Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: A big-tech consortium goes toe-to-toe with Google Maps, and a big-tech consortium tries to fool AI regulators. (more…)
New Relic today made available a public preview of an application security testing tool that will be integrated into its observability platform.
Esteban Gutierrez, CISO and vice president of information security for New Relic, said the New Relic Interactive Application Security Testing (IAST) will provide DevSecOps teams with the context needed to identify the root cause of a cybersecurity issue down to specific lines of code.
DevSecOps teams will be able to take advantage of IAST to identify vulnerabilities both in code as it is written and after it has been deployed in a production environment without any false positives, he noted.
New Relic achieves that goal using deterministic testing techniques that surface an actual proof-of-exploit using observability data collected from both applications and the underlying infrastructure upon which they depend, said Gutierrez. DevSecOps teams are then provided with guided remediation suggestions, guardrails and tracking tools to both remediate the issue at hand and prevent it from reoccurring, he noted.
New Relic IAST takes advantage of the agent software New Relic provides to collect observability data, which reduces the total cost of DevSecOps by providing IT teams that have adopted the New Relic platform with an integrated set of application security testing tools that doesn’t require them to acquire and manage a separate additional platform, added Gutierrez.
That approach also ensures that application security testing is integrated with the continuous integration/continuous delivery (CI/CD) platforms that New Relic already observes, he added.
The reason most vulnerabilities are not remediated in a timely fashion is the DevOps teams responsible for creating and deploying the required patches lack any context. They often don’t know, for example, how many instances of a vulnerability there might be or the actual level of severity. Without those insights, it becomes exceedingly difficult to prioritize remediation efforts, noted Guttierrez.
As application security requirements become more stringent in the wake of forthcoming legislation, it’s now more of a question of when than if organizations will be required to better secure their software supply chains. The issue DevOps teams face now is finding a way to integrate application security testing tools into existing DevOps workflows without slowing down the pace at which applications are being developed.
Of course, not every vulnerability discovered requires the same level of attention. Depending on its severity and likelihood of being exploited, DevOps teams need to prioritize which vulnerabilities need to be remediated first. There simply are not enough resources available today to fix every vulnerability an application might have. For the foreseeable future, there will remain technical debt involving vulnerabilities that will need to be addressed after an application is deployed in a production environment.
The issue, of course, is that cybercriminals are getting more adept at exploiting those vulnerabilities. The amount of time any DevOps team has to resolve issues before they result in a breach continues to dwindle.
Dynatrace today revealed it has added generative artificial intelligence (AI) capabilities to its Davis engine it uses to apply machine learning algorithms to its observability platform.
Steve Tack, senior vice president for product management at Dynatrace, said that hypermodal approach to AI will allow DevOps teams to take advantage of probabilistic AI capabilities provided by Davis CoPilot that are enabled by large language models (LLMs) originally developed by OpenAI.
The generative AI capabilities effectively provide DevOps teams with a tool that surfaces workflow recommendations via a natural language interface. The recommendations are based on historical data such as sales and customer experience trends, seasonality and cloud application health. It is also able to analyze dependencies across large sets of data while retaining context accessed via the Dynatrace Grail data lakehouse and the Dynatrace Smartscape application visualization and mapping framework.
Dynatrace is now making a case for a multimodal AI platform that uses a common set of metrics, traces, logs, user behavior and topology to enable machine learning algorithms to predict anomalies and causal-AI dependencies to determine the root cause of an IT issue and then leverage generative AI to provide recommendations to resolve it. The company is forecasting IT teams will achieve 10% to 20% productivity improvements year-over-year as a result.
It’s too early to determine the full extent to which a multimodal approach to AI will transform IT management, but it’s clear that as IT operation teams become more productive, more time will be freed up for innovation, noted Tack. Many of the manual tasks that IT teams still need to perform divert time away from building and deploying additional applications, he added.
Naturally, there’s a lot of speculation concerning the impact AI will have on DevOps. Some contend it’s only a matter of time before the entire software engineering process is automated. As those advances are made, the cost of building applications will effectively drop to zero. Others argue that AI will augment DevOps teams in a way that makes it simpler to manage IT at scale using either the same number or possibly even fewer engineers.
The one thing that is certain is that AI will soon be pervasive, which will drive the adoption of automation frameworks as organizations look to operationalize the insights surfaced by AI platforms. As rich as the insights any AI model surfaces might be, they only provide real value when integrated with an automation framework, noted Tack.
Ultimately, most DevOps professionals will not want to work for organizations that don’t provide them with AI tools that make it more likely for them to be successful. Organizations that embrace AI may not have a sustainable competitive advantage when every other organization is doing the same, but those that don’t will soon be left behind. Those that succeed will benefit from managing application environments at a previously unprecedented level of scale at minimal additional cost. The challenge is determining which tasks will be automated with an eye toward planning how DevOps roles will need to evolve.
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.
Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.
Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.
The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.
We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:
Indeed.com
SAP
San Francisco, California
DevOps Engineer
$141,378 to $162,000
CareeerBuilder.com
Citigroup
Tampa, Florida
DevOps Lead Engineer
$110,090 to $165,130
Dice.com
Cognizant Technology Solutions
Seattle, Washington
xStore DevOps Lead
$114,365 to $127,538
J.Crew
New York, New York
Lead DevOps Engineer
$108,800 to $136,000
SimplyHired.com
Hearst Media Services
New York, New York
DevOps Engineer
$98,900 to $125,000
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week, a conundrum: On the one hand, researchers say ChatGPT is losing the plot; and on the other, we hear outsourced coding jobs in India will be replaced by AI. (more…)
Google today made available an integration platform-as-a-service (iPaaS) capable of invoking a range of methods to integrate applications.
Initially developed for the Apigee application programming interface (API) management platform Google acquired in 2016, the Application Integration service can now, for example, also consume a publish and subscribe event or an event driven through a Salesforce platform.
Amit Zavery, vice president and general manager for Google Platform, said the Application Integration service provides IT organizations with all the benefits of an iPaaS without requiring them to stand up and manage an integration platform themselves.
The Google Application Integration service also provides access to a Visual Integration Designer tool that can be used to build workflows using a low-code tool. In total, there are now more than 75 connectors that can be used to integrate multiple Google Cloud services and third-party platforms that can run in either a cloud or on-premises IT environment, said Zavery.
In general, visual tools are transforming how integrations are created and expanded within organizations, noted Zavery. Rather than using lower-level procedural code, a visual tool enables developers to employ low-code to create integrations. That makes it simpler to collaborate with business users that can now more easily participate in developing workflows.
In fact, in some cases, business users, otherwise known as citizen developers, have enough technical acumen to create their own workflows using low-code tools.
There are, naturally, going to be plenty of complex integration challenges that will require procedural code, but the bulk of the integrations required today are not especially complex.
Regardless of who creates the integration, the number of them being employed across an enterprise organization continues to increase as more digital business transformation initiatives are launched. Developers are not going to be able to keep pace with the demand for those integrations if they rely solely on procedural code. The only way to effectively reduce the backlog for integrations is to rely more on visual tools to construct them. In most cases, the integration being created is relatively trivial. The only reason it wasn’t created sooner is there are not enough developers available to complete that task using procedural code.
There are, of course, no shortage of iPaaS options available. As more workloads are deployed in the cloud, Google is betting the center of gravity for integration will shift toward the places where modern microservices-based workloads are deployed to reduce overall latency.
It’s not clear whether organizations still view integration as an afterthought versus employing an integration platform around which all applications revolve. That latter approach tends to reduce the total cost of integration when compared to using multiple point products that are not managed via single framework, noted Zavery.
Ultimately, IT teams that adopt an iPaaS are able to focus more on higher-value IT tasks. The issue is determining which integration projects really require professional developers with lots of integration expertise and which, via a low-code tool, can be handled by almost any developer.
Postman today announced it has acquired Akita Software to gain access to a platform for monitoring and observing application programming interfaces (APIs).
The first integration of the respective products offered by both companies will arrive in beta this fall.
Postman CEO Abhinav Asthana said the acquisition of Akita Software will make it much simpler for organizations to discover what APIs are being employed across an enterprise. A recent Postman survey found that 28% of developers are now deploying APIs at least once per week.
The Akita Software platform will make it simpler for organizations to discover both rogue APIs that have been created by a shadow IT project and zombie APIs that have been inadvertently left exposed long after they are needed.
Akita Software’s CEO Jean Yang said the integration with Postman’s API management platform will provide a rich source of data that can be used to add artificial intelligence (AI) capabilities to Akita’s API observability platform. For example, generative AI capabilities should make it simpler to create summaries in natural language that explain the calls an API is making to specific data sources.
In addition, the combined company will be in a better position to enable organizations to better secure their APIs after deployment by surfacing anomalous behavior indicative of an API that is being used to exfiltrate data, she added.
The merger with Postman will, in effect, enable the combined entity to provide a complete ecosystem for managing APIs, noted Yang.
Most APIs are used primarily to interconnect internal-facing applications and systems, with a subset used to integrate partners. Only a relatively small percentage of APIs are externally facing in the sense that they expose data to the internet. Many organizations, however, fail to appreciate how quickly an internally facing API can become externally facing over the course of its life cycle. As such, IT teams need tools and platforms that can manage and secure APIs as they evolve.
As APIs continue to play a crucial role in advancing business goals, there is a clear need for increased visibility as the types of APIs employed also continue to expand. Most APIs in use today are based on the REST format, but there are also APIs based on GraphQL, event-driven architecture and various messaging platforms. None of these newer APIs will supplant REST APIs any time soon. Rather, they are being applied to drive additional processes alongside REST APIs.
In the longer term, it’s not clear how many APIs will be managed by the developers that created them versus a centralized DevOps team. However, the more APIs that are deployed in a production environment, the less feasible it becomes for developers to manage their life cycle. The challenge is making sure there is some type of structured workflow in place that, at the very least, makes everyone involved in the process aware that a new API has been created and deployed.
Webb.ai today opened an early access program access to a Continuous Automated Root Cause Analysis platform that uses artificial intelligence (AI) combined with a knowledge graph to dynamically keep track of and analyze changes to IT environments.
Manish Gupta, CEO of Webb.ai, said the platform uses a mix of machine learning algorithms and generative AI capabilities based on large language models (LLMs) to aggregate alerts into higher-order insights that are presented in natural language to members of a DevOps team.
That approach differs from legacy approaches because it tracks causal relationships between changes versus relying on probabilistic models that tend to create a lot of false positives, he noted.
Webb.ai is also taking advantage of Kubernetes clusters to enable its platform to scale up and down as needed when analyzing data, added Gupta. That platform is also more efficient than other approaches to observability that require IT teams to store massive amounts of data. In contrast, the Continuous Automated Root Cause Analysis automatically surfaces anomalous events that DevOps teams can choose to save rather than requiring them to save all the metrics, logs and traces that would otherwise need to be tracked, he noted.
Most IT incidents can be traced back to the most recent changes made to an IT environment. The challenge is as IT environments have become more complex, it’s not feasible for humans to keep track of those changes without relying on AI and a knowledge graph, said Gupta.
As businesses become more dependent on software to drive digital processes, the cost of downtime is exponentially increasing. The need to identify the root cause of an IT incident as fast as possible has become a critical requirement, he added.
Webb.ai doesn’t see AI technologies replacing the need for DevOps professionals and site reliability engineers (SREs) for at least another 10 to 15 years. In the meantime, many tasks that today are completed manually will be increasingly automated, said Gupta. A DevOps engineer dragged out of bed at 2:00 A.M. to address an issue does not want to have to sift through alerts. Instead, generative AI tools will summarize the issue at hand with recommendations on resolving it, noted Gupta. In effect, DevOps teams will be augmented by AI so they can manage IT environments at even higher levels of scale, he said.
There is always going to be some sense of fear and loathing when it comes to AI, but ultimately, AI should reduce the burnout rates that today adversely affects any organization’s ability to retain DevOps professionals. Far too much time is spent trying to identify the root cause of a slowdown in a cloud-native application’s performance that could be caused by any number of issues involving one dependency or another. The frustrating thing, of course, is that while it may take days to identify the root cause of an issue, it often takes just a few minutes to resolve.
It’s not every day that a well-established technology provider announces they are building their solutions on a new cloud technology stack, but that’s what Splunk announced at its .conf23.
“…[O]ne of the most exciting [announcements] is Splunk’s new strategic partnership with Microsoft to build Splunk’s cloud solutions natively on Microsoft Azure. Together, our approach will enable our joint customers to migrate, modernize and grow their environments with end-to-end cloud and hybrid visibility at scale,” Splunk President and CEO Gary Steele said in a Splunk blog post this morning.
Why such a bold move, might you ask? “Splunk’s strategic partnership with Microsoft to build Splunk natively on Azure demonstrates our commitment to advancing digital resilience and meeting our customers where they are…” Well, indeed, a big, big draw is the vast landscape of customers building and operating applications in Azure. While Gary didn’t share too many details about specific new capabilities or offerings yet, customers will get to use their Azure credits for Splunk offerings. I suspect two other important underlying factors made such a tech marriage happen: Open source and AI.
First, Microsoft is far removed from the days of being viewed as a pariah by the open source community and is now a leader and contributor to well-known open source projects (OpenTelemetry, to name one); it abandoned its proprietary service mesh tech and got behind Istio (a recently-graduated CNCF project) and now owns the largest open source repository ecosystem with GitHub.
While Splunk is by no means a noob when it comes to incorporating AI into products, the company continues to announce new AI capabilities, including a generative AI chat interface with a preview of Splunk AI Assistant, an improved version of the former SPL Copilot. Other AI-related announcements include Splunk App for Data Science and Deep Learning (DSDL) 5.1, which allows customers to leverage LLMs to build and train models with their domain-specific data for text summarization and text classification use cases. Stay tuned for more from .conf 2023!
At its .conf23 conference, Splunk today revealed it added a slew of capabilities to its portfolio of operational analytics tools, including an assistant that leverages generative artificial intelligence (AI) capabilities that use large language models (LLMs) the company developed to enable IT teams to use natural language to invoke the Splunk Processing Language (SPL).
In addition, Splunk is also previewing OpenTelemetry Collector, an add-on that uses open source agent software being developed by the Cloud Native Computing Foundation (CNCF) to capture metrics and traces. It is designed to enable IT teams to use OpenTelemetry alongside existing agent software that Splunk uses to capture metrics.
Tom Casey, senior vice president for products and technology at Splunk, said the domain-specific LLMs that the company created enable Splunk Assistant to write or explain customized SPL queries in a way that augments rather than replaces the need for IT professionals. Splunk Assistant is designed to surface recommendations to optimize IT environments to reduce toil rather than automate entire processes, he noted.
Splunk is adding other tools infused with machine learning algorithms to its portfolio. These include the Splunk App for Anomaly Detection and an Outlier Exclusion for Adaptive Thresholding to detect and omit abnormal data points that has been added to version 4.17 of the Splunk IT Service Intelligence platform.
In addition, Splunk is previewing an ML-Assisted Thresholding tool for Splunk IT Service that uses historical data and patterns to create dynamic thresholds with a single click.
The company is making available a 5.4 update to the Splunk Machine Learning Toolkit (MLTK) 5.4 and a Splunk App for Data Science and Deep Learning (DSDL) 5.1 toolkit that provides access to additional data science tools that can extend MLTK to enable organizations to build their own custom LLMs and AI assistants.
Finally, Splunk added Unified Identity to make it simpler to access Splunk Cloud Platform and Splunk Observability Cloud along with an update to Splunk Cloud Platform and Splunk Enterprise that make it simpler to ingest, route, search and export data.
It’s still early days as far as the application of generative AI is concerned, but it’s already clear that the way IT is managed is about to be transformed. Coupled with tools such as OpenTelemetry that make it less expensive to collect massive amounts of data, the opportunity to train LLMs that streamline a wide range of processes is immense. Those capabilities won’t replace the need for humans to manage those processes, but they will most certainly cause staff realignments as many manual tasks become increasingly automated.
In fact, it’s hard to imagine an IT team that would not want to take advantage of AI capabilities to simplify the management of complex IT environments that now function at a level of scale that few IT professionals can successfully manage on their own. One way or another, AI is going to be broadly applied to IT workflows. The only thing left to be seen now is the ultimate impact.