potential ROI from the improved performance management can help justify these costs.
Security and Privacy: AI tools need access to a lot of data, which can raise security and privacy concerns. It’s important to choose AI tools that follow best practices for data security and privacy and to conduct regular security audits.
Performance management is a critical part of site reliability engineering, ensuring that systems function at their optimal efficiency and efficacy. With the integration of AI, this facet of SRE is getting an unprecedented boost. From using AI in performance monitoring to identify patterns and anomalies to employing machine learning for accurate capacity predictions, AI is redefining how SRE practices are carried out. Tools like Dynatrace, Amazon Forecast and Akamas, among others, are leading the charge in AI-fueled performance management, streamlining processes and delivering superior results.
Yet, as promising as the future of AI in performance management appears, organizations must navigate challenges to fully harness its potential. From managing data quality to bridging the skills gap, countering resistance to change, integrating with existing systems, managing costs and ensuring security and privacy, the transformation involves overcoming significant hurdles.
However, with robust data governance, investment in upskilling, open communication, careful planning and strict adherence to security best practices, organizations can fully leverage AI to revolutionize their performance management practices and elevate their SRE capabilities. This not only ensures optimal system performance but also positions the organization well for future growth and innovation.
New Relic today made available a public preview of an application security testing tool that will be integrated into its observability platform.
Esteban Gutierrez, CISO and vice president of information security for New Relic, said the New Relic Interactive Application Security Testing (IAST) will provide DevSecOps teams with the context needed to identify the root cause of a cybersecurity issue down to specific lines of code.
DevSecOps teams will be able to take advantage of IAST to identify vulnerabilities both in code as it is written and after it has been deployed in a production environment without any false positives, he noted.
New Relic achieves that goal using deterministic testing techniques that surface an actual proof-of-exploit using observability data collected from both applications and the underlying infrastructure upon which they depend, said Gutierrez. DevSecOps teams are then provided with guided remediation suggestions, guardrails and tracking tools to both remediate the issue at hand and prevent it from reoccurring, he noted.
New Relic IAST takes advantage of the agent software New Relic provides to collect observability data, which reduces the total cost of DevSecOps by providing IT teams that have adopted the New Relic platform with an integrated set of application security testing tools that doesn’t require them to acquire and manage a separate additional platform, added Gutierrez.
That approach also ensures that application security testing is integrated with the continuous integration/continuous delivery (CI/CD) platforms that New Relic already observes, he added.
The reason most vulnerabilities are not remediated in a timely fashion is the DevOps teams responsible for creating and deploying the required patches lack any context. They often don’t know, for example, how many instances of a vulnerability there might be or the actual level of severity. Without those insights, it becomes exceedingly difficult to prioritize remediation efforts, noted Guttierrez.
As application security requirements become more stringent in the wake of forthcoming legislation, it’s now more of a question of when than if organizations will be required to better secure their software supply chains. The issue DevOps teams face now is finding a way to integrate application security testing tools into existing DevOps workflows without slowing down the pace at which applications are being developed.
Of course, not every vulnerability discovered requires the same level of attention. Depending on its severity and likelihood of being exploited, DevOps teams need to prioritize which vulnerabilities need to be remediated first. There simply are not enough resources available today to fix every vulnerability an application might have. For the foreseeable future, there will remain technical debt involving vulnerabilities that will need to be addressed after an application is deployed in a production environment.
The issue, of course, is that cybercriminals are getting more adept at exploiting those vulnerabilities. The amount of time any DevOps team has to resolve issues before they result in a breach continues to dwindle.
In my recent blog Revolutionizing the Nine Pillars of SRE With AI-Engineered Tools, I indicated that AI can help reduce toil by automating more complex tasks that were previously challenging to automate. Machine learning models can predict system behavior, enabling proactive responses. In this blog, I explain in more detail how AI-engineered tools can be used to improve toil reduction and automation.
In each of the following use cases, AI not only reduces toil but also contributes to improving system reliability, efficiency and scalability, forming a critical part of modern site reliability engineering (SRE) practices.
Anomaly Detection and Predictive Maintenance: AI can monitor system logs and operational metrics to detect anomalies, predict system failures and schedule maintenance. This leads to fewer unexpected issues and lower downtime. Tools such as Splunk‘s Machine Learning Toolkit and Elastic’s Machine Learning features can be used for this purpose.
Automated Testing: AI can be used to automate testing procedures, ensuring code reliability before deployment and reducing the toil of manual testing. Tools like Mabl or Testim use machine learning to create, execute and maintain tests, reducing the need for human intervention.
Incident Triage and Resolution: AI can analyze incident data, diagnose issues, suggest solutions and, in some cases, automate the resolution process. Tools such as PagerDuty’s Event Intelligence or BigPanda help automate these processes and reduce resolution times.
Capacity Planning and Resource Allocation: AI can predict system load and adjust resources accordingly to ensure optimal performance and scalability. Dynatrace and Datadog are examples of AI-driven platforms that can provide predictive analytics and capacity planning.
Proactive Fault Isolation: AI can help isolate faults before they escalate into significant issues, reducing downtime and maintaining system reliability. IBM’s Watson AIOps and Moogsoft’s AIOps platform use AI to quickly isolate and remediate faults.
Security and Threat Detection: AI can monitor system activity, detect threats and prevent security incidents, reducing the toil of manual monitoring and intervention. Tools like Darktrace and CrowdStrike Falcon use AI for cybersecurity.
Network Optimization: AI can analyze network traffic and performance data to optimize network configurations and improve system performance. Tools such as Mist (from Juniper Networks) and Cisco’s DNA Center can provide these functionalities.
Code Review and Technical Debt Management: AI can analyze code changes and identify issues and potential technical debt, providing guidance for incremental code improvements. Tools like DeepCode and CodeClimate can help manage and reduce technical debt.
Organizations must overcome challenges with their people, processes or technologies when transforming SRE practices to using AI tools for toil reduction and automation.
Lack of Skilled Personnel: AI technologies often require a level of expertise that may not exist within current teams. This lack of skill can be a significant barrier to the successful implementation and usage of AI tools. Invest in training existing staff and consider hiring new team members with the necessary skill sets. There are plenty of resources and courses available online to train your teams on AI tools and technologies.
Data Quality Issues: AI tools rely on quality data to deliver reliable insights. Data might be unclean, unstructured or siloed across different systems, which can hinder the effectiveness of AI. Implement robust data management and governance practices to ensure your data is clean, structured and accessible. AI tools can also be used to assist in data cleansing and structuring processes.
Resistance to Change: People can be resistant to new technologies, especially when it comes to something as transformative as AI. This resistance can slow down or even halt the transition to AI-based SRE practices. Develop a strong change management strategy, which could involve regular communication about the benefits and importance of the change, provide training and support and gradually integrate AI tools into existing workflows to allow for a smoother transition.
Integration with Existing Systems: AI tools need to work in tandem with existing IT systems, tools and processes. Integration issues can prevent AI tools from accessing necessary data or functioning as expected. Plan the integration process carefully, ensuring that the selected AI tools are compatible with your existing systems. Where possible, choose AI solutions that offer flexible APIs and other integration options.
High Costs: Implementing AI tools can require substantial investment, including purchasing or subscribing to the tools, integrating them into your existing systems and training staff. Calculate the return on investment (ROI) before implementation to understand the potential benefits and savings the AI tools can provide in the long run. Look for scalable solutions that allow you to start small and increase your investment as you see value.
Compliance and Security Concerns: The use of AI tools, particularly those that leverage cloud computing, may raise concerns about data security and compliance with various regulations. Conduct a thorough risk assessment before implementing any AI tool. Choose vendors that adhere to industry-standard security protocols and offer comprehensive security features. Consider working with a third-party auditor to ensure compliance.
As organizations journey toward greater operational efficiency and reliability through SRE, the transformative potential of AI is becoming increasingly clear. AI-driven tools are revolutionizing various facets of SRE, including toil reduction, automation and defining service-level indicators, objectives and agreements. These innovative technologies can automate complex tasks, predict system behavior, refine performance targets, optimize deployments and aid in effective incident management. For example, AI tools such as Datadog, Dynatrace and New Relic can provide actionable insights into your systems, while others like Nobl9 can use machine learning to define SLOs based on historical performance data.
However, the road to this AI-infused future is not without its challenges. Teams might grapple with issues such as a lack of skilled personnel, data quality, resistance to change, system integration, high costs and security concerns. Yet, with the right approach, these hurdles can be overcome. By investing in training and hiring skilled personnel, implementing robust data management practices, fostering a culture receptive to change and carefully planning the integration of AI tools, organizations can leverage the power of AI. Calculating ROI before implementation and choosing vendors who adhere to stringent security protocols can further ensure success. The use of AI in SRE represents a powerful convergence of technology and practice that is reshaping the landscape of modern IT operations.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week, a conundrum: On the one hand, researchers say ChatGPT is losing the plot; and on the other, we hear outsourced coding jobs in India will be replaced by AI. (more…)
Postman today announced it has acquired Akita Software to gain access to a platform for monitoring and observing application programming interfaces (APIs).
The first integration of the respective products offered by both companies will arrive in beta this fall.
Postman CEO Abhinav Asthana said the acquisition of Akita Software will make it much simpler for organizations to discover what APIs are being employed across an enterprise. A recent Postman survey found that 28% of developers are now deploying APIs at least once per week.
The Akita Software platform will make it simpler for organizations to discover both rogue APIs that have been created by a shadow IT project and zombie APIs that have been inadvertently left exposed long after they are needed.
Akita Software’s CEO Jean Yang said the integration with Postman’s API management platform will provide a rich source of data that can be used to add artificial intelligence (AI) capabilities to Akita’s API observability platform. For example, generative AI capabilities should make it simpler to create summaries in natural language that explain the calls an API is making to specific data sources.
In addition, the combined company will be in a better position to enable organizations to better secure their APIs after deployment by surfacing anomalous behavior indicative of an API that is being used to exfiltrate data, she added.
The merger with Postman will, in effect, enable the combined entity to provide a complete ecosystem for managing APIs, noted Yang.
Most APIs are used primarily to interconnect internal-facing applications and systems, with a subset used to integrate partners. Only a relatively small percentage of APIs are externally facing in the sense that they expose data to the internet. Many organizations, however, fail to appreciate how quickly an internally facing API can become externally facing over the course of its life cycle. As such, IT teams need tools and platforms that can manage and secure APIs as they evolve.
As APIs continue to play a crucial role in advancing business goals, there is a clear need for increased visibility as the types of APIs employed also continue to expand. Most APIs in use today are based on the REST format, but there are also APIs based on GraphQL, event-driven architecture and various messaging platforms. None of these newer APIs will supplant REST APIs any time soon. Rather, they are being applied to drive additional processes alongside REST APIs.
In the longer term, it’s not clear how many APIs will be managed by the developers that created them versus a centralized DevOps team. However, the more APIs that are deployed in a production environment, the less feasible it becomes for developers to manage their life cycle. The challenge is making sure there is some type of structured workflow in place that, at the very least, makes everyone involved in the process aware that a new API has been created and deployed.