A survey of 5,315 individual contributors and leaders in development, IT operations and security finds two-thirds (66%) are releasing software faster than they were a year ago.
Conducted by the market research firm Omdia on behalf of GitLab, the survey also finds that among 40% of the developers that participated in the survey 24% said they were pushing code into production environments at least once a day, with 13% pushing code multiple times a day.
At the same time, more than three-quarters (78%) of all respondents said they are either already using, or plan in the next two years to employ, artificial intelligence (AI) to help develop software. More than half (55%) conceded introducing AI into the software development lifecycle is risky, with data privacy and security being the number one concern.
Unfortunately, the survey also suggests that the pace at which best practices for securing that software are still lagging. The survey finds that among the 27% of respondents who work in security, only 38% report having shifted responsibility for application security left toward developers, and only 34% report providing security training to developers.
On the plus side, another 32% plan to start providing that training this year, and more than a quarter (26%) of those currently using AI for application development identified improved security as one of the top benefits of AI. More than half (52%) said they are interested in using or planning to rely on AI explanations of security vulnerabilities to improve code.
Overall, more than two-thirds of developers (67%) said more than a quarter of the code they work on is from open-source libraries, with 40% reporting open-source software components make up more than half of their application code. At the moment, however, only 20% work for organizations using software bills of materials (SBOMs).
More troubling still, only 34%report using dynamic application security testing (DAST) tools, followed closely by 33% using static application security testing (SAST) tools, container scanning (29%) and secret detection (24%).
More than half of the security respondents also said they have difficulty getting development teams to prioritize the remediation of vulnerabilities, and 52% reported that red tape often slows their efforts to quickly fix vulnerabilities.
GitLab CISO Josh Lemos said that while progress is being made in terms of the adoption of best DevSecOps processes, there is still much work to be done. Application security is only going to be a more pressing issue as the amount of code being created with the help of AI tools increases, he added.
The Pace of Building Software
Rather than merely treating application security as another gate to be added to a DevOps workflow, organizations need to as much as possible provide developers with the context they need to address security issues at the time they are writing code, said Lemos.
The challenge, of course, is finding ways to continue to build more secure software without slowing the rate at which it is being built, he noted.
Each organization will naturally need to determine for itself at what pace to build software. However, the more any business becomes dependent on software to drive revenue, the greater the pressure to build new applications while continuously updating existing ones only continues to increase.
