devopsy.kinsta.cloud

Tag: ai

Best Practices for Modernizing App Modernization

Modernizing legacy systems to embrace a loosely-coupled microservices architecture is the biggest predictor of success for continuous delivery, according to Google Cloud’s 2021 Accelerate State of DevOps report. Studies continue to show that the most elite DevOps performers enjoy more frequent code deployments, faster lead times to deploy, low change failure rates and faster time-to-recovery.

Leading enterprises like Netflix, Tesla and Starbucks proved that a microservices architecture minimizes fine-grained dependencies between services, which can then be independently tested, deployed and scaled. Combined with DevOps best practices, this reduces technical debt and allows for modernization based on a factory model approach that incorporates automated analysis and deep observability.

That said, application modernization to date has been a manual process requiring multi-year projects that suffer a high failure rate. How can we apply modern tools, known DevOps best practices and desired business benefits to improve and accelerate a company’s modernization efforts? In other words, how do we make modernization more modern?

By using automation, AI and data science, building repeatable pipelines and shifting architecture left, architects can get in front of technical debt before it becomes unmanageable. In this article, we’ll explore these practices in more detail.

Intelligently Automate Everything Possible

DevOps methodologies have taken manual steps and applied automation to create repeatable processes that scale. Modernization teams today are in dire need of these methodologies, as they are stuck with manual approaches that don’t scale across an entire application estate. Thus, applying intelligent automation, AI and data science to modernization—and creating a repeatable pipeline for refactoring—is a natural extension of DevOps successes over the last decade.

Continuous Integration, Continuous Deployment, and Continuous Modernization

CI/CD methodologies are a core best practice for DevOps teams and are already familiar patterns that development organizations are using for their application life cycles. But, there is no continuous delivery without continuous modernization. Elite teams continuously monitor technical debt accumulation and address it at every application release cycle, thereby implementing continuous modernization in their application life cycles.

Deep Application Observability

Observability, defined as monitoring, logging and tracing, is a foundation for cloud-native architectures. Modernizing an existing monolith requires deep observability beyond simple static code analysis to include deeper domain-driven behavior analysis and dynamically tracking dependency interactions. This is also the secret to uncovering dead code that is no longer used.

Ensure Architectural Parity

You must understand your infrastructure architecture to inform your application architecture and your modernization options. Lift-and-shift causes headaches for many organizations because the traditional three-tier architectures of monolithic applications have a completely different topology than cloud-native applications, which are designed from scratch to leverage the efficiencies of the cloud.

Whether it’s a hybrid approach (part on-premises, part cloud), public or private cloud, it’s important to ensure that your modernization strategy ensures architectural parity between the target application and its ultimate destination in the cloud. Also, it’s important to understand your modernization options: Rehost, replatform, refactor, rewrite, etc. What can you lift-and-shift and what needs more attention?

To find the answer, incorporating data science-driven analysis, automated service extraction and, more importantly, people, to help you understand the possibilities is critical.

Get Executive Support for Your Modernization Project

This isn’t about simply churning through your backlog; your executive sponsors for a project of this scope need to understand, in business terms, why this is crucial for the organization. There are plenty of metrics showing the financial and opportunity costs of maintaining mission-critical applications that are aging and problematic.

To get executive buy-in for your modernization initiatives, you need to formulate a business case that communicates the cost of maintaining the legacy apps, both in time and resources to maintain, but also the negative impact on innovation, customer acquisition and retention and speed to market.

DevOps practices emerged to improve how IT organizations reliably and efficiently deliver software from development to operations and out to customers. Applying these emerging technologies of automation, pipelines and deep observability to application modernization initiatives will enable teams to accelerate how they deliver application transformation projects. By investing in training application teams in these methods and providing modern tooling to support that training, organizations more reliably and more efficiently move both people and projects forward into the next generation of cloud applications.

March 2, 2022
Investing in Artificial Intelligence: How MLOps Drives Enterprise AI Wins
Insight Partners had a banner year in 2021, with more than $50 billion in capital commitments across over 200 investments. While we invest in founders across a wide spectrum of businesses, this series focuses on outlining our theses on four verticals that we’re particularly excited about in 2022: Artificial intelligence (AI), fintech, cybersecurity and healthtech.

Artificial intelligence has remained a super-hot category for good reason: It has the potential to transform nearly every industry and business.

At Insight, we’ve long been bullish on the many use cases for AI. In the past year, we’ve invested in image recognition software from Netherlands-based ScreenPoint Medical, which improves early detections of breast cancer, Covera Health, which provides a quality analytics platform to reduce medical errors in radiology, CARTO, which helps companies use and understand spatial analytics, and Laminar, a cloud data security platform to continuously monitor and protect against data leaks – among other game-changing companies.

In total, Insight invested in 49 different companies across a broad spectrum of artificial intelligence and machine learning use cases in 2021, which represents a 172% increase from the year prior.

As we look ahead into 2022, we expect artificial intelligence tools to continue to dominate. We see the ecosystem dividing into three primary categories:
- Layer 1 – Base platform companies: Algorithms; frameworks; infrastructure and workbenches for creating ML systems
- Layer 2 – Cross-industry capability companies: Turnkey machine learning-based systems that solve specific problems spanning multiple industries (e.g., cybersecurity)
- Layer 3 – Industry-specific companies: Applications powered by prediction or classification systems that target specific, niche use cases in one domain
Companies and investors will find valuable AI/ML software across all three layers. At Insight, we initially focused on layers two and three. We invested in startups creating robust ML systems that addressed specific problems, either vertically (like credit underwriting company Zest AI) or horizontally (like cybersecurity company SentinelOne). We thought that economic moats were hardest to build at layer one; in part as a result of robust open source ecosystems and because large public cloud vendors deliver many of these tools at low prices.

Insight Partners’ three-layer framework of machine learning companies

Throughout this year, however, we realized we were missing a piece of the puzzle. While there will always be market demand for cross-industry capabilities and industry-specific applications, 2021 taught us that as companies try to productize AI for the first time, base platforms will become increasingly important as well.

After all, more companies than ever are charging forward on artificial intelligence projects to try to guide business decisions and save time and money. A whopping 90% of enterprises are either actively running AI projects or plan to in the next 12 months, according to a recent survey.

But here’s the catch: Most of these projects will fail.

There are many reasons why including a lack of sufficient data or black-box models that spit out indecipherable results. Regardless of the reason, high failure rates can hurt the ecosystem if they result in corporations’ hesitation to move forward with future AI projects.

Accordingly, Insight is particularly excited about a subsection of AI tools that can significantly increase companies’ likelihood of succeeding at their project goals: Machine learning operations, or MLOps.

MLOps tools can improve a machine learning pipeline from start to finish by helping gather, manage and label data, experiment and test the model selection, deploy multiple models in production at once and protect against model and data drifts and attacks.

Holistically, the goal is to improve communication and collaboration between data scientists, data engineers and business analysts through the machine learning life cycle, similar to how DevOps tools help improve communication in the software development life cycle. Machine learning is an iterative process with constant feedback loops and the need for continuous monitoring, which makes MLOps tools to manage this process even more critical.

Overview of some of the key areas of an MLOps pipeline

While every company rolling out AI projects can benefit from MLOps, the type of tools they require will depend on their needs, resources and strategies.

Companies should ask themselves: How sophisticated is our data science team? How mission-critical do we want our models to be? Are our data sources structured or unstructured? Do we want open source, commercial or homegrown tooling?

The answers to those questions will point companies to specific MLops tools that are best suited for their specific challenges.

For example, some platforms—like Dataiku or DataRobot—are end-to-end products with wide capabilities, which are typically easier to use and thus encourage model creation and experimentation from workers across job functions, regardless of technical knowledge. These so-called ‘citizen data scientists’ can boost analytic workflows for companies with fewer data science experts and create significant value, but there’s a risk that the deployed models are not as well understood or controlled. These types of tools are best for companies that want to use machine learning to drive business insights and analytics rather than as part of their core business function.

If a company has a sophisticated data science team, however, it may lean toward specific point solutions, or what Insight calls best-in-class MLOps solutions. While these products require greater technical knowledge to maintain and deploy, they allow for much more control, depth and sophistication in a system. One startup offered the apt analogy that using platforms versus best-in-class solutions is like driving an automatic car versus a stick shift.

There are multiple MLOps tools for each part of the pipeline, and we see a world where each tool has enough market space to support it becoming a large company.

At Insight, we spent 2021 learning about and investing in many of what we consider to be the best-in-class MLOps tools, as determined by highly satisfied customer feedback, clear market momentum and well-respected and knowledgeable teams. This perspective led to our investments in Explorium, Rasgo, Weights & Biases, Deci, Run AI, Fiddler, Tonic, Dataiku and Databricks, as well as several others that have yet to be announced.

Insight Partners’ MLOps market map

While Insight expects MLOps to continue to be an essential driver of AI success in the new year, we also expect to see several other trends take shape in 2022:
- First, we will see the emergence of two machine learning pipelines, one for structured and one for unstructured data. Unstructured data sources—like images, videos and audio—require specific data warehouses, data management, pipelines and model management tools that maximize productivity and accuracy. Given the nuances and complexities between the two data types, we expect to see more MLOps tools shift toward owning their category for one or the other.
- As enterprises scale from dozens of models to hundreds or even thousands of models, we expect the increased industrialization of AI. This will result in the rise of orchestration layers that sit on top of machine learning pipelines to help manage all the different tooling. These layers will integrate across multiple tools in the ML pipeline—whether open source, commercial or homegrown—and provide an integrated environment (or so-called “single pane of glass”) to better track and manage ML pipelines. Orchestration layers will help enterprises gain more control over their pipelines while still supporting best-in-class tools.
- Insight believes we are at an inflection point of moving from a model-centric to a data-centric world. In a model-centric approach, you ask how you can change a model’s code to improve the performance of the system, whereas, in a data-centric model, you ask how you can change the data to improve it [system performance]. We expect the most successful tools of 2022 to be focused on supporting the new tasks, workflows, and jobs spawned by the data-centric movement.
- We will also see a new class of MLOps tools focused on closing the growing AI skills shortage and gap across businesses. These tools will focus on increasing the efficiency of the model production process and lower the bar for ML development.
- Finally, we expect to see a significant increase in the overall enterprise adoption of ML, with a shift from experimentation to deploying models in full production. Last year, we saw many enterprises form AI research teams and hire data scientists to experiment with machine learning. In 2022, we believe these enterprises will start realizing the full capacity of their AI projects and driving significant business value. This increase in enterprise adoption will also be driven by the explosion of edge devices that will enable new use cases of ML adoption.
As active machine learning and artificial intelligence investors, we are excited to continue to watch the market and support new entrants in what will surely be another dynamic and exciting year.

George Mathew, Lonne Jaffe and Sophie Beshar co-authored this piece.
January 27, 2022
How AI Can Improve Software Development

Change is constant and inevitable. While some changes are welcome, others are just a necessary evil.

Continuous calls for digitalization combined with a pandemic-prompted emphasis on transforming business operations, force organizations across industries to modernize their legacy systems. The emergence of cloud computing has shrunk organizations’ on-premise IT footprints. However, with 96 of the world’s largest 100 banks, 90% of the world’s largest insurance companies, 23 of the 25 largest retailers in the U.S. and 71% of the Fortune 500 still using mainframe systems, any modernization efforts—resulting in increased risk of downtime or defects—will frequently lead to disastrous consequences.

So, while making changes can be expensive, uncertain, and lead to customer loss and/or embarrassment in the marketplace, modern business demands that systems change to continue to deliver value. The problem with mainframe modernization, however, is that today’s code search tools, linters and program analysis tools are deficient when it comes to mitigating the risks associated with maintaining and improving systems.

Modernization: A Knowledge Problem

With 10,000 mainframes in active use globally, the average organization annually spends anywhere from 60% to 80% of its IT budget just on maintenance. But, as experienced and proficient programmers retire or move on, many companies are realizing that the specialized domain knowledge of the industry and institution that those developers used to create and update these complex critical systems is walking out the door with them.

As the developers who originally wrote the code have long since moved on, and documentation leaves a lot to be desired, developers new to a system are unable to acquire comprehensive knowledge of the system’s functionality, at a detailed or fast enough level, to become adequately productive and proficient. That lack of speed comes with significant risk and cost to any organization.

Recognizing the full and true intent of the functionality written in code is not simple. Developers today spend roughly 75% of their time searching through source code, to identify the code representing the functionality that needs to be changed. Complicating matters further, understanding the code is not enough. To effectively and efficiently maintain and support any system, software developers must know precisely what an application actually does—and how altering code in one part of the system impacts it as a whole. But since the code representing a behavior that needs to be changed can be littered throughout the system, developers might think they’re making a simple tweak, when really they may be breaking the entire system (and not even knowing it). The risk of change resulting in unintended consequences is real.

All of that being said, how can developers improve their efficiency and effectiveness?

The Shortcomings of Today’s Tools

With code repositories growing unchecked over time to extraordinary sizes, those responsible for maintaining and preserving a system’s functionality say it’s becoming increasingly challenging to find bugs in code without machine assistance. And with debugging being an arduous, time-intensive endeavor, developers are increasingly turning to code search tools, linters, and static and dynamic analysis tools to analyze millions of lines of code, flag errors and suggest fixes.

Whether the tool excels at bug localization, code visualization or “error” detection, entirely too many tools are insufficient when it comes to actually identify the specific lines of code that require attention. Program analysis tools only illustrate code in ways that developers still have to interpret (potentially incorrectly) and draw their own conclusions. While code search tools might speed the rate at which developers can build a mental model of the code, such tools are notorious for false positives, and developers still have to undergo the mentally challenging endeavor of piecing that mental model together to identify the code, and then safely make changes. Worse yet, code completion tools—tools that less-experienced developers disproportionately rely on—can actually propose imprecise changes (one prominent tool offers incorrect code 71% of the time), and that introduces risk.

The cherry on top of this problematic sundae is that today’s tools don’t have any way to effectively validate the scope and accuracy of a proposed change. The influence of a suggested change can be tough to identify, so testing for comprehensive validation is frequently next to impossible.

Ideally, there has to be a better way to mitigate risk while making changes to legacy systems. Enter artificial intelligence. By employing a unique approach to AI, the code repository truly becomes a knowledge repository, enabling many capabilities unrealized before now.

A Developer’s AI-Enabled Accessible Knowledge Repository

By leveraging AI to automate the identification of the specific lines of code that require attention, developers can simply ask this AI-driven knowledge repository where behaviors are coming from—and quickly identify the code associated with that behavior. This puts AI squarely in the position of intelligence augmentation, which is key to leveraging its capabilities.

This novel approach of AI reinterprets what the computation represents and converts it into concepts, therefore “thinking” about the code in the same way humans do. The result is that software developers no longer have to unearth the intent of previous developers encoded in the software to find potential bugs. Even better, developers are able to overcome the inadequacies of automated testing by using AI to validate that they haven’t broken the system before they compile or check in the code. The AI will forward simulate the change and determine whether it’s isolated to the behavior under change. The result is the bounds of the change are confined to the behavior under change so that no unintended consequences arise.

While AI is not yet advanced enough to safely make changes on its own, it can serve as a knowledge repository with the added capability of directing developers precisely where to make any needed changes. With AI, programmers—even on their very first day on the job — can make any necessary fixes with confidence that they won’t break the entire system.

Unlike its code search, code navigation, code completion and program analysis tool counterparts, AI fundamentally empowers developers to safely, efficiently and effectively make any necessary changes. With AI — that is fortified by a knowledge repository that understands source code the same way a human does — developers can truly do more with less.

January 13, 2022
Iterative Adds Experiment Versioning to MLOps Platform

Iterative today added an experiment versioning capability to an open source platform for managing machine learning operations (MLOps) using GitOps workflows.

Dmitry Petrov, Iterative CEO, said the latest version of the Data Versioning Control (DVC) platform makes it simpler to save, compare and reproduce machine learning (ML) experiments at scale without requiring organizations to set up an additional repository to track them. Instead, organizations can store those experiments alongside other software artifacts in a Git repository, he said.

As a result, IT teams will no longer need to try to keep track of experiments using spreadsheets or notebook tools such as Jupyter, he noted. Organizations that are building AI models for applications constructed using DevOps workflows will also find it easier to comply with a wide range of existing and forthcoming compliance mandates, added Petrov.

The DVC platform makes use of a Git-like interface to enable organizations to track multiple versions of data sets, models and pipelines across an MLOps workflow. That capability is being extended to make it easier to manage the experiments data science teams create during the construction of an AI model.

Iterative is at the forefront of an emerging debate over how best to infuse AI models into applications. Providers of platforms used by data science teams are making a case for separate repositories for tracking the artifacts used to construct an AI model. Iterative, on the other hand, is arguing for the use of an AI model build framework that uses the same Git repositories where any other type of software artifact is stored and shared. Iterative’s argument is that, in effect, AI models are just another type of software artifact, noted Petrov.

In addition to reducing the total cost of building AI models by reducing the number of platforms required, a Git-based approach also makes it simpler for DevOps and data science teams to collaborate because the DevOps team will have more visibility into what AI models will eventually need to be incorporated into an application.

It may be a while before the development of AI models and applications fully converges. Data science teams today typically have defined their own workflow processes using a wide range of graphical tools. However, as it becomes obvious that almost every application is going to be infused with machine learning and deep learning algorithms to some degree, the need to bridge the current divide between DevOps and data science teams will become more acute.

In the meantime, DevOps teams should assume that many more AI models are not only on the way but that those models will need to be continuously updated. Each AI model is constructed based on a set of assumptions; however, as more data becomes available, AI models are subject to drift that results in less accuracy over time. Organizations may even determine that an entire AI model needs to be replaced because the business conditions on which assumptions were made are no longer valid. One way or another, the updating and tuning of AI models is likely to soon become just another continuous process being managed via a DevOps workflow.

December 7, 2021
Will Automation Fill Gaps Left by the ‘Great Resignation’?

Between burnout, job-hopping and the ongoing pandemic, labor shortages will surely get worse before they get better, and automation is increasingly sought after as a way to mitigate the ripple effects of understaffed IT departments.

For DevOps, automation has several benefits, from freeing up employees to work on more constructive tasks to minimizing software bugs and technical debt.

However, starting off slow and learning how automation will help address staff shortages without complicating processes is a critical factor.

“There’s still a lot of teams that are struggling with far too many manual or repetitive tasks,” said Rich Lane, chief strategy officer at Netenrich, a digital IT and security operations company. “Obviously, trying to do your day job of delivering features and functionality into the wild can be challenging with the speed that business needs demand.”

Lane, a former senior research analyst at Forrester Research, pointed out that slowing down in the present to do foundational work that can lead to higher levels of automation in the future can be hard to sell to digital services stakeholders.

“And yet, without doing so, it becomes increasingly difficult to meet commitments in the event a team becomes shorthanded or delivery requirements increase,” he said.

Generalist or Specialist?

Cody Michaels, application security consultant at nVisium, said when it comes to hiring people for a DevOps environment, you have one of two options: You can hire someone with a wide range of knowledge that spans the entire process or you can hire someone with expertise in one core area like programming or deployment.

“At an individual level, a generalist will be better than an expert, however, a team of experts will outperform a team of generalists,” he said. “Not only can automation fill in gaps between an expert’s area of influence, but it can also serve as a permanent fixture on the team. As a result, the turnover rate won’t affect any automation so long as it’s implemented properly.”

From Lane’s perspective, the main areas DevOps teams should be looking to automate are continuous integration and continuous delivery (CI/CD), IaC and AIOps-enabled incident management platforms.

“By taking the manual nature of day-to-day work off of DevOps engineers’ plates, they are freed to focus on digital transformation,” he said. “The number-one stumbling block is not starting with process.”

Lane noted unless you understand all the steps in a procedure that you’re trying to automate, it is very difficult to maximize the power of automation tools.

“Much of the process that is still adhered to today is outdated for the digital age,” he said. “Spend the time up front to map out what you hope to achieve with an automation project, what all the touchpoints are and how one can measure the quality of automation when it’s implemented.”

Michaels added that while the internet is flooded by companies shouting they have the “best” tools, that proclamation of “best” is going to be determined by budget and known languages.

“The top tools that I would recommend are Jenkins, Docker, Git and Jira, since these four play very well together with regard to automation,” he said.

Git, for example, has hooks that can trigger upon performing certain actions, like freshly submitted code, while Jenkins has automation as its middle name and it’s used in building, testing and deploying, which in turn facilitates CI/CD.

Meanwhile, Docker provides virtualization of operating systems and running applications in a secure manner in conjunction with containers.

“Lastly, Jira is one most don’t think about, but the platform has a lot of macros and filtering functionality that can update the work process automatically from events like code passing a test before it’s deployed, for instance,” he said.

Michaels said a couple of core considerations organizations need to make when approaching the idea of automation and AI are time as well as safety nets in place.

“Automation will take time to set up before you can benefit from it, but in the case of smaller teams, it won’t be too time-consuming to configure it all in one fell swoop,” he said. “But if you’re working with a lot of technical debt, unfortunately, it’s going to be payback time. If this is the case, my best advice would be to start small and not overhaul everything at once.”

Minor Automation Improvements Have Major Benefits

He said he thinks incremental improvement will be the best route for most organizations, and that even minor improvements will compound far faster than waiting a year to see if a redesign will work for you.

“As I mentioned previously, it’s imperative to have safety nets in place,” Michaels said. “Make sure you have a contingency plan if something goes wrong in the process to recover back to a working state. However, strictly speaking, everyone should make it a practice to have a recovery plan in their software development life cycle (SDLC).”

As the DevOps world moves into 2022, organizations choosing to embrace automation could find themselves in a win-win situation—for both developers and operations.

“The more automation takes over the ‘housekeeping’ items of the process, the more time will be freed up to improve the process as a whole,” Michaels said. “As a result, taking time to go back and clean up technical debt can now be set aside between sprints and maintenance.”

He pointed out that senior roles can tackle optimizing the architecture, which will ensure fewer bugs and a healthier work-life balance for all: Just imagine a world where developers can focus on perfecting their craft—instead of waiting hours or days for server reboots or disrupting their flow to update a ticket status.

“It really comes down to the fact that organizations can no longer make automation an afterthought,” Lane added.

He pointed out that given the difficulties in recruiting and retaining staff today, DevOps leaders must make their teams as efficient as possible—and automation can help achieve that goal.

“The number-one way to achieve this is applying as much intelligent automation throughout the IT environment as possible so that the highly-skilled engineers can focus on transforming the business,” Lane said.

December 1, 2021
Digital Transformation Driving VSM Adoption

The number of organizations using value stream management (VSM) to bridge the divide between DevOps and the rest of the business is expected to dramatically increase over the next two years. The shift is due, in part, to investments in digital business transformation initiatives.

A survey of more than 500 executives, IT and business leaders conducted by Dimensional Research on behalf of Broadcom, a VSM platform provider, finds the percentage of organizations employing VSM will rise from 42% today to 70% in the next two years. Nearly three-quarters of organizations (72%) that are not currently using VSM plan to do so in the next 18 months or more.

The survey also finds that 85% of organizations are collecting some subset of value stream metrics today as part of an effort to deliver solutions faster (56%), improve decision making (55%) and increase transparency (54%).

Laureen Knudsen, chief transformation officer at Broadcom, said that as organizations embrace DevOps best practices more broadly to drive digital business transformation initiatives, they need more visibility into the application development process. VSM surfaces the insights required to not only identify bottlenecks but also track how changes in application delivery timetables will impact key performance indicators (KPIs).

VSM traces its lineage back to lean manufacturing methods, which called for each step of a manufacturing process to be continuously measured. As software development has evolved from being a craft to an automated process using DevOps best practices—and as organizations realize just how dependent they are on software—an appreciation for the value of monitoring the impact of missed software development deadlines on the business is growing steadily. VSM platforms automatically collect technical metrics from DevOps tools that are then correlated against the KPIs the organization decides to track.

The Broadcom survey found more than 96% of respondents’ companies are already in the process of adopting digital transformation. Strategic objectives include increasing efficiencies (70%), improving product quality (67%) and improving customer value (63%).

Most respondents (92%), however, are anticipating product development challenges for 2022. The biggest product development challenge cited is a lack of visibility throughout the product life cycle (45%) followed by inefficient processes (44%), lack of resources (42%) and enterprise-wide lack of understanding of how products deliver customer value (42%). A full 89% of the business leaders surveyed also noted they continue to struggle with organizational silos between strategic development and operations; 93% noted that better alignment between teams would improve their organization’s overall return on investment (ROI) in software development. A total of 95% said they believed VSM would optimize their product life cycle processes.

Knudsen said that, in time, artificial intelligence (AI) technologies will increasingly be infused into VSM platforms to enable automated feedback loops between the business and DevOps teams. In the meantime, DevOps teams should be prepared to adjust project priorities based on the needs of the business and to endure a higher level of scrutiny as business stakeholders become more involved in setting the software development agenda.

November 24, 2021
ServiceNow Acquires DotWalk to Gain AI for App Testing

ServiceNow today revealed it has acquired DotWalk to gain an artificial intelligence (AI)-infused application testing capability that runs natively on its software-as-a-service (SaaS) platform.

Joe Davis, senior vice president for platform engineering at ServiceNow, said that testing capability will be made available free of charge to all organizations that build custom applications on the company’s platform.

The number of custom applications being built on the ServiceNow platform has risen sharply since the start of the pandemic. Many organizations have taken advantage of the low-code tools provided by ServiceNow to build a range of applications that use the company’s SaaS applications as a foundation. That approach enables them to more quickly build applications that drive a wide range of digital business transformation initiatives.

Davis said ServiceNow is committed to enabling organizations to improve the quality of those applications using a DotWalk testing capability that eliminates the need for developers to build and run tests themselves or for organizations to hire dedicated application testing teams.

ServiceNow decided to acquire DotWalk because the company built a testing platform using machine learning algorithms specifically for the ServiceNow platform, noted Davis. The DotWalk tools also analyze logs in the background to identify and validate error sources that can arise during any application upgrade process.

While there are a large number of professional developers that build applications on the ServiceNow platform, the company is also trying to encourage more so-called citizen developers to build applications. The challenge is many of the end users building applications lack an appreciation for design, security and what it takes to make sure an application scales as more users employ it. Testing tools infused with AI should make it easier for developers, regardless of experience, to build enterprise-class applications.

Of course, professional developers will also benefit from AI-infused testing tools. Many developers have a tendency to cut short the application development process as they rush to meet application delivery deadlines. The end result, however, is that an application must be updated almost immediately after it has been deployed in a production environment. Testing tools that make use of AI will enable professional developers to more easily run tests they don’t have to build and then maintain, said Davis.

One way or another, the number of custom applications built on SaaS platforms will increase as organizations digitize more processes. In the last year, more organizations have become adept at extending these platforms using a wide range of low-code tools that automate many aspects of application development. A significant percentage of those organizations are now also adopting DevOps best practices to better manage the pace at which those applications are developed and deployed.

In the meantime, it’s too early to say precisely how AI will transform application testing. However, one thing that is certain is that even as the number of custom apps grows, applications will be more thoroughly tested before being deployed in a production environment.

November 23, 2021
Logz.io Extends Open Source Observability Platform

Logz.io has enhanced its observability platform to include both unified dashboards and support for distributed tracing to monitor service performance enabled by the open source Jaeger agent software being advanced under the auspices of the Cloud Native Computing Foundation (CNCF).

At the same time, Logz.io is making available a preview of an anomaly detection capability that leverages machine learning algorithms to build an artificial intelligence (AI) model to monitor data.

The company has also added support for OpenSearch, a fork of the open source ElasticSearch software project that is no longer available via an Apache license. OpenSearch was created by Amazon Web Services (AWS) and Logz.io as an alternative search engine.

Finally, Logz.io has added a security event management capability that makes it easier to classify, prioritize and collaborate on mitigation of cyberattacks as they are discovered.

The Logz.io observability platform is entirely based on open source software. In addition, the company has made contributions to enhance both Jaeger and the OpenTelemetry project, including contributing an OTEL Span Metrics Processor that makes it easier to aggregate metrics.

Logz.io CEO Tomer Levy said that, in general, it’s still early days as far as observability is concerned. As a concept, observability traces its lineage to linear dynamic systems. Observability at its most basic level measures how well internal states of a system can be inferred from knowledge of its external outputs. The overall goal is to make it easier to query machine data in a way that enables DevOps teams to proactively discover the root cause of issues before they cause further disruption. That’s a major advance over monitoring platforms that typically only provide predefined metrics to identify when a specific platform or application is performing within expectations. The issue, however, is most IT teams really don’t know what questions to ask to take full advantage of an observability platform, said Levy.

However, as more organizations are exposed to observability platforms, it will become easier to advance both DevOps and DevSecOps as more platforms continue to leverage AI to provide remediation capabilities and automate processes based on the massive amounts of data collected via these platforms, said Levy. There is simply no way the average IT team will be able to manage all the microservices being strewn across a distributed computing environment without the aid of an AI model trained using observability data, he added.

As DevOps continues to evolve, it’s more than likely that the best DevOps engineers are not going to want to work for organizations that have not invested in some form of observability. The odds of being consistently successful as a DevOps engineer decline sharply as IT environments become more complex.

On the plus side, it should soon become a lot easier as the overall level of application instrumentation increases to manage those complex environments and to do so at a level of scale that doesn’t require a small army of DevOps engineers.

November 22, 2021
4 Keys to Developing Ethical AI

Companies continue to grapple with how to use artificial intelligence (AI) technology in a way that doesn’t compromise privacy and that takes into account other key ethical considerations. It is undeniable that AI is one of the fastest-growing categories today. But if we are unable to build tools that live up to high ethical standards, not only are we doing end users a disservice, but we are failing to deliver on the promise of this technology as a force for good.

AI and ethics has been one of the hottest topics within the technology community for decades. However, as an industry, we are still finding it hard to put our best foot forward in terms of ensuring ethical use—let alone solving the problems these systems were meant to address. Fortunately, there is one group that could be the guiding force we need: Developers.

From the ideation process to implementation, the developer community is by far the group with the most intimate knowledge of how AI products actually work; therefore, they can have a tremendous influence on what these tools actually do and how ethical they are—and they need to be empowered to make these calls.

With that in mind, here are four key questions that companies and their developer teams should ask as they work to build the ethical AI solutions of the future.

Is This Transparent in Every Way?

If a developer ever finds themselves saying, “I don’t know,” when asked about how a product works or how the product is ultimately going to be used, production should stop immediately. The power of automation is tremendous. But given how quickly it can morph and learn, making sure that oversight and explainability are ingrained in its functionality is imperative to ensure ethical use. If this can’t be guaranteed, developers should be empowered to flag their concerns and look for ways to remedy them before continuing production.

As AI continues to evolve, designing and developing AI systems will likely continue to lead us into areas where no clear legal, social or policy guidelines address many of the potential uses—and misuses. So, now is the time for developers to establish a transparent and clear channel of communication where they can actively raise concerns, discuss and deliberate on ethical dilemmas with diverse stakeholders. This is crucial in reducing or eliminating any negative effects of AI. Otherwise, we will continue to see the current faux pas around AI ethics continue.

Have we Accounted for Risk or Exceeded Regulatory Boundaries?

Virtually any big idea has its risks. Unfortunately, when it comes to AI, these risks generally involve unethical use or unintended consequences. The ongoing debate around facial recognition and AI is a perfect example of this. While this use case is intended to improve security and may have other benefits, facial recognition software comes with significant privacy risks and fears over misuse and misapplication. Moreover, because the regulatory landscape around AI is still taking shape, companies can fall into a trap of looking to exploit these gray areas in exchange for being the first to market or gaining a competitive edge. This is why companies that are not using ethical privacy-preserving AI in facial recognition implementations, for example, are having to walk back their products.

Simply put, acting in this manner can have terrible consequences for the ethics around an AI product. But there is good news; the fix for this mistake is relatively straightforward: Instead of just making sure that products barely comply with regulatory gray areas, make sure they exceed them. Granted, this can lead to increased go-to-market time and significant leg work. However, this is the only way to realistically “future-proof” products against potential unethical use cases.

Is This System Adaptable?

Even the best preparation and forethought does not guarantee that a tool will operate exactly as it was intended. This is why it is so important for developers to have the ability to plan for contingencies and build adaptability into their tools so that adjustments can be made periodically if any ethical questions arise. This can be particularly helpful when it comes to addressing bias concerns that may occur as AI products learn and expand.

Technology is a dynamic and rapidly evolving category. And as such, developers are often working on very compressed timelines. But to get AI right, developers need time to suss out the bigger picture around their products and bake in everything possible to make sure products are set up for ethical use in the short, medium and long term. If they don’t, not only will reputational damage be done to a company, but a company’s entire product pipeline could be stunted indefinitely as products need to be pulled offline entirely.

Are Developer Teams Actually Prepared to Build Ethically?

Setting a concrete mission statement that is centered around ethics is a great start for any technology company. But without a more systematic approach to instilling principled behavior in developer teams, companies will struggle to drive tangible results in their pursuit of building ethical products. Additionally, given how complex ethical AI development has become—thanks to innovations in quantum computing, among other things—even the most seasoned developers will have trouble keeping up with the developments and desired standards relating to a company’s ethical AI goals.

Therefore, beyond just laying out overarching messaging, companies need to codify their ethical intentions by building an entire infrastructure that equips developers with the ongoing training and resources they need to constantly keep ethical standards in mind. If not, confusion will almost certainly ensue, missteps will occur and ethical standards will slip as a result.

Unfortunately, despite the promise, the AI world has fallen short of meeting the ethical frameworks we need to have in place to both solve the problems of tomorrow while also serving the public good. But this doesn’t have to be the case. By asking these few simple questions, companies can empower developers and build the ethical development infrastructure that is needed for AI to achieve its full potential.

November 17, 2021
Dynatrace Adds Security Gates to Advance DevSecOps Adoption

Dynatrace today added a security gates capability to its observability platform to make it easier to automatically embrace DevSecOps best practices within an application delivery pipeline.

Steve Tack, senior vice president for product management at Dynatrace, said the security gates function much the same as the quality gates that Dynatrace previously added to that platform in that each release is now also automatically assessed to ensure only secure code is being deployed.

The Dynatrace platform now uses a Davis artificial intelligence (AI) engine to scan for vulnerabilities in application workloads in real-time and then prioritizes them based on the risk they pose, noted Tack. The goal is to make it simpler for organizations to incorporate security reviews in application development processes in a way that doesn’t necessarily require developers to become security experts, he added.

Instead, the core DevOps platforms should be capable of identifying issues that can be remediated before an application is ever deployed in a production environment, said Tack.

Dynatrace earlier added an ability to automatically identify the software libraries and open source packages that present the greatest security risk. The security gates capability now extends the scope of that effort to include applications as they are constructed using custom code.

In general, most organizations are looking for ways to embrace DevSecOps best practices. The challenge is achieving that goal without unduly slowing down the rate at which applications are developed. In fact, a recent survey commissioned by Dynatrace found, on average, organizations expect to increase the frequency of their software releases by 58% over the next two years. However, nearly a quarter (22%) of respondents admit they’re often under so much pressure to meet the demand for application deployments that they must sacrifice code quality, which broadly includes security issues.

It’s not clear to what degree security reviews will automatically be included within a quality assurance process, but Tack said the goal should be to limit human involvement in the application deployment process as much as possible. The issue many development teams encounter today is that applications are being rejected by cybersecurity teams that are reviewing applications just before they are deployed, noted Tack. As a result, developers are racing to build applications faster only to see them rejected and returned to them at the last possible moment, he added.

In the wake of a series of high-profile software supply chain breaches, the focus on DevSecOps has increased substantially within most organizations. It’s often not precisely clear who is responsible for application security, but as DevOps platforms continue to evolve, there may come a day when security issues are routinely addressed within every DevOps workflow.

In the meantime, there needs to be a lot more focus on bridging the divide between DevOps and security teams. Given the chronic shortage of security professionals, there’s no doubt DevOps teams need to assume more responsibility for application security. The challenge and the opportunity is finding a way to achieve that goal with the least amount of friction possible.

November 10, 2021