A survey of 404 IT professionals conducted by Snyk found the use of artificial intelligence (AI) to write code is creating a security paradox. On one hand, just over three-quarters of respondents (77%) said AI tools improve code security. At the same time, however, 59% are concerned that AI tools trained using general-purpose large language models (LLMs) will introduce security vulnerabilities that first appeared in the code used to train them.
The challenge with general-purpose LLMs is that they are trained using a combination of excellent, mediocre and flawed code. As a result, any recommendation surfaced has the potential to be a suboptimal security result.
Randall Degges, head of developer relations for Snyk, said that as AI tools increase the velocity at which applications can be constructed, it’s probable that DevOps teams will discover more vulnerabilities in their code.
In general, 61% of respondents also noted that automation has increased the number of false positives, with 62% of respondents reporting that at least one out of every four vulnerability alerts they received from automation tools were false positives. Well over a third (35%) said false positives represented over half of the vulnerability alerts.
On the plus side, however, more organizations are paying closer attention to application security issues in the wake of several high-profile breaches of software supply chains and disclosures of vulnerabilities. A full 96% reported their organizations are addressing supply chain security problems on an ad hoc basis, yet only half have a formalized supply chain security strategy in place.
The survey also finds 87% of respondents work for organizations impacted by a software supply chain security issue in the last year, with 61% having implemented new tools and processes as a result.
A total of 62% of respondents work for organizations that have a software life cycle assurance process in place, but only 42% of organizations are using software bills of materials (SBOMs). In addition, only 40% have formal security ratings for the open source packages that developers employ, and 31% ignore risks that arise from indirect dependencies.
However, only 40% of organizations have embedded security testing tools into their integrated development environments (IDEs), with 40% not using software composition analysis (SCA) or static application security testing (SAST) tools at all. In fact, even though 80% of respondents reported working for organizations that ship code daily, only 27% claim to continuously audit their code.
As a result, many vulnerabilities remain unpatched, with Java (42%) and JavaScript (31%) topping the list in terms of code with the most ignored vulnerabilities.
Finally, the survey also noted that vulnerabilities involving open source code are now being remediated faster than proprietary code. Maintainers of open source software are now paying more attention to cybersecurity issues thanks in part to the tools and best practices provided by the Open Source Security Foundation (OpenSSF), said Degges.
There will, of course, come a day when AI is more widely used to analyze vulnerabilities in code. In effect, AI will be used to solve some of the security issues general-purpose LLMs create. In the meantime, however, DevSecOps teams would be well-advised to proceed with caution.
BigPanda today added generative artificial intelligence (AI) capabilities to analyze incidents surfaced by its AI for IT operations (AIOps) platform.
Blair Sibille, field CTO for BigPanda, said Generative AI for Automated Incident Analysis leverages generative AI platforms based on the general-purpose large language models (LLMs) created by OpenAI.
The goal is to make it simpler for IT teams to discern the root cause of an issue by, for example, taking advantage of summaries of alerts enabled by generative AI to make it simpler for IT professionals of any skill level to understand what requires their most immediate attention, he added. Today, insights are lost in the sea of alerts that often inundate IT teams, Sibille noted.
BigPanda has been at the forefront of applying machine learning algorithms to automate IT operations management. Now, the company is incorporating external general-purpose LLMs to further augment IT teams, said Sibille.
As IT environments continue to be more complex, it’s becoming essentially impossible for IT teams to manage them at scale without relying more on automation. AI technologies take automation to another level, but they won’t eliminate the need for DevOps teams to manage IT environments, added Sibille.
BigPanda claimed generative AI capabilities will make it possible to reduce the amount of time required to resolve tickets by seven minutes each, with an accuracy rate of 95% during beta testing. Over time, those capabilities not only reduce mean-time-to-resolution but also reduce the level of toil that often conspires to burn out DevOps teams, said Sibille.
At the core of the BigPanda AIOps platform is a data lake capable of consuming data generated by multiple applications and systems. That data then provides the foundation on which machine learning algorithms are applied to surface insights.
It’s not clear how much generative AI will automate DevOps workflows, but in effect, more IT teams will be able to take advantage of having the equivalent of a DevOps engineer that they can query any time an issue arises using natural language, noted Sibille.
AI doesn’t mean that IT outages will be completely eliminated, but it does mean they will become a lot less stressful, he added.
Naturally, there’s a lot of speculation concerning the impact AI will have on DevOps. Some contend it’s only a matter of time before the entire software engineering process is automated. As those advances are made, the cost of building applications will effectively drop to zero. Others argue that AI will simply augment DevOps teams in a way that makes it simpler to manage IT at scale using either the same number or possibly even fewer engineers.
The one thing that is clear is that AI will soon be pervasive. DevOps teams should start evaluating today which tasks will be automated with an eye toward planning how DevOps roles will evolve as AI advances accelerate.
OutSystems, via a Project Morpheus initiative, intends to leverage generative artificial intelligence (AI) technologies to make it possible to automatically generate an application that developers will then use low-code tools to customize for specific use cases.
In the meantime, the company is extending an existing alliance with Microsoft to provide a connector that integrates its namesake low-code platform with instances of ChatGPT. These instances are made available via Microsoft’s Azure OpenAI cloud service to make it possible to build a low-code application in a matter of minutes.
Rodrigo Coutinho, director of data science for OutSystems, said that as generative AI continues to evolve, it will become possible for developers to use a natural language interface to create an application. However, there will also be plenty of instances where end users still prefer to access applications via a graphical user interface that developers build using low-code platforms, he noted.
An application editor will also provide ongoing suggestions for everything from how the user interface is designed to the way data is managed.
Developers will also be able to verify how code functions using the OutSystems visual language. In addition, The OutSystem compiler will be able to deterministically detect threats and code patterns produced by generative AI platforms that will include Google, Amazon and others alongside Microsoft.
Ultimately, citizen and junior developers will be able to build sophisticated applications that previously would have required the skills of a professional developer, noted Coutinho.
It’s not clear how much developers will embrace a low-code platform to build software. However, the one thing that is certain is the whole process of defining requirements before an application can be built will soon become obsolete as the building of an application becomes more iterative and involves developers working alongside subject matter experts, added Coutinho.
It may awhile before that vision of application development is realized, but the pace at which applications are built and deployed is clearly about to accelerate. The impact of all that code will naturally vary, but it’s already apparent that the cost of building many applications may soon drop to almost zero. Developers will soon be spending more time on making sure workflows are logical than writing actual code, noted Coutinho.
In addition to relying more on AI to build software, organizations should also rely more on AI to deploy it at unprecedented levels of scale. The days when application development projects were measured in months, sometimes years, is coming to an end. AI platforms will enable organizations to experiment at will because the time and effort required to build and deploy a new iteration of an application will be virtually nil.
Of course, no one can predict what impact all that code will have on society as we know it. But the only limit going forward may soon be what our collective imaginations can conceive than the level of developer expertise that can be marshalled at any given time.
In my book “Engineering DevOps,” published a few years ago, I classified DevOps into “nine pillars of DevOps best practices” – a comprehensive framework that covered the full scope of DevOps practices. Each of these pillars represents a vital area of DevOps implementation and, together, they ensure a holistic approach to integrating development and operations for effective collaboration and continuous delivery.
The current generation of AI-engineered tools is now being applied to each of the DevOps pillars and has the potential to significantly increase the efficiency, reliability and speed of the software delivery process. By automating repetitive tasks, improving decision-making with predictive insights and facilitating proactive issue resolution, AI can drive a higher level of quality, security and performance in the software development life cycle. Furthermore, AI’s capacity to learn and adapt over time means continuous improvement, fostering a truly data-driven, learning-oriented DevOps culture.
AI Applications for the Nine Pillars of DevOps
The following paragraphs briefly explain how the current generation of AI-engineered large language model (LLM) tools are being applied or could be practically applied to improve each of the nine pillars of DevOps.
Leadership Practices: Leadership is vital to drive cultural changes, set vision and goals, encourage collaboration and ensure resources are allocated properly. Strong leadership fosters a successful DevOps environment by empowering teams and supporting innovation. AI can assist leaders in decision-making by analyzing large datasets to identify trends and predict outcomes, providing valuable insights to guide strategic planning.
Collaborative Culture Practices: DevOps thrives in a culture of openness, transparency and shared responsibility. It’s about breaking down the silos that can exist between different teams (like development, operations and QA) and promoting effective communication and collaboration. AI-powered tools can improve collaboration through smart recommendations, fostering more effective communication and knowledge sharing.
Design-for-DevOps Practices: This involves designing software in a way that supports the DevOps model. This can include aspects like microservices architecture, modular design and considering operability and deployability from the earliest stages of design. AI can be used in the software design phase to automatically suggest improvements in code quality or to identify potential performance issues early.
Continuous Integration Practices: This is about developers frequently merging code changes into a central repository. After that, automated builds and tests are run. The main objectives are to detect problems early and reduce integration issues. AI can analyze patterns in past build failures to predict potential issues with new builds, leading to proactive error mitigation.
Continuous Testing Practices: Continuous testing involves automating tests to provide instant feedback on business risks and allowing for faster, more reliable releases. This approach enhances the quality of the software and reduces the time it takes to resolve defects. AI can be used to generate and optimize test cases automatically, reducing manual effort and speeding up the testing process.
Elastic Infrastructure Practices: Elastic infrastructure involves automated provisioning and management of computing resources, often leveraging cloud-based solutions for scalability and resilience. This includes practices like infrastructure-as-code (IaC). AI can help manage cloud resources by predicting future needs based on usage trends and automatically adjusting resources to optimize cost and performance.
Continuous Delivery Practices: This is an approach where code changes are automatically built, tested and prepared for release to production. It aims to make releases less disruptive and more frequent, increasing speed and efficiency. AI can help predict the potential impact of new releases on the system, aiding in decision-making related to deployment.
Continuous Security Practices: Also known as DevSecOps, this involves integrating security practices into the DevOps workflow. The goal is to introduce security considerations early and often in the life cycle rather than leaving them as an afterthought. AI can be used in anomaly detection to identify potential security threats and automate security policy enforcement.
Continuous Monitoring Practices: Monitoring systems and application performance in real-time allows teams to detect and react to problems quickly, often before they impact users. It’s crucial for maintaining application health and informing future improvement efforts. AI can analyze logs and metrics to predict potential system failures or performance degradation, allowing for proactive maintenance and issue resolution.
Pitfalls and Challenges
Applying AI to DevOps is a complex process with certain challenges. Here are some potential pitfalls, along with ways to address them:
Data Quality and Availability: AI relies heavily on data for training and making accurate predictions. If the data is inaccurate, incomplete or biased, it can lead to misleading outcomes. Ensure you’re collecting high-quality, relevant and unbiased data for training AI models. Regular data audits can help maintain data integrity.
Over-Reliance on Automation: While automation is beneficial, over-reliance on it without human oversight can result in overlooked errors or system failures. Maintain a balance between automation and human intervention. Implement periodic manual checks and reviews to validate AI-generated results and actions.
Security and Privacy Concerns: As AI tools are more integrated into the DevOps pipeline, they may become targets for security threats. Also, the handling of sensitive data used for AI training can raise privacy issues. Implement strong security practices, conduct regular security audits and consider privacy requirements during the data collection process.
Black Box Problem: AI, especially complex models like neural networks, often operate as a “black box,” meaning it’s difficult to understand why they made a certain decision. This lack of transparency can make troubleshooting difficult. Consider using explainable AI (XAI) techniques, which aim to create more understandable AI systems, providing transparency into how decisions are made.
Skills Gap: The application of AI in DevOps requires a certain level of expertise and understanding of both domains, which can be hard to find. Invest in training and upskilling existing staff, or consider bringing in external expertise through hiring or consultancy. Sharing knowledge and encouraging continuous learning can also help bridge this gap.
Summary
AI-engineered tools can enhance all of the nine pillars of DevOps by increasing efficiency, speeding up processes and making predictions to aid decision-making. However, implementing AI in DevOps comes with challenges such as ensuring data quality, maintaining a balance between automation and human intervention, addressing security and privacy concerns, managing the “black box” problem of AI and overcoming skills gaps. Each of these pitfalls can be addressed through proactive strategies like maintaining data integrity, implementing manual checks, bolstering security practices, using explainable AI techniques and investing in training and skills development.
The 2023 Atlantic hurricane season marks a transformative era in tropical forecasting, driven by the remarkable progress in machine learning and big data analysis. It’s a rapidly evolving field, where technology and meteorology intersect to better prepare the public for the formidable forces of Mother Nature.
NOAA’s 2023 Atlantic Hurricane Season Forecast
The National Oceanic and Atmospheric Administration (NOAA) projects that this year’s Atlantic hurricane season will produce 12 to 17 named storms, with five to nine major (Category 3+) hurricanes. NOAA expresses 70% confidence in these ranges, bolstered by its evolving technology.
A summary infographic showing hurricane season probability and numbers of named storms predicted from NOAA’s 2023 Atlantic Hurricane Season Outlook. (Image credit: NOAA)
Upcoming Upgrades: Supercomputing System Expansion
The recent implementation of theProbabilistic Storm Surge model improves storm surge forecasting for the U.S. mainland, Puerto Rico and the U.S. Virgin Islands. The model provides forecasters with a range of potential flooding scenarios, enhancing community preparedness.
NOAA plans to implement several more upgrades this summer, including a 20% expansion of its operational supercomputing system’s capacity. This enhancement will enable NOAA to run more complex forecast models, leading to more accurate predictions.
In late June, theHurricane Analysis and Forecast System (HAFS) becomes operational. Running in tandem with the current Hurricane Weather Research and Forecast Model System, HAFS is projected to show a 10-15% improvement in track forecasts over existing models.
HAFS represents a significant leap forward in the integration of machine learning algorithms and sophisticated data analysis techniques. By leveraging state-of-the-art computational models and assimilating an extensive array of meteorological data, HAFS has the potential to unlock new insights into the behavior and trajectory of tropical cyclones. This fusion of technology and meteorology is projected to surpass the capabilities of existing models.
Harnessing Machine Learning for Advanced Forecasting
The core strength of HAFS lies in its ability to process vast amounts of atmospheric and oceanic data, utilizing advanced machine learning algorithms to identify patterns and correlations. These algorithms can discern intricate relationships between various meteorological variables, such as sea surface temperatures, atmospheric pressure, and wind patterns, enabling more precise forecasting. By comprehensively analyzing historical storm data and incorporating real-time observations, HAFS can generate forecasts with higher accuracy and longer lead times.
HAFS also harnesses the power of high-performance computing, allowing for faster and more complex simulations. This computational prowess enables the system to simulate a multitude of possible scenarios, accounting for various atmospheric conditions and factors that influence hurricane behavior. The ability to run multiple simulations and generate ensemble forecasts enhances the robustness of predictions and provides forecasters with a comprehensive range of possibilities.
Innovative Technologies: Drones, Saildrones, Underwater Gliders, and Sounding Balloons
Small aircraft drone systems offer a unique vantage point for data collection in the lower atmosphere, enabling meteorologists to gather critical information on temperature, humidity, wind patterns, and other atmospheric variables. These drones are equipped with advanced sensors and instruments, allowing them to navigate through hurricane environments and provide valuable real-time data that can significantly improve forecast models.
Saildrones, alternatively, are autonomous surface vehicles equipped with an array of meteorological and oceanographic sensors. They harness wind and solar energy for propulsion, enabling them to traverse vast oceanic regions and collect crucial data on sea surface temperatures, ocean currents, and other parameters relevant to hurricane formation and intensification. By expanding the fleet of Saildrones, scientists can enhance their observational capabilities and obtain a more comprehensive understanding of the complex interactions between the ocean and the atmosphere during hurricane events.
Underwater gliders, equipped with sensors and instruments, offer a unique perspective beneath the ocean’s surface. These autonomous vehicles can collect data on temperature, salinity, and ocean currents, providing valuable insights into the oceanic conditions that influence hurricane development and intensity. By combining data from underwater gliders with other observational platforms, scientists can gain a more holistic understanding of the underlying processes that fuel tropical cyclones.
WindBorne global sounding balloons ascend to the upper levels of the atmosphere, collecting data on temperature, humidity, and wind patterns. This information is vital for initializing and validating numerical models used in hurricane forecasting, enhancing the accuracy of predictions.
NOAA GOES satellite captures Hurricane Ian as it made landfall on the barrier island of Cayo Costa in southwest Florida on September 28, 2022.
Improving El Niño & La Niña Forecasts
The Tropical Atmosphere Ocean buoy array is undergoing modernization and upgrades, bolstering the accuracy of El Niño and La Niña forecasts. These climate patterns have significant impacts on hurricane activity, and accurate predictions of their behavior are crucial for understanding the overall climate system.
By modernizing and enhancing the buoy array, scientists can gather more precise data on oceanic and atmospheric conditions associated with El Niño and La Niña, leading to more accurate long-range hurricane forecasts.
New tools and upgrades have also been introduced for more precise hurricane analysis and forecasting. TheNational Hurricane Center has expanded its Tropical Weather Outlook graphic forecast range to seven days from five. To give communities more time to prepare, theWeather Prediction Center has also extended the Excessive Rainfall Outlook by two days.
A summary graphic showing an alphabetical list of the 2023 Atlantic tropical cyclone names as selected by the World Meteorological Organization. The official start of the Atlantic hurricane season is June 1 and runs through November 30. (Image credit: NOAA)
Bolstering Resilience Against Future Hurricanes
The integration of these innovative technologies and the modernization of existing observational systems expands observational capabilities both in the atmosphere and the ocean to track and monitor storms. The evolution of forecasting techniques holds promise for even greater resilience against future hurricanes, showcasing the remarkable impact of technological advancements in safeguarding coastal communities.
Google is previewing an instance of a generative artificial intelligence (AI) service that surfaces code recommendations to make it possible to build high-quality applications faster.
Specifically, Duet AI for Google Cloud surfaces code recommendations in real-time, generates full functions and code blocks and suggests fixes for vulnerabilities and errors in the code that it discovers. It also promises to enable DevOps teams to create custom large language models (LLM) based on their own code. In fact, GitLab and Tabnine are, respectively, already integrating LLMs running on Google Cloud with their continuous integration/continuous delivery (CI/CD) platform and testing tools.
Chen Goldberg, vice president of engineering for Google, told attendees at the Google I/O 2023 conference that Duet AI for Google Cloud will fundamentally change how developers will be able to build applications, regardless of their skill level.
Duet AI for Google Cloud was trained using data collected from Google Cloud using sample code and documentation to fine-tune behaviors and patterns.
Duet AI for Google Cloud is available under an AI Trusted Tester Program and provides developers with many of the same capabilities that can be found in the GitHub Copilot tool that is based on the LLMs created by OpenAI.
In addition to making Duet AI for Google Cloud accessible via both its tools and managed services, Google said it also plans to integrate the service with multiple integrated development environments (IDEs).
It’s still early days as far as the use of generative AI within DevOps workflows is concerned, but it’s clear that the amount of code being created by developers is about to increase exponentially. Hopefully, AI technologies will also one day help software engineers find ways to manage the massive volume of code moving across their DevOps pipelines.
Generative AI platforms will fundamentally change the way humans interact with machines. Instead of requiring a developer to create a level of abstraction to communicate with a machine, it’s now possible for machines to understand the language humans use to communicate with each other. Using a natural language interface, developers will soon be asking generative AI platforms to not only make suggestions but also debug applications and, eventually, write the code used to create an application.
At this point, like it or not, the generative AI genie is out of the proverbial bottle. Just about every job function imaginable will be impacted to varying degrees. In the case of DevOps teams, the ultimate impact should involve less drudgery and toil as many of the manual tasks that conspire to make managing DevOps workflows tedious are eliminated.
In the meantime, DevOps teams should spend some time identifying which tasks will become automated by generative AI and other technologies that employ machine and deep learning algorithms. It doesn’t make much sense to onboard new members to a DevOps team only to discover that the tasks assigned to that individual are about to be automated. Hopefully, when all these AI technologies are finally implemented, the entire DevOps experience will be better than ever.
New Relic has added a tool that takes advantage of generative artificial intelligence (AI) to make it simpler to query the telemetry data collected by its observability platform via a natural language interface (NLI).
Jemiah Sius, director of developer relations for New Relic, said New Relic Grok will make the New Relic One platform more accessible to a wider range of IT professionals, especially those that haven’t mastered New Relic’s proprietary programming language that enables DevOps teams to identify the root cause of an issue.
New Relic Grok automatically pinpoints code-level errors in integrated development environments (IDEs) in addition to analyzing code, stack traces and production telemetry to suggest fixes. New Relic is providing this capability via integration with the large language models (LLMs) created by OpenAI, which is providing the foundation for a broad range of generative AI capabilities through Microsoft. New Relic has a long-standing alliance with Microsoft, added Sius.
Using plain language, anyone can generate a system or app health report complete with anomalies, issues and recent deployments in a way anyone can understand without having to create and filter dashboards, he noted.
New Relic Grok also makes it simpler to identify instrumentation gaps that can then be addressed using the instructions it provides. It can also set up missing alerts and automate alerts using the open source Terraform infrastructure-as-code (IaC) tool.
Finally, IT teams can also use New Relic Grok to manage accounts, users and user access, data retention rules, usage, billing and other administrative tasks.
New Relic previously invested in machine learning algorithms to automate observability tasks. These AI extensions to the New Relic platform are part of a larger effort to extend the reach of the New Relic One observability platform further left toward developers and IT administrators rather than just site reliability engineers (SREs), said Sius.
However, New Relic doesn’t anticipate that generative AI will eliminate the need for SREs to use its programming tool to solve more complex problems, he added.
The overall goal is to provide development teams with frictionless access to observability data at every stage of the software development life cycle to reduce mean-time-to-detection (MTTD) and mean-time-to-resolution (MTTR) of issues.
In general, most organizations are still in the early stages of achieving full-stack observability. A recent New Relic survey found only 27% of respondents have achieved full-stack observability and only 5% claimed they have a mature observability practice in place. A third (33%) of respondents also said they still primarily detect outages manually or based on complaints, the survey found. On the plus side, the survey also found nearly three-quarters of respondents said C-suite executives in their organization are advocates of observability, and more than three-quarters of respondents (78%) saw observability as a key enabler for achieving core business goals. However, more than half (52%) of respondents said they experienced high-business-impact outages once per week or more and 29% said they take more than an hour to resolve those outages.
AI, of course, promises to improve reliability. At the very least, it could make it easier to identify issues long before a major disruption occurs.
