devopsy.kinsta.cloud

Tag: survey

Survey Surfaces Steady Gains in DevSecOps Adoption

A survey of more than 500 DevOps practitioners finds less than half (47%) of respondents work for organizations that regularly employ best DevSecOps practices.

Conducted by Techstrong Research, an arm of the TechStrong Group, which is also the parent organization of devopsy.kinsta.cloud, the survey additionally finds 54% of respondents regularly practice code scanning for vulnerabilities during development, while 40% conduct security testing.

A full 59% of respondents said they are also making further investments in application security, with 19% describing their investment level as high. At the same time, 64% of respondents are investing in a code scanning tool, with 24% describing those investments as high. A total of 62% are investing in application programming interfaces (API) security, with 23% of respondents describing those investments as being high.

Additionally, among the 61% of respondents that are embracing platform engineering as a methodology for managing DevOps workflows at scale, 48% cited improving security as a primary motivation.

Mitch Ashley, principal analyst for Techstrong Research, said rather than simply trying to shift responsibility for application security further left toward developers, the survey makes it clear more organizations are now applying best DevSecOps practices across the entire software development lifecycle (SDLC).

In fact, the survey finds that DevOps has already had either a high (34%) or medium (43%) impact on improving software security for more than three quarters (77%) of respondents. The challenge is there is still much work to do, given that fact that more than half of respondents have not yet fully embraced DevSecOps workflows, even following a series of high-profile breaches specifically involving applications.

In addition, cybercriminals are clearly now targeting software supply chains using stolen developer credentials to inject malware in the hopes it will find its way into multiple downstream applications. The only way to discover those types of threats is to scan not only code as it is developed, but also where it is stored, and ultimately incorporated into the build that gets deployed into a production environment.

The challenge, as always, is determining how to ensure best practices are followed without unduly slowing down the rate at which applications are being built and deployed. Application developers typically resent tools and platforms that generate too many false-positive alerts that wind up being a distraction that inhibits their ability to focus.

Developers usually don’t allocate much time to creating patches for applications, so the more tools can identify relevant issues as developers are actually writing code, the more likely it becomes developers will embrace DevSecOps practices. That’s crucial at a time when more developers are starting to rely more on AI to write code that might not be secure. The general-purpose large language models (LLMs) that these AI tools are based on have been trained using code of varying quality that has been aggregated from across the Web. As a result, it’s not uncommon for these tools to generate vulnerable code.

Longer term, however, LLMs that have been trained using code that has been vetted for vulnerabilities should generate code that is more secure than what many human developers are able to currently produce. In the short term, however, application security, thanks to generative AI, might get worse before it gets better.

One way or another, the number of organizations embracing DevSecOps practices will only increase as requirements and regulations become more stringent. The only issue left to determine is how to best orchestrate those workflows across increasingly complex development lifecycles.

For more information, download a copy of the DevOps Report here.

October 2, 2024
Developer Survey Surfaces Widespread Reliance on AI

A global survey of 65,437 developers conducted by Stack Overflow finds 62% are already using artificial intelligence (AI) tools, with an additional 14% planning to adopt these tools this year.

Additionally, most developers agree that AI tools will be more integrated across the documenting of code (81%), testing code (80%) and writing code (76%), the survey finds.

Despite those advances, however, a full 70% of respondents said they do not perceive AI as a threat to their job. Rather, the biggest concern is misinformation and disinformation in AI results (79%), followed by source attribution (65%).

Paul Nashawaty, practice lead for Application development at The Futurum Group, said it’s apparent AI is rapidly becoming an indispensable tool across the DevOps landscape, with developers increasingly embracing its capabilities to streamline and enhance their workflows.

However, the ethical concerns, particularly in terms of misinformation and disinformation, cannot be ignored and must be addressed to ensure responsible and trustworthy AI adoption in DevOps workflows, he added.

Currently, the most widely used AI tool is ChatGPT, and 74% of developers using it now want to keep using it next year. However, 41% of ChatGPT users also noted they want to use GitHub Copilot next year. It’s not clear to what degree developers are simply copying and pasting the code generated by AI tools versus using it to jumpstart a project that requires them to either modify or write additional code.

The one thing that is certain, however, is the number of AI tools that will be made available to developers is only going to continue to increase in the next year. One of the challenges DevOps teams will encounter is orchestrating the tasks assigned to various AI agents across workflows that DevOps engineers are managing. Most of the AI tools being used today are designed to reduce the toil of a specific developer or engineer. The next step will be to add AI agents to workflows that span multiple developers and engineers.

Longer term, as the reasoning capabilities of the language models being used to create code continue to improve, the types of tasks that can be managed by AI agents should also increase.

At the same time, as language models are trained using samples of code that have been more closely vetted, the overall quality of the code being generated should improve as well.

Less clear is how the role of developers and software engineers will evolve in the age of AI. It’s likely they will be writing less code, but there is still going to be a need to supervise the development of software. Those individuals will need to know how software should be constructed to ensure the best outcome, otherwise when it comes time to troubleshoot an issue there will no one that truly understands what went wrong.

Of course, it will be a while before every line of code is created using AI, and there are trillions of lines of code written by humans already running in production environments that need to be updated and maintained. Undoubtedly, AI agents will play a role in helping to accomplish that task, but not without first being trained by the developers that understand how that code was constructed in the first place.

August 23, 2024
Survey Surfaces Varying Levels of Enthusiasm for AI Coding Tools

A survey of 406 developers, software engineers, CTOs, CISOs and application security professionals finds that while the majority of respondents (80%) said their organization is ready to use artificial intelligence (AI) tools to write code, the level of enthusiasm for these tools is far higher among C-level executives.

In fact, 40% of the 135 C-level executives surveyed said their organization is “extremely ready” compared to only 26% of 58 application security professionals and 22% of the 119 developers surveyed. A third of the C-level executives said adopting AI coding tools is critical for their organization, with 19% noting they did not attribute any risk to AI coding tools.

Snyk CTO Danny Allan said, in general, organizations would be well advised to test the output of generative AI coding tools within the context of their use cases. Generative AI tools are probabilistic rather than deterministic, so the quality of the output can vary considerably. Unfortunately, there is a natural tendency among developers to place too much faith in the output of an AI coding tool, he noted.

Nevertheless, roughly two-thirds of respondents (63%) rated the security of AI-generated code as either “excellent or “good.” Only 6% rated it as “bad”. At the same time, however, well under half said their organizations provided AI coding tool training to the majority of their developers, the survey finds.

In fact, the survey suggests that not many organizations are pursuing a deliberate approach to AI coding. Less than 20% of respondents said their organization undertook a proof-of-concept (POC) as part of their preparation steps for adopting AI coding tools.

It’s still early days so far as the adoption of AI coding tools is concerned, but usage is probably much broader than officially recognized. Individual developers may not disclose when they are using these tools to help them write code. DevOps teams should be making extensive use of software bill of materials (SBOMs) to help identify which code was written by who, or in the case of machines, what, noted Allan.

Of course, there will probably soon come a day when organizations are using AI to govern how developers are using AI tools to write code, but in the meantime DevOps teams should assume they will need to troubleshoot a fair amount of the code being generated by machines. Less clear is whether that code will be any better or worse than what is created by human developers but undoubtedly there will, as developers become more productive, be a lot more code soon finding its way into production environments.

Ultimately, AI will also be infused into the tools that DevOps teams rely on to manage code, but in the short term there may be an imbalance. Developers are gaining access to AI tools faster than DevOps engineers that generally need to wait for the next round of updates to the platforms they rely on to manage software engineering workflows.

Regardless of how all the code moving through DevOps pipelines was created, however, the one thing that won’t change is the degree to which software engineers will be held accountable for it.

June 24, 2024
Survey Surfaces Widespread Reliance on Generative AI Among Developers

A survey of 885 developers conducted by Docker, Inc. finds reliance on artificial intelligence (AI) to help build applications is rapidly becoming pervasive.

Nearly two-thirds of respondents (64%) are using AI for coding (33%), documentation (29%), conducting research (28%), writing tests (23%) and troubleshooting/debugging (21%). The most widely used generative AI platforms are ChatGPT (46%), GitHub Copilot (30%), and Google Gemini (19%).

Overall, 65% of the developers surveyed said they view AI positively because it simplifies processes (61%) and enables them to focus more on crucial tasks (55%). Less than a quarter (23%) view AI as a threat to their job.

However, nearly half (45%) said there is too much emphasis on AI. Nevertheless, 40% of respondents identified generative AI as the most important trend in software development, followed closely by AI assistants for software engineering (38%).

Dr. Julia Wilson, user experience researcher for Docker, Inc. noted that more senior and full-stack developers tended to view GenAI as most important, whereas more junior developers with less than five years of experience viewed AI assistants for software engineering as being more important.

It’s still early days when it comes to applying AI to software engineering but it’s clear there are plenty of use cases. Most of that usage currently benefits developers. However, as reasoning engines embedded within large language models (LLMs) become more advanced, it’s now only a matter of time before generative AI platforms can orchestrate a series of tasks that previously would require DevOps teams to write scripts to programmatically perform. Instead, the generative AI platform will create the required scripts required. Those capabilities will serve to eliminate a lot of the toil that ultimately conspires to burn out members of a DevOps team, noted Wilson.

It remains to be seen, however, what impact generative AI will have on how DevOps teams are structured. In theory, an existing DevOps team augmented by AI should be able to build, update and manage a lot more applications. In many cases, the need for entry-level developers might be sharply reduced or, conversely, it may turn out that the junior developers can manage tasks that previously required a senior developer. At the same time, AI may ultimately make DevOps more accessible to a wider range of organizations that previously lacked the resources required to hire and retain software engineers.

The one certain thing is AI is not going back into the proverbial bottle. In fact, the next generation of generative AI platforms will be trained on a narrow set of code that has been vetted for quality and security. That approach should reduce the number of instances where a generative AI platform “hallucinates” in a way that produces code that simply doesn’t work or is rife with known vulnerabilities. General-purpose LLMs such as ChatGPT were trained using code examples pulled from across the Web so the current level of the code being generated is inconsistent.

As a result, one short term concern DevOps teams should have is whether developers become too dependent on generative AI platforms that, by definition, are probabilistic rather than deterministic. In fact, it’s often challenging for a generative AI platform to consistently surface the same code when responding to identical prompts.

As is the case with any major innovation, the challenge is making sure that AI is used both responsibly and safely anytime it is being used to generate code.

Photo credit: Thomas Lefebvre on Unsplash

April 16, 2024
BMC Mainframe Survey Results Show a Platform on the Rise

What if I told you that the oldest active computing platform is also one of the most innovative, seen as a platform for growth and new workloads, not just by seasoned professionals, but by a new generation of stewards, too? The 2023 BMC Mainframe Survey shows just that. In addition to an overwhelmingly positive perception and growth mindset regarding the mainframe, the survey reveals that the majority of those who are most enthusiastic about its future are relative newcomers to the platform.

Now in its 18th edition, the annual BMC Mainframe Survey gauges the opinions of more than 800 executive and technical professionals on a range of topics, from overall perception of the platform to top priorities, common practices and greatest challenges.

This year’s results show that 94% of respondents have a positive perception of the mainframe, with 62% citing it as a platform to grow and attract new workloads. This tracks the 62% who report adopting DevOps practices on the platform. It’s no surprise, then, that two of the top five priorities cited by respondents are efforts to enhance automation and modernize applications. Organizations around the world recognize that the mainframe can be a leader in innovation, powering their digital transformations.

Modern Management Approaches

This innovation goes beyond the software and services developed for the mainframe to include those used to manage the platform. It’s reported that 35% of respondents listed the implementation of cloud technologies as one of their top four priorities for the coming year, with 41% saying they are considering cloud-based storage and backup. With the growing volume of mainframe data and the emergence of new regulations and standards governing data security and recovery, organizations are turning to cloud-based data management to reduce costs and improve recovery options.

Year over year, the number of survey respondents reporting the use of AIOps hasn’t changed considerably, but those reporting its cross-platform use on both mainframe and non-mainframe systems has jumped 7% from 2021.

Organizations are recognizing the need to take advantage of the greatest business values of AIOps — cited in the survey as improved uptime and the ability to detect problems quickly, understand trends and respond proactively — as part of a holistic approach to enterprise IT operations management.

With increased cross-platform use, significant benefits and a decrease in the number of respondents reporting implementation challenges like cost, complexity and the need for specialized skillsets, BMC sees AIOps as an area ripe for significant growth in the coming year.

Investment Pays Dividends

Improving the availability, quality and efficiency of the mainframe, of course, requires investment. In our report on the results of the 2023 BMC Mainframe Survey, we compare the responses of maximizers (those planning to increase investment in the platform) with those of minimizers (those planning to decrease investment levels). The results are eye-opening.

Maximizers have invested in future-proofing their workforce in a variety of ways, and the data bears that out; 81% have ten or fewer years of experience on the platform. The new generation of stewards sees the mainframe not as a legacy platform, but one of continued growth and innovation, worthy of the investment required not just to keep it modern, but to place it at the forefront of digital transformation.

Another key difference between maximizers and minimizers relates to security, which was cited as the top overall priority of survey respondents for the fourth consecutive year. Maximizers are more likely than minimizers to have a dedicated resource to investigate security events and to have dedicated ransomware recovery capabilities in place. It should come as no surprise, then, that maximizers were 20% more likely than minimizers to report that their mainframe security controls for ransomware are extremely effective.

These results show that the differences between maximizers and minimizers go beyond outlook, producing tangible effects on outcomes. The maximizers increasing their investment in the mainframe report fewer challenges with staffing and skills shortages and a stronger stance against increasingly sophisticated cyberthreats. The minimizers decreasing their investment in the platform not only have greater difficulty in maintaining a skilled workforce, which increases the risk of falling behind competitively, but it also puts their organizations at serious risk of potentially catastrophic security breaches.

A Bright Future

In short, the results of the 2023 BMC Mainframe Survey reflect a positive outlook for the platform’s future. By investing in their workforces and the tools required to advance and protect the platform while adopting modern techniques and practices, organizations can reduce risk and promote innovation that delights their customers.

November 16, 2023
92% of Devs Use AI, Survey Says ¦ Intel One Mono Font

Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

This week: GitHub touts unbelievable AI stats, and Intel’s beautiful open source typeface. (more…)

June 15, 2023
Yeah, You’re Doing DevOps

The Stack Overflow annual survey of developers came out this month, and it has a lot of interesting data points in it. There is a lot that I wish was different about their questions/methodology, but one thing caught my attention. Docker, Kubernetes and similar tools (Ansible and Terraform are in there at lower percentages, for example) make up more of the responses than can be accounted for by people with “DevOps” in their title.

Sometimes by a lot.

That means we have a fair number of developers that are doing DevOps, but who aren’t DevOps team members. Yeah, there are a few systems admins in the ranks of the respondents also, but not enough to cover the discrepancy. If every respondent that was in DevOps and sysadmin roles used Kubernetes, there would be just enough to cover the number of respondents that said they used Kubernetes “extensively” over the past year. It’s unlikely that all of them are Kubernetes specialists. And that doesn’t touch on Docker, with a whopping 40% of respondents saying they use Docker extensively. Any developer with recent experience can explain away Docker—though “extensive” is a bit strong for your average developer’s usage, it is becoming part and parcel of development, using containers to host dev environments, test, even build tools. And, of course, some deployments. But 40% is still a lot.

So, if your title is developer, and you’re using deployment tools on a regular basis, go ahead and call yourself DevOps. That’s not the only criteria, but if you were going to pick one, the breadth that using deployment tools represents combined with the implication that there isn’t an ops person worrying about that type of thing makes “uses deployment tools” a good stand-in test.

To the nearly 18% (20% of pro developers) of you using Yarn, I tip my hat. I used it for a couple of years early on in its life, and am happy to say I do not need to use it any longer. I assume your usage is not tied to Hadoop and that it has greatly improved over my 2015-2016 experience. Still, y’all rock, just by definition of using it to get resource scheduling down. It ain’t easy.

Across the board, the number of DevOps/Ops tools that make these lists is amazing for a developer survey – nearly 9% of respondents use Ansible, and nearly 9% use Terraform. There is undoubtedly overlap, so the actual number that uses one or the other is less than 18%, but still, nearly one in 10? That’s huge. And that’s DevOps or Ops, not purely developers. Regardless of title.

And that’s been a hallmark of development since the field took off—doing what needs to be done to deliver software. This is just another iteration, and you’re rockstars, regardless of title. You keep delivering apps that run the business—let them call you whatever they like. Money talks; titles are pretty much meaningless. Not like you’ll retire on a title, but bonuses or stock grants? Those you might retire on.

August 18, 2021
CircleCI Report Finds DevOps Teams Adjusting to New COVID-19 Normal

An annual State of Software Delivery report published today by CircleCI suggests that after a spike in developer activity last spring at the beginning of the COVID-19 pandemic, the pace at which code is moving through a continuous integration/continuous delivery (CI/CD) platform has returned to normal levels even as developers continue to work from home.

CircleCI CEO Jim Rose said after any initial rush last spring, it appears maintaining that level of productivity is simply unsustainable for most organizations. If heroic measures are continuously required, Rose noted it’s only a matter of time before DevOps teams start to burn out.

Based on an analysis of 55 million data points gathered from 160,000 projects spanning more than 44,000 organizations, the CircleCI report finds that despite the ability of a handful of organizations that can deploy code multiple times per day, most organizations on average run workflows less than once (0.7 times) per day.

However, Rose noted, there is too much focus on the number of times per day code is being deployed. The more important metric is duration. Half of the 11 million workflows measured by CircleCI finished in less than four minutes. Three-quarters finished in less than 11 minutes, with 95% of all workflows measured finishing in less than 35 minutes.

Rose said durations are longer than in previous years, which suggests more testing is being included in workflows. In an ideal world, Rose said workflow durations should be in the range of five to 10 minutes.

The report also finds 50% of the workflows went from failing to being successfully deployed in 55 minutes on average, with the median success rate 61% of workflows. Splitting the workflows by the ones run on default branches versus the ones run on non-default provides more insight, and the median rates are 80% for the default branch and 58% for the non-default branch. Failure rates for the non-default branch are higher because that’s the branch most developers employ to experiment in a way that doesn’t impact the primary workflow.

Rose said the report also suggests there is a correlation between larger team size and better overall engineering performance. In times of uncertainty, IT leaders should consider increasing the size of teams to reduce burnout and maximize flexibility. Depending on the scope of the project, Rose said the CircleCI data shows that somewhere between five and 20 code contributors is the optimal number of team members. IT organizations would also be well-advised to consider how those team members are geographically distributed to maximize the number of hours in a day any project is being worked on without having to overwhelm a small number of developers working in the same time zone.

As has always been the case, DevOps success over the long term requires organizations to balance multiple factors and metrics. After all, the primary goal for most organizations is not so much to increase the amount of code being deployed as much as it is to increase the quality of the code that ultimately gets deployed in a production environment.

November 11, 2020
Survey Finds Security Champions Fostering DevSecOps

A survey of 99 application development and IT security professionals suggests organizations that appoint a security champion within their application development teams are making more progress toward implementing best DevSecOps practices.

According to the survey conducted by ZeroNorth, a provider of an application security automation and orchestration platform, 84% of respondents said they believe the efforts of dedicated security champions have both bolstered application security (AppSec) and improved relationships between security and DevOps teams.

More than two-thirds of respondents (67%) said a security champion initiative has existed in their organizations for less than two years, with almost 40% reporting an initiative being in place for less than one year.

Among respondents from organizations that have such programs, 78% of respondents said the program has strengthened the security skills and knowledge of developers, with 77% reporting their organization’s overall AppSec posture has improved. Half of the respondents (50%) noted having a passion for security is a characteristic of any successful security champion.

More than half of respondents (56%) said support from corporate security leadership was a top requirement for the success of security champion, while 47% said support from engineering leadership was also required.

In addition, 57% of survey respondents said corporate security teams should also play a role in defining security priorities, while 47% said they should be involved in training best practices.

ZeroNorth CEO John Worrall said the survey results show security champions within application development teams are becoming a unifying force that drives increased levels of collaboration between DevOps and security teams. In effect, the security champion functions as an ambassador for the security teams among developers, who typically don’t have a lot of security expertise, he noted.

At the same time, security champions within application development teams increase the confidence security professionals have in developers as responsibility for AppSec shifts further left toward DevOps teams, Worrall said.

Collaboration between those teams is more critical than ever as organizations embark on digital business transformation initiatives that are likely to become primary targets of cybercriminals, who increasingly are focusing their efforts on high-value targets, he added. The challenge now is finding a way to automate DevSecOps workflows to make sure that the rate at which those applications are being developed is not impeded by manual security reviews or security scans that take too long to run, said Worrall.

The level of progress organizations are making toward embracing best DevSecOps practices is, of course, uneven. However, it’s become apparent that continuing to rely on understaffed security teams to review applications for security flaws before they are deployed in a production environment is no longer practical. But finding a security champion with the appropriate level of application development expertise is no easy task. Merely adding someone from the security team into a DevOps team isn’t likely to succeed if that individual has no development experience. In fact, it’s often easier to teach developers about security than it is to teach cybersecurity professionals how to code. The issue is finding a developer whoDev has a zeal for security that is contagious enough for the whole DevOps team to eventually catch.

November 6, 2020
Survey Sees Faster Shift to Open Source Software

A survey of 638 IT professionals finds the economic downturn brought on by the COVID-19 pandemic is, like other slumps, driving increased adoption of open source software.

Conducted by Tidelift, a provider of commercial support and maintenance for open source projects, the survey finds 44% of respondents reporting their organizations are now more likely to use more open source. The survey also finds 42% of organizations have cut their application development budgets this year, with only 10% seeing an increase.

More than two-thirds said saving time and money is the top reason to use more open source for application development during the downturn (68%) while increasing efficiency of application development and maintenance was cited by almost half of respondents (48%).

However, reliance on open source software comes at a cost. The top two open source challenges cited are making good decisions about which components and versions to employ and making good decisions about when to upgrade components and frameworks, at 62% each. The third top challenge is identifying security vulnerabilities (49%).

Only a small fraction (18%) of organizations are extremely confident that their open source components are secure, up-to-date and well-maintained, and slightly fewer (17%) have a formal process for managing open source.

Tidelift CEO Donald Fischer said the current downturn is not all that much from previous economic slumps that lead to many organizations adopting an “open source first” approach to software. The challenge is many of those organizations don’t always appreciate the total cost of employing open source software. With each new open source project that gets added to the enterprise IT portfolio, the need to rely on external support services becomes more pressing, he said.

One thing that has changed over the years is more end user organizations are contributing to open source projects, with 83% of respondents reporting their organization contributes to open source projects. Almost half (49%) of organizations now have policies governing employee contributions to open source.

While many organizations initially view open source software as a way to reduce costs the days when the open source community was primarily focused on providing free alternatives to commercial operating systems and databases are long over. Innovations today are most often driven by open source consortiums such as the Linux Foundation, the Eclipse Foundation, the Apache Software Foundation and the Open Infrastructure Foundation, formerly known as the OpenStack Foundation. The rate at which software can be developed by teams of contributors working on an open source project makes it difficult for an IT vendor working on a single project to keep pace.

There will, of course, always be some form of commercial software consumed by enterprise IT organizations. However, the percentage of open source software continues to rise with each passing year. The latest economic downturn is only accelerating a trend that was occurring long before the COVID-19 pandemic arrived. The challenge now is finding the best way to manage all that open source software at a time when IT environments are also becoming more complex.

November 3, 2020