Category: Sponsored Content

AI, the New Hero of Software Development … or Anti-Hero?
Artificial intelligence (AI) can be a hero or an anti-hero in software development, depending on your implementation approach. According to the 2024 DORA Accelerate State of DevOps Report, AI adoption shows promise with 75% of respondents reporting positive productivity gains, but also reveals unexpected challenges, including a 7.2% reduction in software delivery stability.

The key is to position AI as a supportive partner. AI should be utilized to enhance human expertise rather than replace it.

AI Is Promising, but Let’s Stay Suspicious

AI has been rapidly infiltrating software development for almost two years now. Coding assistants, automated testing tools, and AI-powered analytics promise to transform how we build applications, and some early adopters have shown impressive results. When AI first entered development workflows, it tackled well-defined problems such as code completion, simple test generation, commenting, and draft documentation with reasonable success.

But that initial enthusiasm has given way to more complex realities. Modern software development involves intricate systems, multi-cloud deployments, complex security requirements, and accelerating delivery expectations. AI has shown both remarkable capabilities and concerning limitations in this environment.

After hearing customer stories about dozens of AI implementations, I’ve found the story isn’t as binary as “hero” versus “villain”—it’s more like “hero” versus “erratically-troubled-if-ultimately-victorious anti-hero.” The reality of AI is nuanced—and much more interesting, depending very much on the implementation approach, governance scheme, and where organizations choose to apply AI technologies.

The Toil Problem Is Real and Measurable

Every developer knows the frustration of “toil”—those manual, repetitive tasks that consume time without adding much value. Toil isn’t just a minor annoyance. The 2024 DORA report confirms that this challenge remains persistent, with developers continuing to struggle with time allocation between valuable work and repetitive tasks.

Recently, I had the chance to discuss AI heroism and anti-heroism with the Chief Product Officer of CloudBees, Shawn Ahmed. CloudBees is an enterprise DevOps solutions provider and was co-founded by Jenkins creator Kohsuke Kawaguchi, so it has been in a good position to observe the thousand ways AI has been injected into software development. Their internal research indicates developers spend about half of their time triaging test failures, waiting on build times or addressing security issues—and as little as 20–30% of their time writing code. As Ahmed pointed out to me, this inefficiency seems like it wouldn’t be tolerated in most other industries; it is like accepting a manufacturing line that’s only 20–30% effective.

An example of CloudBees’ approach to incorporating AI productively and helpfully is their continuous integration (CI) capability. It analyzes historical pipeline data to identify patterns in successful deployments and uses AI to provide suggestions for future deployments. This eliminates hours of configuration work, thanks to AI’s ability to base pattern recognition on thousands, if not millions, of data points.

From CloudBees’ perspective, AI in software development isn’t a replacement technology in dev but rather what Ahmed characterizes as a “companion.” AI’s best role is handling routine tasks to preserve and expand the human developer’s time performing creative and strategic work.

Three Implementation Models, Three Different Outcomes

It’s clear that not all AI implementations are created equal. I see three distinct approaches emerging, each with dramatically different results:
1. The Replacers: Some organizations approach AI to reduce headcount by automating development tasks. This model typically delivers poor results, fundamentally misunderstanding both AI capabilities and the creative nature of software development. The DORA research supports this concern, showing that while AI adoption is widespread, 39.2% of respondents reported having little or no trust in AI-generated code, indicating that successful implementations require human oversight.
2. Tools First!: These organizations adopt individual AI tools without a cohesive strategy or governance framework. This approach delivers mixed results—productivity improves in specific areas, but in many cases at the cost of quality, security, or long-term maintainability. The DORA findings highlight this challenge, showing that despite AI’s positive impact on individual productivity and code quality, it can lead to decreased software delivery performance.
3. The Augmenters: The most successful approach treats AI as an amplifier of human capabilities rather than a replacement. The DORA research validates this model, showing that AI adoption leads to meaningful improvements: when AI adoption increases by 25%, individual productivity increases by 2.1%, flow improves by 2.6%, and job satisfaction rises by 2.2%.
CloudBees is built on this augmentation philosophy. According to Ahmed, AI handles pattern recognition and repetitive tasks while humans make decisions on strategic matters. Their DevSecOps solution demonstrates this approach by using AI to identify security vulnerabilities while preserving human authority over remediation strategies. CloudBees’ Value Stream Analytics uses AI to spot workflow inefficiencies while leaving process improvement decisions to the teams who understand the organizational context.

Making AI the Hero of Your App Dev Story

Here are five critical success factors that determine whether AI becomes a hero or an anti-hero for you:
1. Target high-toil activities first. Successful implementations start with well-defined, repetitive tasks where AI can deliver immediate value. CloudBees’ recommended targets include test generation, pipeline optimization, and code reviews, including areas where AI can significantly reduce manual effort.
2. Establish governance first, deploy AI second. Organizations seeing positive results implement governance frameworks before widespread AI adoption, defining, for example, appropriate use cases, verification requirements, or clear boundaries for AI autonomy.
3. Invest in developer education. Contrary to some narratives, successful AI implementation requires more skilled developers. Top-performing organizations invest in training programs that help developers understand both AI capabilities and limitations.
4. Integrate rather than isolate. Rather than adopting disconnected point solutions, effective organizations implement AI capabilities that integrate throughout their delivery pipeline. CloudBees’ platform takes this approach, connecting AI capabilities from requirements analysis through production monitoring.
5. Measure meaningful outcomes. The most effective implementations have moved beyond measuring code generation metrics. Instead, they focus on quality improvements, security posture enhancements, and business impact indicators that reflect the true value of AI adoption.
AI Is Your Enthusiastic Partner, Not Your Replacement

Successful AI implementations in app dev seem to share the common characteristic of using it as a complementary force instead of as a replacement. AI is adept at the mundane, repetitive tasks that drain motivation and attention among developers and increase their toil. It lets humans focus on innovation, customer experience, and ultimately, business value.

According to Ahmed, CloudBees envisions a future where AI becomes increasingly personalized to individual developers. He predicts that within two years, developers will likely work with multiple AI companions tailored to their specific preferences and working styles. This personalization aspect represents an important evolution beyond today’s more standardized AI tools.

A particularly noteworthy perspective I got from research and vendor discussions is the relationship between AI adoption and team scaling. While some organizations initially approach AI to reduce headcount, the data suggests the opposite effect. As Ahmed noted in our discussion, the more effective approach isn’t using AI to reduce a 10-person team to 5, but rather leveraging AI to assist that 10-person team in achieving what would have previously required 15 people. This is the proactive, business-building “scale up, not down” perspective that can help propel an organization to its goals.

I’ve concluded that today, the hero of software development isn’t AI. Not AI alone, but it is no longer purely human expertise either. The true hero is the partnership between them, working in concert to create outcomes neither could achieve independently.
June 17, 2025
DevEx Got You This Far: What’s Next for True DevSecOps Maturity?

The journey toward integrating security into the fast-paced world of DevOps has seen significant strides, largely thanks to a much-needed focus on the developer experience (DevEx).

Collectively, the AppSec community and industry have moved mountains in making security tools less intrusive, integrating them into developer workflows, and acknowledging that developers need security as a help, not a hindrance. A focus on DevEx has been crucial, acting as the bridge to bring security considerations earlier into the development lifecycle while simultaneously enhancing the developers’ daily work.

The numbers don’t lie: Checkmarx’ recent DevSecOps Evolution 2025 report reveals that a majority of the organizations we surveyed—58% to be exact—are at Stage 2 maturity, a transition stage primarily focused on DevEx: They’ve integrated tools into IDEs, offer formal training, and the relationship between security and development teams is generally positive. While these developments signify important progress, this DevEx-focused stage represents a critical foundation rather than the ultimate destination in achieving mature DevSecOps.

DevEx Isn’t the Destination

Organizations haven’t yet achieved true DevSecOps maturity. They haven’t yet embedded security through shared culture, governance and aligned goals.

And while developer experience is essential, it’s just one brick of the DevSecOps foundation. To achieve the ultimate goal—high-performing, secure code delivered at the pace of business—organizations need to move beyond DevEx to a true culture of shared responsibility and trust.

Despite better tools and training, developers still report spending a significant chunk of their week—often over 17 hours—on security tasks. Trust in tool results is often hampered by false positives impacting velocity, and a lack of shared goals that align development and AppSec priorities means security can still feel like a separate concern rather than a shared objective. We’ve improved the experience; but haven’t fully embedded security seamlessly and at scale.

The Scale – and Stakes – Are Growing

The need to mature beyond DevEx is especially urgent given the accelerating complexity and scale of modern application development. Enterprises are managing sprawling codebases and adopting tools that increase both speed and risk. Checkmarx alone scans over 450 billion lines of code every month, and that figure is only rising.

At the same time, the software supply chain is expanding at an unprecedented pace: approximately 700,000 new NPM package versions are introduced monthly, each one a potential point of exposure.

Add to this the growing adoption of AI-assisted coding tools and agentic AI systems that generate or modify code autonomously, and the attack surface multiplies further.

On the other hand, development productivity requirements have never been higher, with organizations tracking DORA metrics and looking for AppSec solutions like Checkmarx’ that deliver on security while optimizing MTTR and other DORA metrics.

Achieving truly mature DevSecOps—Stage 3, where only 30% of organizations currently reside—requires moving beyond just making security palatable for developers. It demands a deeper, more strategic integration built on shared culture, robust governance, trusted automation, and aligned success metrics.

Checkmarx’ Five Pillars of DevSecOps Maturity

At its heart, DevSecOps is a cultural evolution. It’s about merging the “move fast” ethos of development with the “protect everything” mandate of security to achieve a common goal of delivering secure, high-performance code at the speed the business requires. To progress from Stage 2 (DevEx-focused) to Stage 3 (Mature DevSecOps), organizations need to build on their DevEx foundation with five key elements:

1. Shared Metrics

You can’t improve what you don’t measure, yet our research shows a surprising lack of consensus on DevSecOps metrics. While many organizations we surveyed track top vulnerable applications (52.1%) and mean time to detect vulnerabilities (51%), only 28.3% measure mean time to remediate—arguably the most critical metric for balancing security and velocity.

True DevSecOps maturity requires security and development teams to align shared metrics that measure how effectively they work together, not just how many vulnerabilities they find.

2. Collaborative Governance

In mature DevSecOps, security and development teams jointly establish policies, standards and processes. Our data shows this remains rare—when asked to describe the relationship between security and development in one word, respondents most frequently chose “trust,” “policy,” and “risk,” indicating an evolving but not yet fully collaborative relationship.

For 88% of organizations, the absence of shared metrics, policies and governance suggests security and development teams are aligning but are still struggling to form a fully collaborative governance.

3. Advanced Security Education

While essentially all developers have access to training according to our study, the model needs to evolve. Traditional formal training programs still have value, but the premium on developer time makes standalone training challenging.

Mature DevSecOps organizations are pivoting toward just-in-time training that delivers contextual guidance when and where developers need it. Providing a step further is in-the-moment training with inline feedback from within the IDE, allowing developers to learn while maintaining their workflow.

4. Trusted Automation

Our study showed that one in five (20%) of the organizations we surveyed have no AppSec automation in place. Even among the remaining 80%, adoption of key automation capabilities remains low—only 32% have automated security testing during change management, and just 30% auto-populate security tickets with remediation guidance.

The far-from-optimal adoption rate of automation cannot be attributed to a lack of technological solutions but rather appears as a matter of trust and culture gaps between security and development teams. Without shared governance and metrics, attempts to “automate everything” typically fail because there’s no foundation of trust on which to build automations that both teams will embrace.

5. Velocity-Security Balance

The ultimate goal of DevSecOps is to deliver high-performing, secure code quickly. Yet 66% of developers report that false positives impede their velocity, and 28% say their AppSec teams lack the tools or resources to help them fix security issues efficiently.

Mature DevSecOps organizations recognize that speed isn’t just about how quickly tools scan—it’s about how quickly developers can remediate issues without disrupting their workflow. This requires prioritized, actionable results with clear remediation guidance, not just faster scanning.

The Role of Leadership

Making the transition to DevSecOps takes more than just good tooling—it requires strong leadership. Security leaders must be willing to trade control for collaboration and build systems based on partnership, not policing. Engineering leaders must recognize that security is essential to velocity, not an obstacle.

This shift requires executive buy-in and strategic commitment. It means moving beyond budget conversations centered on compliance and instead investing in the long-term health of your codebase and your teams.

The Road Ahead

As the DevSecOps Evolution 2025 report shows, most organizations are still in the middle of the journey. That’s not a failure. It’s an opportunity. DevEx helped bridge the gap between developers and security, and now it’s time to build the foundation that inspires them to run together. By moving beyond DevEx as the sole focus and embracing these pillars of mature DevSecOps, we can finally embed security seamlessly at scale, achieving the ultimate objective of delivering high-performing, secure code without compromising speed.

The transformation won’t happen overnight. It requires sustained investment in building trust between security and development teams. But organizations that successfully make this journey will gain the significant competitive advantage of more secure and advanced applications built with less friction and lower costs.

As we look to 2026 and beyond, the most successful organizations will be those that move beyond seeing security as just another feature of the development process. Instead, they’ll embrace it as an integral, collaborative aspect of delivering high-quality software in a digital world with ever-rising security risks.

At Checkmarx, we believe the future of software development is secure by design—and it starts with mature DevSecOps. Let’s keep moving forward.

June 9, 2025
Dynatrace Ushers in the AI-Powered Future of Observability
Observability — the ability to measure and understand the internal state of a system by analyzing the data it produces — has come a long way in the past 15 years. Companies such as Dynatrace have led the charge, helping businesses transform how they monitor and manage their systems. At the recent KubeCon + CloudNativeCon Europe 2025 conference, Alois Reitbauer, chief technology strategist at Dynatrace, shared his insights on the evolution of observability and how artificial intelligence (AI) is now reshaping it.

The Evolution of Observability

When Reitbauer first joined Dynatrace nearly two decades ago, observability was a nascent concept. Back then, some viewed it as a reactive tool only used to address immediate problems. Early challenges centered around collecting data in real time without disrupting systems, and the focus was on finding the needle in the haystack with the limited tools available.

Over time, Dynatrace evolved to incorporate more advanced features, including visual analytics and automated solutions. A significant turning point was the introduction of AI over 12 years ago, which enabled predictive causal analysis and automated root cause identification. This shift transformed observability from reactive to proactive and predictive. Today, observability yields actionable steps to improve system performance and security. It can provide deep insights into how your technology systems are functioning, insights that help you identify and resolve issues, optimize system performance and ensure reliability. “The tools are no longer simply passive, just showing you the data,” Reitbauer said. “Now, it’s about taking action,” he continued.

The Three Pillars of Actionable Observability

According to Reitbauer, modern observability is built on the following three key pillars enabled by AI:
1. Self-Healing: Automating the resolution of system issues without human intervention.
2. Self-Protecting: Enhancing security by detecting vulnerabilities and providing proactive solutions.
3. Self-Optimizing: Continuously adjusting systems for better performance, cost efficiency and streamlined business processes.
These pillars redefine how organizations make observability an indispensable part of their operations.

The Role of Generative AI

Of course, AI is top of mind today, especially in environments where patterns in enormous amounts of data need to be identified instantly. Generative AI represents a significant paradigm shift, even larger than the industry’s previous transition from monoliths to microservices. At KubeCon, Reitbauer noted that while early conversations about AI raised concerns about job displacement, the conversation has since evolved. Today, the focus has shifted to how AI can enable professionals to do their jobs more effectively.

Businesses are now exploring generative AI’s potential to support dynamic, real-time system monitoring and management. Dynatrace has already incorporated agentic AI components, such as autonomous root cause analysis and preventive operations, to reduce operational workloads and improve system efficiency. These tools, which don’t require human intervention, are designed to handle repetitive tasks, allowing IT teams to focus on high-value initiatives that drive innovation. “I see agentic AI as the biggest paradigm shift yet,” said Reitbauer.

Preparing for the Next Wave

Reitbauer emphasized the importance of using AI as a competitive advantage, especially as businesses adapt to new markets and technologies. He underscored the need for organizations to automate routine tasks and focus on strategies that create real value for their customers. By doing so, companies can better position themselves to thrive in today’s increasingly AI-driven landscape. ”You don’t want to be stuck with the past, just running things that you can easily automate,” he said.
April 16, 2025
Unifying VMs and Containers on a Single Platform

Why the Divide No Longer Makes Sense

When it comes to traditional vs. modern apps, the days of making a binary choice are long gone. Organizations must rely on both, as many traditional business-critical applications often run on virtual machines, while modern applications are typically container-based. Yet, inexplicably and to their detriment, many enterprises still treat virtual machines (VMs) and containerized apps as separate entities—splitting their infrastructure and platforms into two distinct halves. The problem? Each half requires its own licenses, its own management, and its own financial and operational overhead. This results in inefficiency multiplying at an alarming rate—slowing innovation, increasing costs, and creating operational headaches that could (and should) be avoided.

Imagine an IT world where traditional virtual machines and modern containerized apps coexist seamlessly on one unified platform. No duplicate infrastructure. No added costs. No separate teams managing different silos. No unnecessary complexity. It shouldn’t be hard to imagine. IT executives already recognize that future success demands a fundamental shift in how infrastructure is managed to drive agility, efficiency, and resilience–not just technology modernization.

The Advantages of a Single Platform for VMs and Containers

When you consolidate your workloads, you unlock a host of benefits. Below are three of the most impactful:

1. Consistent Operating Model

Managing VMs and containers on separate platforms results in duplication and inefficiency across the entire IT ecosystem:

●      Two sets of operations, policies, self-service portals, APIs, and skill sets.

●      Fragmented visibility, root cause analysis and troubleshooting across infrastructure and workloads.

●      Higher total cost of ownership (TCO) due to redundant systems and fragmentation.

In contrast, using a single platform like VMware Cloud Foundation (VCF) for both workloads delivers:

●      Unified operations, policies, APIs, and self-service portals

●      Holistic visibility across VMs and Kubernetes clusters

The result? A unified environment that allows more efficient app delivery and lower TCO.

2. Higher Asset Utilization & Better Capacity Planning

Fragmented infrastructure leads to resource underutilization and inflated costs. A unified platform improves asset use and planning by:

●      Run more VMs and Kubernetes workloads per server—requiring fewer physical servers to meet demand.

●      Reduce operating costs related to space, power, cooling, monitoring, and management.

●      Leverage efficient memory management and intelligent workload scheduling.

The impact? Increased server utilization, fewer hardware purchases, and simpler holistic capacity planning process.

3. Reduced Licensing Costs

It’s simple math. Running separate platforms for VMs and containers effectively doubles software licensing costs—forcing organizations to purchase, manage, and maintain two sets of platform licenses. A unified approach eliminates this redundancy by reducing licensing costs from two platforms to one—covering both VM and Kubernetes workloads under a single framework

The Time Is Now

Now is the time to converge your traditional VM-based and modern container-based applications, and VMware Cloud Foundation provides the opportunity to do so.

With VMware Cloud Foundation, unification isn’t just possible—it’s the only way to ensure long-term success. Customers have long trusted VMware’s superior virtualization capabilities to deliver on performance, availability, and security requirements for their mission critical VM-based applications. And with integrated compute, storage, networking, and management, VCF has long delivered everything enterprises need to modernize and optimize—without relying on bolt-on components or complex workarounds. The inclusion of vSphere Kubernetes Service, at no extra cost, provides a single platform to deploy, provision, and manage both virtual machines and container-based applications—at scale. No silos. No added complexity. No compromises.

Delaying this shift only adds to technical debt, increases complexity, and makes future migrations more difficult. But the organizations that embrace this shift today will be the ones leading the digital economy tomorrow.

Stop waiting. Unify your infrastructure, streamline your operations, and position your organization for sustained success and lower TCO. This isn’t a mere technical evolution—it’s a strategic decision.

April 10, 2025
APM Alone Is Not Enough: Enter Internet Performance Monitoring
Key Takeaways: Application performance monitoring (APM) was built for a world that no longer exists—where applications ran in controlled environments. Cloud, APIs and the Internet are the substrate of digital experiences today, making Internet Performance Monitoring (IPM) an attractive approach to achieving the true visibility required to ensure reliability, resilience and user satisfaction.

APM Was Great, Until it Wasn’t

Application performance monitoring has been a cornerstone of IT operations for decades, tracking application health and troubleshooting performance issues. And for a long time, it has been enough. When APM was born, applications lived in a controlled environment—on-premises, usually monolithic, running on dedicated infrastructure. Even moves to off-premises cloud did not change this significantly for many enterprise applications. So if performance suffered, APM had the vision to be able to tell you why.

But that world no longer exists. Modern applications are built on cloud services, microservices and application programming interfaces (APIs); and they stretch across multiple providers, platforms, networks and geographies. Arguably, the internet is now the enterprise network. APM wasn’t designed for this; it tells you how well your backend is running but it won’t tell you why users in Singapore are experiencing slow load times while everything looks fine in Virginia.

This is something that was emphasized repeatedly in a recent conversation between Mitch Ashley, an analyst at The Futurum Group, and Mehdi Daoudi, CEO of performance management platform vendor Catchpoint. Mehdi pointed out that traditional monitoring approaches fail to account for external factors like ISP congestion, CDN slowdowns, and DNS failures—all of which can degrade user experience without triggering a single APM alert.

Addressing the Internet-Driven World

A few thoughts:
1. The Internet Is Your Platform
Your users aren’t just sitting in your office. They’re accessing essential services from a web of ISPs, mobile networks, VPNs, and clouds, across the world. APM will tell you that your database query is executing efficiently, but it won’t tell you that a congested ISP peering point is causing unavailability in Central Europe.

Catchpoint’s approach is what they call Internet performance monitoring (IPM). Mehdi described the company’s IPM as founded on a global set of real-world intelligent agents that continuously track network conditions, ISP latency, peering issues, and so forth. This gives you visibility into global performance problems so you can mitigate issues beyond your own systems, uncontrolled by you. If you can’t see the entire delivery chain, you can’t fix what may currently be affecting your users.
1. Third-Party Dependencies Can’t Be a Blind Spot
Modern applications rely on a messy web of APIs, SaaS integrations, and cloud services public and private. Payments, authentication, analytics, content delivery, and on and on—you know best for your applications—are handled by third parties. When one of them fails, your users don’t know or care whose fault it is. They turn to you.

As Mehdi explains it, the failure of a third-party service is still your problem—your brand suffers the damage, and your team deals with the fallout. APM provides insight into your own code and infrastructure while IPM gives you visibility into everything else—monitoring DNS resolution times, tracking API availability and latency, and catching outages and service health issues from your third-party providers before they affect you.
1. Network Performance Is the Too-Often-Overlooked Failure Point
Your application’s performance is only as good as the network that delivers it. Packet loss, BGP misconfigurations, ISP throttling, access attacks beyond the VPN, and so many other issues APM can’t catch can bring an application to its knees.

IPM provides continuous visibility into the network pathways between users and your application so you know exactly where performance bottlenecks or choke points are—whether it’s an overloaded CDN node or an ISP routing issue.

IPM Can Also Improve CI/CD and Release Management

As you modernize on so many fronts, you’re pushing code faster than ever. CI/CD pipelines that are humming deploy new releases multiple times a day. But here’s the problem: if your testing and monitoring stop at the application layer, you’re not catching performance issues that arise outside your systems.

IPM can address that potential source of release snags and rollbacks. Catchpoint, for example, integrates directly into CI/CD workflows so you can detect and mitigate performance degradations just as rapidly as you release—and before users feel them. Here’s how:
- Internet-facing services are monitored as part of every deployment. Before a release, IPM can simulate real-world traffic from multiple regions, ISPs, and cloud environments to catch performance regressions early.
- Rollbacks are automated. If a release introduces slowdowns due to external dependencies—like a third-party API latency spike—IPM data can trigger automated rollback policies and maintain application service health before you might even know of the issue.
- Network resiliency is ensured as code. IPM enables organizations to treat Internet health as part of their infrastructure monitoring, embedding network performance thresholds into CI/CD pipelines.
A New Equation: APM + IPM = Full Observability

I think I have been clear enough here that I don’t think APM is “dead.” Far from it. It remains essential for tracking application health, debugging issues, and optimizing backend performance. But APM alone is like checking your car’s drivetrain and suspension while ignoring the road conditions. If the highway is full of potholes, it doesn’t matter how well the engine runs.

Pairing APM with IPM gives operations and platform engineering teams:
- End-to-end visibility, from backend code execution to real-world Internet conditions.
- Faster root cause analysis by correlating internal and external performance issues.
- A proactive, automated approach to monitoring, reducing downtime and user-experience failures that’s comprehensive, and therefore more effective.
APM was built for the previous generation of application architectures. IPM is built for the way applications run today. Your organization depends on the Internet just like everyone else’s, so you need to monitor the Internet’s effect on your applications.

As Mehdi put it, “If you don’t monitor the Internet, you’re not monitoring your business.” Anything less and you’re flying blind.

Want to learn more? Check out Catchpoint’s blog or their latest SRE Report for deeper insights into the future of monitoring.
March 7, 2025

DevSec Relationship Status: It’s Complicated (But Fixable)

Remember that plastic Fisher-Price Shape Sorter from when you were a kid, where you had to fit different-shaped colorful blocks into their matching slots? And that oddly satisfying moment when the green triangle block slid out of your fingers and landed perfectly into place?

That tiny ASMR-inducing thrill of making all the parts of a system slide seamlessly into their place is alive within every DevOps architect or platform engineer. However, with modern-day DevOps infrastructure, that thrill often dissolves into frustration.

Fragmented security tools that weren’t built for DevOps pipelines, can often refuse to fit neatly into their workflows. But the challenge extends far beyond mismatched tools – it’s a clash of cultures. While developers race to meet relentless delivery deadlines in a cloud-native world, security teams watch their risk exposure expand with every deployment. Both teams remain entrenched in their separate realities, speaking different languages, chasing different goals.

How Serious is the DevSec Dissonance? Industry Data Speaks

In Checkmarx’ December 2024 AppSec Survey, performed by Visible Impact, a division of The Futurum Group, organizations were asked what’s standing in their way of optimal application security. The answers tell a familiar story:

38% of respondents say that a top problem they face is the eternal balancing act between speed and security.

29% report that making their security tools play nice with DevOps pipelines is a top challenge.

19% are wrestling with different processes for different security tools.

14% point to the elephant in the room: Poor collaboration between security and development teams

I’m not here to bring you down, of course. There’s a solution, but it’s not a single tool, integration, or a fancy new dashboard. It’s a guiding principle designed to ‘Make It All Work Together.’ – a call for a deep shift in the paradigm of how development and security interplay.

Toll of a Cultural Divide

Security and development evolved as distinct disciplines, each with their own tools, methodologies, and metrics.

Security teams emerged from risk management and compliance, while development teams were born in the age of agile and continuous delivery. Most security tools have been designed with security teams in mind, neglecting the needs of development, and vice versa.

In today’s enterprise environments, where DevSecOps processes have evolved into complex ecosystems, the challenge isn’t just integration – it’s scalability. Security tools that were either developed purely for AppSec professionals, or those designed for small dev team become bottlenecks when scaling up to manage thousands of pipelines, potentially with many different configurations, across multiple development teams.

Most application security tools weren’t designed with enterprise-scale DevOps pipelines in mind, and don’t align with current development and deployment practices. The impact of this misalignment manifests across the entire development ecosystem:

Developer productivity: The constant context-switching between various tools and the IDE creates delays, breaks flow state and contributes to burnout and fatigue.

Operational overhead: Managing multiple security tools comes with substantial costs in licensing, integration, maintenance, and operational complexity.

Knowledge fragmentation: Each tool introduces its own learning curve and best practices. multiplying the burden on all teams involved and complicates security training.

Risk Visibility Gaps: Without a single source of truth, teams lack visibility into application-level risk, leading to inaccurate risk assessment.

Understanding these challenges is the first step. Now let’s explore what it takes to bridge this divide.

How Do You “Make It All Work Together” in Practice?

Making It All Work Together requires four components: culture, integration, consolidation, and adaptation.

Culture

Developers need to embrace security as part of their process, another engineering challenge to solve. Equally important, security teams need to embrace DevOps culture, moving away from traditional gated approaches toward automated, pipeline-native security controls that match development velocity.

Integration

Security controls need to maintain pipeline velocity, work from within the IDE and integrate with developer workflows. Implementations must remain consistent across all pipelines, repositories, and teams, bridging the gap between security and development through shared processes.

Consolidation

The more AppSec and dev teams are involved, each making their own decisions on which tools they’re going to use and how to use them in their process, the problem of tool sprawl multiplies exponentially. What’s an arguably manageable issue with a small team becomes a chaotic web of incompatibility. That’s why consolidation is imperative.

Consolidating your AppSec tools into one unified platform that covers all stages of the SDLC provides a seamless, developer-centric experience across all teams involved. For consolidation to be effective, the platform must cover everything from code, through supply chain, to cloud and deployment.

Consolidation not only helps streamline current work processes across different tools and teams, but also, equally importantly, facilitates further scalability.

Adaptation

‘Making it All Work Together’ is a process of progressive change, trial –and-error, and continuous improvement. Monitor how your teams interact with security tools, track key metrics, and fine-tune your approach accordingly.

Who Benefits from “Making It All Work Together”? Everyone

DevOps and Platform Engineering leaders have much to gain here being the ones dealing with the challenge, and the impact ripples across all teams and stakeholders. Let’s break down the benefits:

DevOps/Platform Engineering leaders

Developers

AppSec Managers

Support more dev teams on their security requirements with fewer tools

A unified view across your teams and pipelines for easy reporting on security and compliance requirements

Streamlined onboarding and reduced overhead

Cost reduction through consolidated licensing

Centralized policy management to catch issues early in the pipeline

Single point of contact for support

No more context-switching between security tools

Clear, prioritized security guidance in existing workflows

Faster vulnerability remediation with contextual guidance

Easier adoption of secure development practices

Correlated findings reducing overall ticket load

Automations to optimize security feedback loops and reduce cycle time

Complete visibility across the application portfolio

Better adoption of tools by developers

Faster remediation times with centralized security data

Reduced friction in DevSecOps workflows

Pipeline-native security driving cultural adoption

Ultimate reduction in application security risk

When Every Piece Clicks into Place

Creating a harmonic environment consolidating security into the SDLC is never about a single tool or process- tweaking. It takes a rethinking at the molecular level about how development and security interact, and while tech itself is not enough, it’s the foundation for change.

Integration and consolidation – two of the four principles of the “Make It All Work Together” mindset – are very much dependent on a unified AppSec platform that can integrate security tools seamlessly into the SDLC, help manage pipeline load and streamline dev and sec collaboration.

Ready to forge a new DevSecOps experience?

Explore how Checkmarx can help:
[checkmarx.com/solutions/devsecops]

February 25, 2025

Internet Performance Monitoring Wins the Day

We’ve spent years refining our ability to monitor systems, applications and networks, yet businesses still struggle with performance issues. The problem isn’t a lack of data—it’s too much of it. IT, network and cloud operations organizations are overrun with massive amounts of monitoring, performance and telemetry data. So much so, we must move for dashboards and alerts to metrics and KPIs that tie directly to business impact metrics and customer experience KPIs.

In my recent conversation with industry leader Mehdi Daoudi, CEO of Catchpoint, one thing is clear: Performance monitoring must evolve to account for the modern reality that connectivity across networks, the Internet, and Internet-based resources outside of IT operations have a profound effect on the performance of any application.

Key Takeaways: Modern applications performance is intrinsically linked with the performance of Internet and Internet-based resources, making Internet Performance Monitoring vital to meeting business and customer expectations. By extending observability and monitoring beyond internal systems and networks, organizations are better equipped to reduce downtime, optimize the user experience, and ensure their digital service delivery truly wins the day.

Moving Beyond Traditional Monitoring

For decades, organizations held the mindset that more data will result in better insights. However, this often creates the opposite effect. As Mehdi Daoudi points out, companies end up drowning in a sea of metrics, trying to extract meaningful insights from overwhelming amounts of information. Instead of enabling faster issue resolution, this data overload slows teams down.

Mehdi’s combined experience at DoubleClick, Google, and Reuters shaped his view that performance monitoring isn’t just about application performance—it has to extend beyond internal infrastructure to include the Internet. Internet Performance Monitoring (IPM) takes a more holistic approach by accounting for everything from third-party services to ISP networks, CDNs, DNS, and even cloud providers.

Internet Performance – Beyond Uptime and MTTR

It’s time to redefine what success looks beyond monitoring, uptime and mean-time-to-recover (MTTR). Today’s users have zero tolerance for a poor user experience. If an application or website takes too long to respond, it might as well be down. In many cases, it’s too easy to switch to an alternative mobile app, site or SaaS solution when the current choice doesn’t deliver.

Mehdi’s philosophy behind Catchpoint of “monitor what matters from where it matters” aligns with today’s reality. Businesses must monitor the end-user experience, not just the backend infrastructure and application stack. Synthetic monitoring, coupled with real-user monitoring (RUM), provides a clearer picture of end users’ actual experience, helping teams optimize for speed and reliability.

Beyond just user expectations, performance also directly affects business outcomes. Studies consistently show that faster websites and applications lead to better customer retention, higher conversion rates, and improved revenue. With so many third-party services and dependencies in today’s digital stacks, understanding and controlling performance holistically is more critical than ever.

Catchpoint’s IPM service is designed to go beyond application monitoring, performance or uptime by actively testing performance across the entire delivery stack. This holistic approach helps businesses pinpoint problems often before they escalate into major customer and business disruptions.

AI’s Role in Performance Intelligence

Artificial intelligence (AI) is an essential tool in the modern IPM stack. AI-driven analytics help organizations cut through noise and focus on the signal, prioritize real issues, and automate response strategies. With platforms like Databricks and Snowflake enabling real-time data analysis, AI is making correlating performance insights with business outcomes easier.

AI reduces alert fatigue that plagues IT and Ops teams. Teams can focus on solving meaningful problems faster and with greater precision. AI can also predict potential issues before they escalate, allowing companies to take preventative action rather than waiting for a crisis to unfold.

The Future of Monitoring: A Business-Centric, Delivery Stack Focused

The core takeaway from my discussion with Mehdi is that monitoring isn’t about technology—it’s about business and customers. Companies must align their performance monitoring strategies with their business goals.

Organizations can adopt a proactive IPM approach and gain deeper visibility into the entire customer experience and digital stack. This ensures that not only are applications working as expected, but that third-party services, global internet conditions, and external integrations are all functioning optimally as well.

This shift also means that business and technical leaders need to work more closely together. Performance monitoring must be part of the broader conversation about business growth and customer experience. Organizations that prioritize this alignment will be better positioned to compete in an increasingly digital-first world.

How Internet Performance Monitoring Wins the Day

Catchpoint’s vision for Internet Performance Monitoring is one promising way to ensure your performance monitoring wins the day. By extending monitoring beyond internal infrastructure to the entire internet ecosystem, companies gain the proactive insights they need to ensure seamless digital experiences, reduce downtime, and optimize performance where it matters most.

For information about Catchpoint, visit the Catchpoint blog and their latest SRE Report.

[This was a conversation packed with great insights, and if you haven’t already, be sure to check out the full interview on DevOps Dialogues.]

February 19, 2025
SOUTHWORKS – Cloud-Agnostic Platforms Will Drive New Possibilities in Multi-Cloud

Cloud customers are flocking towards a new approach as the classic option of relying on a single go-to provider is falling out of favor. Multi-cloud, the concept of using two or more cloud platforms to run workloads, has emerged as a hot alternative – and a smart business strategy.

“Ten years ago, when the cloud was starting, everybody was like pick your vendor and everything will be fine, and we thought it would be,” remembered Johnny Halife, CTO of SOUTHWORKS, a company that provides the engineering horsepower required to make a go of the multi-cloud play.

“So companies invested a lot in learning the ways of AWS, Azure and GCP. What they are finding out is that just one won’t do,” he said.

Halife urges customers to have an open mind rather than “picking sides” when it comes to the cloud.

“We need to stop looking at the world as black and white, as Azure or AWS…and understand that at this point, there might be a better offering on Azure and if that’s the case, let’s build the bridges, let’s build the network, and let’s build a blueprint for that to happen.”

Being on multiple cloud has undeniable advantages. For example, it gives one room to selectively put applications on platforms that are best suited for them, giving them the perfect environment to thrive.

Or as IT is scaling beyond data centers, and edge computing is rising worldwide, being on multiple infrastructures gives one the flexibility to grow and embrace new innovations.

Cost-savings are an obvious reason as well. In the past few years as cloud costs have surged manifold, enterprises are seen trying new flavors of cloud in pursuit of lower expenses.

And with the right toolbox and a solid roadmap, one could easily be set up for success in the multi-cloud. Except there is a catch.

“This modernized multi-cloud strategy is creating a “virtuous circle” because what we perceive as benefits like cost reduction, better performance, better or different revenue streams, or even more modern and robust infrastructure are what they ask.”

But what they get may not be the same thing. Switching platforms fast and loose comes with heaps of risks.

“Full-fledged migrations or hybrids scenarios are really valuable, but they have these problems,” he said.

Due to architectural differences between platforms, an application cut out to take advantage of the discrete services of one cloud infrastructure may not be able to profit from the services of another to the same extent. Depending on its design and build, the platform will influence the application’s behavior, either positively or adversely.

In its experience of working with many startups and ISVs, SOUTHWORKS has witnessed the potential pitfalls and disasters.

“When I talk with companies that have already gone through from on-prem to cloud, or from this stack to that stack, usually they say it was painful, and a lot of them messed up on training the people.”

Building cloud-agnostic applications can help get ahead of this problem and tap the true value of multi-cloud. Such applications can safely ignore the environment they’re running on, eliminating the need to align to one particular platform.

SOUTHWORKS puts its deep experience and familiarity with all of the major cloud providers to help design multi-cloud solutions for clients that allow their applications that formerly ran on separate platforms, to be in multiple places at once, while supporting the core business requirements.

The neutrality introduces broad interoperability and cloud resiliency, while also giving enterprises a chance to fairly weigh their options when it comes to workload balancing.

SOUTHWORKS’ cloud adoption, migration and app modernization solutions are designed to help customers get through the transition frictionlessly, and allow leveraging the best offerings of each provider. The scope of their work, based on customer stories shared at the AppDev Field Day event in November at KubeCon, includes shifting workloads wholesale from one cloud platform to another, turning traditional infrastructure into SaaS, and streamlining scattered technologies into a unified infrastructure.

As a systems integration company, SOUTHWORKS serves as a cloud-agnostic technology partner guiding companies towards the most suitable cloud platforms based on business case. When a customer comes to them with an open mind, they are shown all the options that work for them, Halife told.

“It’s part of our value. We don’t want to be cornered as the AWS shop or the Google Shop or the Microsoft shop when it comes to cloud,” commented Halife.

Watch SOUTHWORKS’ presentations from the AppDev Field Day event at KubeCon for a closer look at their services.

December 5, 2024
Heroku Uplifts Developer Experience with a Shorter Build and Deploy Cycle

Across the country, companies are on a quest to find an easy button to fast-track delivery of applications to customers. An accumulating number of side tasks are continually pushing out their time to market.

A central issue that has plagued app development companies is the stretched-out phase of deployment that begins after developers have written the code, and the lifecycle management process thereafter.

“It’s really 3,000,000 steps that you need to go through to get the code out to your customers,” said Adam Zimman, sr. director of product marketing at Heroku.

From building to scaling, the myriad steps and chain of decisions that make up the journey, amount to a lot of secondary tasks that consume time and resource from the developers’ routine. Most of it is manual, and developers liken it to flying blind with no safety harnesses.

Confusingly, industry averages will have you believe that the length of deployment is measured in hours, but most teams do not stack up to that. For the majority of the industry, deployment drags on for weeks. With too many moving parts, frequent needs for change, and no clear milestone, developers have to walk a tightrope.

A fitting solution, they say, is to use automation to keep the process closed, quick and painless.

A Salesforce company since 2010, Heroku has designed a developer-friendly Platform as a Service (PaaS) solution for creating, deploying and managing applications that it says uplifts developer experience from poor to “extraordinarily pleasurable”.

The platform makes a quick work of launching applications into the market bringing up companies to be first-to-market players.

Built with the goal to end the need for developers to get into the weeds of infrastructure plumbing and app maintenance, Heroku takes over the grunt work that slows down innovation and delays release of new applications. This leaves them in full control of ideation and coding, the real work.

“Heroku is that platform that engineers go to when they need things to work, and don’t want to think about it,” said Zimman while presenting at the AppDev Field Day event in California, “because we take care of all of the scaling, making sure that the apps stay up and running.”

Under the hood, the solution offers a breadth of functions that include integration, lifecycle management, automation, configuration, provisioning and autoscaling – to enable this. The sweeping abstraction gets customers “from app idea to customer experience as quickly as possible with as little effort as possible,” he said.

Heroku is a “very opinionated system. We think about all of the abstractions that you need to normally consider when bringing an application to market.”

An example is cloud migration. Companies struggle migrating workloads to public cloud platforms because of the change it entails. “Heroku is a great way to shortcut that lifecycle and be able to migrate quickly and easily,” said Zimman. “You don’t have to worry about understanding the 7000 plus services that you can get access to on AWS. Instead with Heroku, you take advantage of the primitives that you need, and we take care of the rest.”

Heroku is a “polyglot platform”, meaning it can support applications written in different programming languages the same way. There is no need to make changes to run them on Heroku, say its makers. If it’s written using a supported language or framework, Heroku will work it out.

Here’s everything that Heroku does under the hood to make lives easy for developers, and shorten the time-to-market for companies.

Applications are deployed on Heroku via a Heroku app which is essentially a second instance of the app codebase hosted on Heroku. Users are required to introduce the source code from a standard Git repo. As Heroku receives the app source, it initiates a build. Code is compiled, dependencies are retrieved, necessary assets are created, and finally, everything is assembled into what is known as a slug.

This slug, featuring all of the fundamental pieces, is a pre-packaged copy of the application that is ready to run. Heroku executes the slug on a dyno which is an isolated Unix container environment designed to execute code based on user-specific command.

A user can choose to run any number of dynos at a given time from the dyno manager. As a new version of an app is deployed, existing dynos are killed off and substituted with new ones, keeping the current formation intact.

All dyno activities, and logs from the routers and other platform components, are streamed into Logplex, a system that records entries in real-time. Applications can be easily scaled by increasing the number of dynos running.

Configurations sit outside the code and can be tweaked independently from the source code. They get stored in configuration vars from where they are programmatically pulled down at runtime.

Zimman brought a round of projected numbers to underline the developer efficiency gains. Not having to worry about or learn all of the ways different components fit together, may lead to a jump of up to 40% develop productivity, and 30% reduction in developer expenses, he said.

“We’re providing a prebuilt template that they’re able to use to deploy applications much more quickly.”

A growing marketplace of add-on services featuring over 500 add-on and build packs offers customers ready-to-use capabilities. Messaging, backup, search, database, uptime alerts, email services – users can choose and attach them to the applications as required.

Heroku is commonly mistaken for a product designed for startups, but in its current form, the product no longer fits that mold, said Chris Peterson, sr. director of product management.

“In the last few years, the company has worked to make sure that Heroku scales as the business scales.”

While the platform adapts to the changing business requirements, users are in control of the resources they want to use and can add features as they go.

Developed in 2007, more than 13M apps and 38M managed datastores have been built on the Heroku platform till date.

A significant number of Salesforce apps run on the platform. “We have a lot of very deep integrations to extend the Salesforce ecosystem quickly, easily and seamlessly, so that people can build their Salesforce apps with Heroku.”

Learn more about Heroku by watching their presentations from the AppDev Field Day event.

November 26, 2024
Dispelling the Cloud Security Myths and Accelerating Migration
Cloud migration is no longer a question of if—it’s a matter of when. But the mere mention of it can cause IT security leaders to conjure up images of data breaches, compliance nightmares and loss of access control. As businesses aggressively continue to harness the scalability, flexibility and cost-effectiveness of the cloud, the pressure on every application to make the leap mounts. But here’s the controversial truth: Most security fears about the cloud are, by now, completely unfounded.

Persistent waves of misconceptions continue to sow doubt, holding back migrations and leaving applications unnecessarily stuck in outdated infrastructure. So how do you separate fact from fiction in the cloud security debate?

On Sept. 24, during our DevSecOps Virtual Summit, we addressed these concerns in the session “Dispelling Cloud Security Myths in Migration.” Let’s take a deeper dive into some of the most common myths around cloud security—and, more importantly, what you can do to ensure secure, seamless transitions to the cloud.

The Top Cloud Security Myths Keeping You Up at Night

In our session, one thing became crystal clear: We’ve been looking at cloud security all wrong. When it comes to cloud migration, security is often cited as the biggest barrier, but many of the fears around cloud security are rooted in outdated ideas.

Myth 1: The Cloud is Less Secure than On-Premises Solutions

For years, we’ve clung to the notion that our on-premises systems are inherently more secure than the cloud. This is one of the biggest misconceptions organizations face. The idea that data is inherently safer when kept on physical servers within an organization’s walls is outdated. In reality, cloud providers invest billions in their security infrastructure, and many cloud services are equipped with more advanced security measures than most on-premises environments could ever match.

This doesn’t mean that migrating to the cloud automatically makes your data secure. The essential difference here is that security in the cloud is a shared responsibility. Cloud providers offer a secure foundation, but it’s up to your organization to build on that foundation with strong policies around access, data protection and compliance.

Myth 2: Once You’re in the Cloud, You’re Immune to Cyberattacks

The cloud can be more secure, but it isn’t invincible. A common belief is that once your systems and data are in the cloud, you’re automatically protected from threats. But no system—cloud-based or otherwise—is immune to cyberattacks. What matters is how prepared you are to respond to those threats.

Cloud security requires continuous monitoring and updating. A “set it and forget it” mindset won’t work in the cloud. Proactively managing your security posture by leveraging cloud-native security tools, multi-factor authentication and encryption is essential to staying ahead of evolving threats.

Myth 3: Cloud Migration is Complicated, Adding Security Risks

Yes, migrations are complex. Also, migrations (of any kind) involve risk. However, both the complexity and the risks of cloud migrations can be managed. Too often, organizations stall their migration plans due to concerns over data loss or exposure during the transition.

Cloud migrations don’t have to be a particularly intense security risk. A comprehensive migration strategy addresses potential risks before they become real problems. Tools that automate security checks throughout the migration process can ensure that you’re not leaving vulnerabilities open as you move data and systems to the cloud while helping manage the migration’s complexity.

The Right Approach to Cloud Migration: Strategy and Security

Now that we’ve cleared up some of the misconceptions, what does a secure cloud migration really look like? The success of your cloud migration relies on building a clear roadmap that takes both your business needs and security concerns into account. Here are three steps to ensure a smooth and secure journey:
1. Start with a Security-First Mindset
Before you begin your migration, assess your current security posture. Identify where your vulnerabilities lie and make sure your security policies are up to date. Remember, migration isn’t just about moving data, it’s about moving data safely.
1. Leverage Cloud-Native Security Tools
One of the biggest advantages of the cloud is access to cloud-native security tools. These tools are designed specifically for cloud environments and provide automated monitoring, data encryption and compliance tracking. OpenText’s DevOps Aviator, for instance, integrates seamlessly with cloud platforms, offering continuous security checks throughout the migration process.
1. Collaborate Across Teams
Cloud migration isn’t just an IT task—it involves everyone, from security to development teams. Open lines of communication are critical to ensuring that security measures are integrated at every stage of the migration and that everyone is aligned on how to respond to any issues that arise during or after the transition.

What’s Next? Watch the Full Session Recording

Migrating to the cloud doesn’t have to be an intimidating process, but it does require the right approach and a solid understanding of what’s true—and what’s not—when it comes to cloud security.

Don’t let cloud security myths hold back your organization. The benefits of the cloud are too significant to ignore. By taking a security-first approach and leveraging the right tools, your organization can confidently migrate to the cloud and reap the rewards.

If you’re ready to separate fact from fiction in your cloud migration journey, check out the DevSecOps Summit recording and take the first step toward a more secure, efficient and innovative future.

Watch the full session recording here and learn how to ensure your cloud migration is secure and seamless.
October 1, 2024

Category: Sponsored Content

AI Is Promising, but Let’s Stay Suspicious

The Toil Problem Is Real and Measurable

Three Implementation Models, Three Different Outcomes

Making AI the Hero of Your App Dev Story

AI Is Your Enthusiastic Partner, Not Your Replacement

DevEx Isn’t the Destination

The Scale – and Stakes – Are Growing

Checkmarx’ Five Pillars of DevSecOps Maturity

1. Shared Metrics

2. Collaborative Governance

3. Advanced Security Education

4. Trusted Automation

5. Velocity-Security Balance

The Role of Leadership

The Road Ahead

The Evolution of Observability

The Three Pillars of Actionable Observability

The Role of Generative AI

The Advantages of a Single Platform for VMs and Containers

The Time Is Now

Addressing the Internet-Driven World

IPM Can Also Improve CI/CD and Release Management

A New Equation: APM + IPM = Full Observability

How Serious is the DevSec Dissonance? Industry Data Speaks

Toll of a Cultural Divide

When Every Piece Clicks into Place

Moving Beyond Traditional Monitoring

Internet Performance – Beyond Uptime and MTTR

AI’s Role in Performance Intelligence

The Future of Monitoring: A Business-Centric, Delivery Stack Focused

How Internet Performance Monitoring Wins the Day

The Top Cloud Security Myths Keeping You Up at Night

The Right Approach to Cloud Migration: Strategy and Security

What’s Next? Watch the Full Session Recording