Actionable Summary
Thanks to cloud computing and open source, the pace of software development has been reduced from years to months, if not weeks.
Every company is becoming a software company. DevOps has quickly become the most effective way for companies to develop and deploy software at scale.
DevOps is the process of applying deliberate operational workflows and tools to the software development lifecycle. Leading companies such as Amazon, Adobe and Netflix, have deliberate DevOps workflows and tech stacks to build products.
DevOps has increasingly become a focal point for enterprises. Over 90% of business leaders cite DevOps as a top strategic priority in their organizations. However, only 12% of enterprises have mature DevOps capabilities.
For organizations to derive maximum value from the cloud, they need to have the right platforms to optimize software delivery. However, there are challenges. Only one in five companies says they have the right tools and automation to scale DevOps.
These challenges have presented an opportunity for companies to emerge within the DevOps space to solve this problem. While only 10% of companies have standardized around a single DevOps platform today, another 60% say they’re likely to do so over the next few years.
Security remains one of the most pressing issues for organizations, and we’re seeing security become tightly integrated into software through DevSecOps. This comes at a time when three out of four companies plan to incorporate security into their development capabilities.
Given the way DevOps processes flow together, the industry will likely see consolidation that will lead to a few winners and over time, niche players may become more marginalized.
With the advances in AI/ML, automation will increasingly play a critical role in software development including automated code reviews and code / function suggestions.
The Evolution of DevOps
Software is eating the world. Software now defines the speed of innovation and continues to differentiate the winners from the losers. Digital transformation continues to be key to survival for established companies. The winners don’t just need to be capable of building software; they need to be exceptional at it. Software development consistently requires more scale and more speed. Today, over 70% of DevOps teams release code as frequently as once a day, up 11% from 2021.
Defining DevOps
At its core, DevOps is a set of practices and methodologies that brings together software developers (Dev) and Operations (Ops) teams to deliver software at scale:
Security teams play a key role to ensure that software is delivered safely.
Engineering teams plan, create, and verify code.
Operation teams ensure successful release, packaging, configuration, and monitoring.
Building an effective DevOps process requires a deliberate culture of seamless collaboration. Pipelines, code merges, testing, validation, and a high degree of automation are required to quickly and safely move code from design and build through to deployment and production. This is reflected in Continuous Integration / Continuous Delivery (CI/CD), an instrumental part of the DevOps framework. CI is the philosophy of getting tests integrated with code automatically, and CD involves deploying that code frequently. Using a continuous and iterative process to build, test, and deploy can help avoid bugs and code failures.
DevOps practices allow development, security and operation teams to collaborate and work together to shorten the software development life cycle, sometimes from months to hours.
![](https://images.prismic.io/contrary-research/ef5e5b0c-85cc-4a25-bce9-00d11902dbef_image+%286%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab
How We Got Here
In the past, developers would write and run code on their personal computers. When it was time to launch, they required large monolithic servers and processes to deploy them. DevOps tools have enabled software teams to deploy code multiple times a day for their users. As Justin Gage at Technically describes it, just 10 or 15 years ago, if you were writing software, you’d need to:
“Manage your remote repositories manually (no GitHub), run your own data centers, or rent someone else’s (no AWS), move code between locations slowly (no 1gbps internet) and manually run tests and ping servers for monitoring (no Datadog). New features and product releases were very infrequent and slow.”
Cloud computing and open source have played a key role in driving the tailwinds for DevOps over the past 10 years.
Both cloud computing and open source tools have delivered scale advantages for software delivery and made the entire process cheaper. Organizations are moving from monolithic architectures (large, centralized servers) to microservices architectures (distributed and smaller applications). But the more scalable your architecture, the more chaotic your processes. Being able to ship faster doesn’t automatically mean you can ship smarter. Businesses like GitHub and GitLab have emerged to help automate the software delivery workflow all the way from code to deployment.
As every company becomes a software company, and the rate of deployment in software accelerates, developer productivity becomes even more critical. Operation teams must keep up with developers so that they can effectively manage the delivery and monitoring of the applications developers ship. Without a reliable and efficient infrastructure operation, developers cannot maximize their output.
DevOps emerged as the solution to bridge developers and operations together. By using a set of practices, workflows, and tools, practitioners hope to greatly accelerate the speed of innovation and reduce the amount of repetitive work. DevOps tools, therefore, are the important toolkits powering developers. But the DevOps revolution was made possible by a few massive leaps in software development: cloud computing and open source.
Cloud: The DevOps Spark
Building a software application in the 1990’s required a massive amount of effort, not the least of which was racking your own physical servers. On average, a new software application could take 3 years to be developed. The process was so slow, you would often see projects get scrapped because they became obsolete even before deployment!
The introduction of cloud computing, and the continued abstraction of different programming components through the use of containers, serverless, and APIs, have rapidly increased the rate of production for software. Entire platforms are built on cloud providers: Shopify and Snap are built on GCP; Netflix lives on AWS.
Today you can host your application on AWS, store your data on Snowflake, serve up content through Cloudflare, build out your client side application with Vercel, monitor your applications with Datadog, and integrate directly with thousands of other applications like Twilio, Stripe, and Okta via API. That evolution has moved the software development lifecycle from years to months, if not weeks.
The evolution of the cloud was the single most important transformation for the way software gets built. That, coupled with the advancement of open source, means that with an internet connection any developer can access the very best tools for any aspect of the development process. However, this velocity and application sprawl makes things incredibly complex to manage. That complexity was the spark that made DevOps such a priority.
DevOps has grown in tandem with the rising adoption of cloud computing and is a philosophical and cultural approach to better manage the complexity of cloud operations. DevOps provides greater transparency and a unified purpose that helps overcome friction between developers and operations teams (the former being focused on velocity and the latter being focused on stability).
Open Source: A Key Driver for DevOps Platforms
Beyond the cloud, open source platforms have played a key role in the adoption of DevOps. When it comes to effective DevOps deployment, if you look at companies with at least 60% of their DevOps assets as open source, over 54% of them are fully deployed. Meanwhile, just 20% of companies with low levels of open-source usage have managed to effectively deploy DevOps tooling. Open source has grown in popularity because of the cost-effectiveness, ease of adoption, and ability to integrate with other tools for developers. Open-source software is built to work and integrate with other software components and help organizations take advantage of the best tools for the job while mitigating complexity.
Many of the top DevOps vendors have built their software on top of open-source frameworks. A major reason for this is that it helps the vendor adapt to the ever-changing landscape and ensure they have a high-quality codebase. Open-source codebases sometimes have thousands of developers' eyes scrutinizing the code for their own projects. The codebase is continuously undergoing a Kaizen-like improvement over time.
This is in stark contrast to proprietary code where a vendor will have a limited number of in-house developers managing a codebase that likely consists of tens of thousands of lines of code. Ultimately, this is the fundamental reason why many leading software vendors become outdated legacy platforms, especially if their codebase has a monolithic structure that hasn’t adopted a microservices architecture.
Significant open-source innovation has occurred in the source code management space. Git, released in 2005, is a free and open-source repository for source code that enables developers to better manage version control. Inevitably, as developers are writing code and then testing it, they will encounter something faulty. Version control empowers them to revert back to an earlier version of the codebase that doesn’t contain the error so that they have an easier time troubleshooting.
One of the biggest value-adds for Git is its branching model which allows a developer to write branches of code independent of the codebase's trunk. This gives developers the flexibility to experiment with new ideas without affecting the entire application or to save certain lines of code just for production. Git makes it effortless to merge, delete, or recall branches when needed.
Sizing Up The DevOps Opportunity
The number of developers today is estimated at nearly 30 million. Only 50% of companies have implemented DevOps at scale in their organization, and only one in five companies say they have the right tools and automation to scale DevOps. Many companies are still playing catch-up to fill those gaps. That means the DevOps revolution is still in the early days.
There is a large opportunity for DevOps vendors to provide the software necessary to facilitate a more cohesive culture and streamline workflows. While most organizations are in the midst of rolling out DevOps, 82% of them are in the low to mid-levels of DevOps deployment; but deployment is happening.
![](https://images.prismic.io/contrary-research/4c0fa3b8-a4fc-40ff-97d4-7634f4e38de8_image+%287%29.png?auto=compress%2Cformat&fit=max&w=1080)
Source: State of DevOps Report 2021
The opportunity now is for companies to provide the products that will accelerate the adoption of DevOps across organizations of all sizes. The DevOps market is expected to grow to $26 billion by 2027, up from $7 billion in 2021. As the market grows, so does the complexity of managing a variety of individual solutions. Gartner estimates that by 2024, 60% of organizations will have switched from multiple-point solutions to value stream management platforms to streamline application delivery, up from 20% in 2021.
Consolidation is coming for the DevOps world. As each company evaluates the size of their potential opportunity, it revolves around each company’s ability to build a DevOps platform, not just a point solution. About 60% of companies say they plan to consolidate on DevOps platforms over the next three years. That shift won’t be easy. The difficulty of fully transitioning to DevOps is largely attributed to the required cultural and organizational transformations.
The DevOps Stack
DevOps is a cultural shift that touches a variety of steps within the software development lifecycle. There currently isn’t a single all-encompassing platform to cover the entire scope. DevOps teams usually put together a customized toolchain to connect the various people and workflows that consist of open-source and vendor tools. The output from one is an input for another, and so on. That leads to a very fragmented vendor landscape.
![](https://images.prismic.io/contrary-research/de10c783-2579-47a9-b5c0-38358463d158_image+%288%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: Sapphire Ventures
Each organization selects the toolchain they want to leverage for their own processes. When a company is leveraging DevOps, their toolchain will cover stages like planning, creation, testing, releasing, and monitoring. Most DevOps vendors will specialize in a particular area of the toolchain, such as planning, issue tracking, source code control, code writing, testing, configuration management, deployment, or monitoring.
![](https://images.prismic.io/contrary-research/5aa9078e-25dc-42b2-a42f-0ed5802b680d_image+%289%29.png?auto=compress%2Cformat&fit=max&w=1920)
Source: Hubspot
Software, overall, has become increasingly fragmented as users take advantage of the opportunity to test out best-in-class solutions. As the speed of software production cycles increases, the need for a seamless toolchain has become increasingly important. Determining which DevOps tools an organization will use can be complex given the multiple stakeholders involved. Executives want to ensure uptime and control costs, while developers are focused on performance and ease-of-use. First, we’ll touch on some of the key platforms being leveraged across the DevOps lifecycle. Then we’ll touch more on the future of DevOps, and how it's changing.
GitHub
Git is a software that a developer installs and uses locally on their workstation. As cloud computing emerged, so did GitHub, which has become the largest cloud-based platform that extends the benefits of Git. What might be confusing is that while GitHub's software is closed-source, it’s actually the go-to place for almost every developer and non-coder to create and share their open-source projects. The key contributor to GitHub’s success is its community.
![](https://images.prismic.io/contrary-research/34b7a211-2be6-4325-a996-0715a3394a3f_image+%2810%29.png?auto=compress%2Cformat&fit=max&w=1920)
Source: GitHub
With GitHub, it's easy to share code with other team members. You can view, edit, and make comments on others’ code. Git repositories can be remotely accessed by authorized personnel. In essence, Git facilitates DevOps teams to coordinate code writing, while GitHub’s branching model enables developers to contribute new or amended code that can be validated without overwriting existing code in the main branch.
In 2018, Microsoft acquired GitHub for $7.6 billion. With GitHub, Microsoft started making steps to rebuild its relationship with the open-source community. Former Microsoft CEO, Steve Ballmer, had previously called Linux a cancer. Under Microsoft’s umbrella, GitHub has continued to grow. In October 2022, GitHub reached $1 billion in ARR and 90 million active users, up from $200 to $300 million at the time of the acquisition. GitHub also benefitted from Microsoft's platform, including their partnership with OpenAI. Large language models (LLM) helped GitHub’s platform to check code, generate code, and automate security testing.
GitLab
As DevOps becomes the de facto methodology for producing software, more players have looked to extend their platform. GitLab has held a unique position in the market by clearly stating early on that they were trying to build an open core platform to extend across the DevOps lifecycle.
![](https://images.prismic.io/contrary-research/e8b31b2b-5626-4262-b61b-3323fc765f68_image+%2811%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab
The core difference between GitHub and GitLab is that GitHub focuses on code repository and enables users to easily integrate with CI/CD tools of their choice (e.g. Jenkins, CircleCI). GitLab includes not only their own CI/CD, but also an entire suite of DevOps tooling in one platform so that, if a user chooses, there's no need for other third party tools. GitLab is also very public about their product features, road map, and comparability to other tools. GitLab even published an analysis of their feature maturity against industry standards for GitHub and GitLab. GitLab ranked 82% complete compared to GitHub at 56%.
![](https://images.prismic.io/contrary-research/06b6356a-799f-4688-a8a5-e264e6c7af78_image+%2812%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab
GitLab is one of the rising leaders in the DevOps world. The company had its IPO in October 2021, and as of October 2022 they reached $333 million of LTM revenue, growing~70% YoY. A primary driver of GitLab’s momentum is its unique approach of becoming a multi-product toolchain. They managed to position themselves as a single application that can provide end-to-end comprehensive DevOps solutions, with substantial capabilities in security. GitLab’s CI/CD automates the steps required to build, test, and deploy code to production. Their platform can automatically provision infrastructure and manage infrastructure changes, ticketing, and release versioning.
While other platforms have one strength (i.e. code repository, application testing) and enable integrations with other third party DevOps tools, GitLab is unique in that it tries to offer tools across the entire DevOps stack. Their ability to own the entire toolchain also makes collaboration more seamless across user personas.
![](https://images.prismic.io/contrary-research/319bc820-3853-4a39-bf77-27809631507e_image+%2813%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source:GitLab
GitLab’s multi-product strategy has also enabled them to generate over 130% net dollar retention. Developers will test out GitLab for a particular need, and then compare GitLab’s other features to comparable third party tools. By having all their tools in one platform, users often choose to adopt more of GitLab’s products, thereby driving high net dollar retention. Companies like T-Mobile and UBS were able to increase their speed of deployment by 10x by having a unified DevOps platform from GitLab.
GitLab's open-source involvement has played a key role in supporting their product innovation. GitLab receives frequent feature feedback from the developer community as they make contributions to the open-source component of the company’s codebase.
HashiCorp
HashiCorp is quickly becoming an established name in DevOps that launched its IPO in December 2021. It is more vertically integrated than most other DevOps vendors, as it provides infrastructure provisioning services across multi-cloud environments. HashiCorp’s Infrastructure-as-Code (IaC) product, Terraform, has become very popular among developers when compared with tools like Chef, Puppet, and Ansible.
HashiCorp pitches all their products as multi-cloud, which positions them favorably for developers and engineers who have to deploy across multiple different cloud providers. Similar to GitLab, HashiCorp makes its code viewable to their open-source community, which has a number of benefits including enhanced security (i.e. bugs are found quicker) and higher quality software that will benefit from continuous improvement. Thousands of developers have contributed to its development and will continue to look to optimize the code.
![](https://images.prismic.io/contrary-research/0b2be2fd-7301-4de3-aedb-b608ca7abc22_image+%2814%29.png?auto=compress%2Cformat&fit=max&w=1920)
Source: HashiCorp
HashiCorp’s open-source approach has enabled it to foster a deep connection with the developer community which supports their primary GTM strategy of building relationships with DevOps decision-makers rather than a high-touch top-down approach of courting the attention of executives. You can see a hint of the response from the developer community from the growth in stars (similar to a “like”) on GitHub for some of their more popular products.
![](https://images.prismic.io/contrary-research/73e7bad8-d305-4b36-8ba6-baffbd5aa57e_image+%2815%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: github.com/HashiCorp
HashiCorp offers both free and commercial products. HashiCorp’s products have been downloaded over 100 million times. The company then sells proprietary software on top of its open-source products, with a focus on large enterprises. As of October 2022, the company had LTM revenue of $393 million, growing ~52% YoY. The company also has a 133% net dollar retention rate, which indicates wallet expansion within customers.
CircleCI
CircleCI is a continuous integration (CI) platform used by more than 1 million developers. CircleCI allows developers to create automated tests, monitor builds, and locate problems so they can iterate and fix them. The product helps developers get connected to code repositories such as GitHub, integrate with toolchains via pre-built integrations, webhooks (customizable integrations), and APIs, and then deploy to the environment of choice, such as AWS. The company offers a range of options for users, including cloud and self-hosting environments and subscription services priced based on seats and time.
CircleCI offers enterprise features related to security and administration. CircleCI is one of the only CI/CD tools to get certified by FedRAMP. It supports isolated execution environments including Docker, Linux, macOS, Android, Windows, and self-hosted runtimes. They also support OpenID Connect integrations for better identity control.
![](https://images.prismic.io/contrary-research/2e3993f2-b7c1-4651-bdc8-6b6c59e35991_image+%2816%29.png?auto=compress%2Cformat&fit=max&w=1200)
Source: CircleCI
Jenkins
Jenkins is another highly popular open-source software tool. Its CI/CD product utilizes automation to suggest snippets of code. It further assists in the build of the codebase, manages the integration of code branches into the main branch, conducts testing, continuously debugs the codebase, communicates issues with the respective developers, and pushes validated code into production. At a high level, Jenkins provides a pipeline with supporting tools in order to help developers write code securely, test it, and ship it through to live production.
Several other common open source developer tools include ELK (for logging and monitoring), Ansible, (for provisioning hardware and configuration management), Chef (also for provisioning hardware and configuration management), and Apache Kafka (real-time data streaming management). Across the board, there is an ocean of players tackling one component of the DevOps lifecycle or another. But the way that landscape may evolve could leave the space looking very different from what it looks like today.
The Future of DevOps
![](https://images.prismic.io/contrary-research/4754c889-fa62-4e96-ab3a-2612ee2a9762_image+%2817%29.png?auto=compress%2Cformat&fit=max&w=2048)
Source: Sapphire Ventures; Contrary Research
The rate of software development has increased exponentially. The volume of the world’s data has increased over 15x in the last 10 years alone. During the 70s and 80s, the technology world experienced a “software crisis” where software was becoming more prominent, yet production of it remained frequently over budget and off schedule. Over time, software development has evolved from focusing on efficiency to quality and scalability. Technology has increasingly become the center of the universe in terms of how things get built and how people live their lives. As a result, we need to build technology that can scale dramatically, and do it much more quickly than we have in the past.
![](https://images.prismic.io/contrary-research/7d4a5615-5281-4b6e-980d-28cffd2fd9f6_image+%2818%29.png?auto=compress%2Cformat&fit=max&w=1920)
Source: IEEE Computer Society
When you consider what the future of DevOps will look like, you’re effectively looking at what the future of technology production will look like. The trends impacting software development are as versatile as the capabilities of software itself, but there are three trends that stand out as having overarching implications for the way software will be developed in the future.
Consolidated Toolchain: As it becomes more critical to drive efficiency in the software development lifecycle, companies will look to move more of their DevOps stack onto the same platform. This will favor companies that have built multi-product platforms over best-in-class point solutions, and set the stage for what companies will become dominant in DevOps going forward.
DevSecOps: As the rate of software development continues to increase, there isn’t as much wiggle room for after-the-fact security reviews before something is shipped. Shift-left is the integration of security review within the development life cycle and will become increasingly table stakes for any company hoping to become a major DevOps platform.
Infusion of AI/ML: Artificial intelligence is becoming more pervasive in every industry, but it is most often leveraged in fast-moving, resource-constrained environments. Almost no value chain in the world is as fast-moving and resource-constrained as software. From AI-assisted code review to full development via AI, there are a number of ways automation will impact how software is created.
Consolidated Toolchain
![](https://images.prismic.io/contrary-research/f8c68d4a-a23c-41f5-8a99-bf3171d43d89_image+%2819%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab
Developer productivity has been placed front and center as the speed of deployment has increased. Every company feels resource-constrained when it comes to developers’ time. Adding more software engineers isn’t a scalable fix, and we’re also seeing demand exceed supply. Some sources estimate the shortage of software engineers will reach over 80 million by 2030. Companies are doing everything they can to increase the capacity of their developers.
Beyond just a shortage of talent, evidence indicates that companies also need to better leverage their existing engineering talent. In 2018, Stripe published a report called The Developer Coefficient about software engineering efficiency. They described the opportunity this way:
“While businesses today face myriad issues—security vulnerabilities, trade tariffs, complex government regulations, increased global competition—how they deploy their developers may be the most overlooked factor impacting their future success. Developers act as force-multipliers, and if used effectively, have the collective potential to raise global GDP by $3 trillion over the next ten years. While many people posit that lack of developers is the primary problem, this study—which surveyed thousands of C-level executives and developers across six different countries—found that businesses need to better leverage their existing software engineering talent if they want to move faster, build new products, and tap into new and emerging trends.”
The need for better leverage from existing software engineering resources has led to the popularization of two trends: (1) increased dependence on open source communities, and (2) increased emphasis on value stream management.
On the open source side, you’re seeing companies like Grafana build a large portion of their differentiation from competitors like Datadog around the strength of their open source community. Grafana’s CEO, Raj Dutt, made that emphasis clear when he said, “90% of our users will never pay us, and that’s by design. It’s really important for us to have a healthy open source community. That’s mission number one.” To read more about Grafana, you can read the Contrary Research memo here.
In terms of value stream management, more DevOps platforms have continued to emphasize more of an end-to-end experience through idea to production and delivery. Several companies have built these capabilities through acquisitions such as Microsoft and GitHub, or Cloudbees and Electric Cloud.
GitLab, on the other hand, is focused on building their end-to-end platform on a common code-base. This further emphasizes their vision of becoming “the one DevOps platform.” GitLab was founded in 2014, and when you look at their early messaging on their website, they didn’t start out with this vision of a unified platform. The emphasis of the message was on open source, and the ability to collaborate on code.
![](https://images.prismic.io/contrary-research/1b253b0c-e0aa-4147-a222-0e9a8a014f5d_image+%2820%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab; June 2014
From 2014 to 2017, their focus continued to revolve around building a platform for “modern developers” and unifying various features of the development lifecycle. DevOps had been around since the early 2000s, but building one unified platform was unheard of. In late 2017, the company’s messaging started to revolve around the idea that is core to their product strategy today: “a single application for the whole software development and operations lifecycle.”
![](https://images.prismic.io/contrary-research/d6d7220a-64f7-4eb0-aa06-48674fc8d1ce_image+%2821%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: GitLab; September 2017
Later in 2020, that driving principle would evolve into the much more marketing-friendly catch phrase: “The One DevOps Platform.” While this is just one example with GitLab, this is representative of the overall sentiment in the DevOps space. Today, the software development lifecycle is interconnected enough that there is a clear value proposition in having a unified platform.
Granted, some of the arguments for vendor consolidation in the DevOps toolchain are self-serving for these larger platforms that want to push their customers to unify their DevOps stack. One executive at an application security company put it this way:
"GitHub, Atlassian, Microsoft... They’re trying to get everyone to adopt a unified tool system. But most people still go with best-of-breed, as far as tools go. The idea, though, is that some people will eventually go with more of a “you can’t get fired for buying IBM” approach, where you buy everything from a single vendor."
Whether consolidation happens quickly, or slowly, one thing is for sure: beyond efficiency, the next big aspect that every aspiring DevOps platform will need to address is security.
DevSecOps
DevSecOps is becoming a major trend in the DevOps space. Another common way to articulate the trend is shift-left. If you imagine the development lifecycle laid out in a path from left to right, the status quo would put security towards the far right of the workflow – something to be reviewed right before deployment. Shift-left is the realignment of security to be an earlier part of the development lifecycle.
![](https://images.prismic.io/contrary-research/f4408501-4a7d-4060-80e4-3c77b62460e5_image+%2822%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: Snyk
As the pace of software development continues to accelerate, the ability for security operations teams to catch every code-level vulnerability gets much more difficult. Some sources indicate that 67% of developers have shipped code with vulnerabilities, and 84% of code bases contain one or more open source vulnerabilities. Shift-left, along with the increased emphasis on involving developers in the security process, makes the security review process more proactive, as opposed to reactive.
Similar to the cultural evolutions required to adopt DevOps, there are similar cultural changes required to effectively integrate security into the broader software development lifecycle. Typically, security and DevOps work independently, with developers focusing on efficiency, and making what seems to be good progress until security steps in and highlights a load of issues that need to be addressed before the project can continue toward deployment.
Shift-left is the consistent application of security best-practices from the time developers begin writing code, and provisioning infrastructure, through deployment and monitoring. This covers both the software development timeline and the staging and production timelines, respectively. Aspects of shift-left can be automated to continuously check for errors and poor practices that can lead to an exploitable vulnerability.
![](https://images.prismic.io/contrary-research/1f4ab612-0864-4518-801f-1878d062c025_Screen+Shot+2022-10-28+at+10.35.44+PM.png?auto=compress%2Cformat&fit=max&w=3840)
Source: Convequity
Shift-left not only provides organizations with better security, but it also speeds up the time-to-market. Legacy approaches of doing security after a project has already made progress inevitably slow things down, because it will be pushed back to the developer to troubleshoot. Doing things right the first time has obvious benefits pertaining to being more responsive to the demands of end users and bringing down costs.
As mentioned, GitLab’s emphasis on building an end-to-end DevOps platform has extended to include security features as well. Bridgecrew, acquired by Palo Alto Networks in 2021, is currently focused on the infrastructure side of shift-left. Since Bridgecrew’s acquisition, downloads ballooned from 1 million in 2020 to over 3 million in 2021.
Snyk is a key vendor in the DevSecOps space. Snyk’s platform continuously checks for potential vulnerabilities in real-time as developers write their code, without impacting productivity negatively the way legacy security reviews do. Users of Snyk cite ease of use and clear value-add in helping them speed up CI/CD workflows while keeping a high level of security. From the GTM perspective, in July 2022 Snyk announced they reached $150 million in ARR, up 150% YoY despite macro headwinds. Snyk’s rapid growth signals that DevSecOps is becoming a high-priority item for many organizations despite weakening IT consumption demand. To read more about Snyk, you can read the Contrary Research memo here.
You see that continued enterprise demand for security in the DevOps process not only in Snyk’s success, but across company budgets as well. As of September 2022, 62% of companies expected to increase their security budgets by ~10% over the next year. Three out of four companies plan to incorporate security into their technology stack to develop fully integrated DevSecOps.
![](https://images.prismic.io/contrary-research/7389a547-4079-4fa1-b649-aea9c078595c_image+%2823%29.png?auto=compress%2Cformat&fit=max&w=3840)
Source: Battery Ventures
Security continues to command budget and prioritization, not just because it leads to developer efficiency, but because security is an unsolved problem that every company is concerned with. 43% of security development teams are concerned about security, and as a result are focused on optimizing their organization to effectively implement DevSecOps.
While security is a critical part of the developer lifecycle, it also represents yet another strain on the already limited capacity of existing software engineers. Companies are turning to automation to increase engineering capacity.
Infusion of AI/ML
While security was the first infusion into the DevOps process, AI/ML is close behind. About half of tech leaders say they are looking into new areas like DataOps and MLOps to better leverage their DevOps capabilities. One example of this comes from Sid Sijbrandij, the CEO of GitLab:
“If we look at AI/ML, there's 2 things happening. We're using it to make GitLab better. And a great example of that is code reviewers... The other thing is helping data scientists do their work… We see a great convergence happening where the AI/ML engineers have to collaborate with the DevSecOps people and vice versa because every significant application in the future will need both.”
MLOps becoming more integrated with DevOps is a logical extension, given the similarities of the workflows between software engineers and data engineers. That opens up data scientists as part of the TAM for any DevOps platform. Beyond additional user personas, AI is becoming a bigger part of the products in DevOps. The volume of data that these DevOps platforms have access to also creates the opportunity to automate more and more of the development lifecycle.
The best illustration of this trend is Amazon CodeWhisperer or Github CoPilot which were launched last year. CoPilot is a cloud-based AI platform developed by GitHub and OpenAI to assist developers by providing suggestions as they code. Built around OpenAI Codex and GPT-3, CoPilot draws context from the code being developed, suggesting whole lines or entire functions, enabling developers to code faster. Its large language model is built by analyzing all the open-source code on GitHub repos and then collecting the data necessary to recommend the best code for what a developer is trying to accomplish.
Incorporating machine learning helps optimize the workflow for software delivery. Intelligent models help to automate aspects of building, testing, and deployment of applications. Given the volume and variety of software, there is a rich data set for models to continue to improve, making it possible for GitHub’s Copilot and similar tools to more accurately suggest code snippets or entire functions in real-time.
The R&D team at Meta, having seen the advancements in AI/ML within software development, made this prediction:
“With the advances in [ML-enabled software development], we believe that programming should become a semiautomated task in which humans express higher-level ideas and detailed implementation is done by the computers themselves.”
Within the scanning and testing aspect of DevOps, companies like Harness, Snyk, and GitLab use similar models to analyze code and help engineers detect security anomalies, and potential code vulnerabilities using pre-built models that have been trained on publicly available open-system data. For example, Snyk acquired Deepcode to enable automated code reviews in addition to suggesting changes to developers looking for security vulnerabilities. AI will continue to play a key role in automating and streamlining developer workflows which should increase developer productivity.
Other companies are approaching automation in developer tooling from the ground up. Replit is a collaborative browser-based Integrated Development Environment (IDE) that allows developers to code in 50+ languages. The platform is easy to deploy with multiple integrations to make it easy for developers to create their programming environments. Recently, they announced Ghostwriter as part of their AI Mode feature. Most of that product is built off of open source LLMs that have been optimized for ease-of-use. Ghostwriter offers similar code completion suggestions in both snippets, and whole functions.
Where most enterprises emphasize developer productivity as the case for automation, Replit makes the case for automation as part of simplifying the developer learning journey. The company’s emphasis on educational and hosting services is targeted at the long-tail of developers either learning to program, or established programmers looking for an easier-to-use environment for side projects. To read more about Replit, you can read the Contrary Research memo here.
![](https://images.prismic.io/contrary-research/8a4fbaf0-3cfa-488a-b9ba-386616bcb6cf_image+%2824%29.png?auto=compress%2Cformat&fit=max&w=1920)
Source: Replit
The Future of DevOps is the Future of Software Development
Up to this point, cloud computing has been the key to unlocking rapid software development. Access to the very best tools and resources has increased developers ability to build exceptional software, and to do it quicker than ever. Those same capabilities, however, have also led to dramatic complexity in the development process. DevOps is the solution to the problems that speed without infrastructure created.
Software development shows no signs of slowing down. Companies will continue to look for as much value as possible from the DevOps platforms they use in order to reduce the complexity of having application creep across their processes. The increased pace of software creation will stretch (1) the security capabilities of every application, and (2) the available developer resources a company has access to.
Security will become increasingly interwoven in the development process, and will be pushed as early as possible in that lifecycle. Security will extend, not only to the code-level, but into cloud computing and abstracted layers like API security and container security. Security, like software development, is a rapidly evolving space. Human expertise will only go so far before automation becomes a critical part of the story.
The advancements in AI/ML, along with the massive amounts of data living in open source repos and existing software networks have enabled large language models to get built around software semantics. Now, DevOps platforms can start to automate aspects of the development process. AI assistants can make code recommendations right in an IDE. Scans for security vulnerabilities can also be automated because these models know what kinds of issues to look for.
The future of DevOps is the future of software development. Last year, VCs invested $37 billion into companies building developer tooling. The demand for software, and for software developers to build that software, is only going to increase. A massive opportunity exists for the platforms that can become the central building blocks of that increasingly important process.