Revisit security in the era of DevOps: An evidence-based inquiry into DevSecOps industry
Open accessAbstract
Abstract By adopting agile and lean practices, DevOps aims to achieve rapid value delivery by speeding up development and deployment cycles, which however lead to more security concerns that cannot be fully addressed by an isolated security role only in the final stage of development. DevSecOps promotes security as a shared responsibility integrated into the DevOps process that seamlessly intertwines development, operations, and security from the start throughout to the end of cycles. While some companies have already begun to embrace this new strategy, both industry and academia are still seeking a common understanding of the DevSecOps movement. The goal of this study is to report the state‐of‐the‐practice of DevSecOps, including the impact of DevOps on security, practitioners' understanding of DevSecOps, and the practices associated with DevSecOps as well as the challenges of implementing DevSecOps. The authors used a mixed‐methods approach for this research. The authors carried out a grey literature review on DevSecOps, and surveyed the practitioners of DevSecOps in industry of China. The status quo of DevSecOps in industry is summarized. Three major software security risks are identified with DevOps, where the establishment of DevOps pipeline provides opportunities for security‐related activities. The authors classify the interpretations of DevSecOps into three core aspects of DevSecOps capabilities, cultural enablers, and technological enablers. To materialise the interpretations into daily software production activities, the recommended DevSecOps practices from three perspectives—people, process, and technology. Although a preliminary consensus is that DevSecOps is regarded as an extension of DevOps, there is a debate on whether DevSecOps is a superfluous term. While DevSecOps is attracting an increasing attention by industry, it is still in its infancy and more effort needs to be invested to promote it in both research and industry communities.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Zhou et al.'s industry-focused analysis reveals further issues such as vague definitions, skill gaps, inconsistent security practices, and a lack of consensus on DevSecOps standards.
“Additionally, Zhou et al.'s industry-focused analysis reveals further issues such as vague definitions, skill gaps, inconsistent security practices, and a lack of consensus on DevSecOps standards, highlighting the continued fragmentation of approaches.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [38]
Section 5.3 says there is no commonly accepted definition of DevSecOps, and section 6.3 identifies a lack of DevSecOps experts. The survey results (section 4) and section 6.1.2 describe differing security concerns and practices across industries. The copy does not explicitly establish a lack of consensus on DevSecOps standards, as distinct from its definition or practices. (LLM, conf=0.84)
Experimental — accuracy not yet measuredThe literature identifies persistent limitations including tool incompatibility, challenges with legacy systems, fragmented security policies, and resistance to change within organisations.
“yet the literature identifies persistent limitations including tool incompatibility, challenges with legacy systems, fragmented security policies, and resistance to change within organisations.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [38]
Section 6.3 (page not provided) identifies organisational culture resistance, complications with legacy resources, and the complexity of integrating security tools as DevSecOps challenges. It does not specifically identify tool incompatibility or fragmented security policies as persistent limitations. (LLM, conf=0.86)
Experimental — accuracy not yet measuredAutomation significantly boosts cybersecurity by enabling rapid vulnerability detection and more efficient compliance processes.
“showing that automation significantly boosts cybersecurity by enabling rapid vulnerability detection and more efficient compliance processes”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [38]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Extreme Programming Explained: Embrace Change
Beck, K. L., & Andres, C. (2000) · Cited by 5,855 · see citing works
Agile Software Development with SCRUM
Schwaber, K., & Beedle, M. (2001) · Cited by 2,639 · see citing works
Brereton, P., Kitchenham, B. A., Budgen, D., Turner, M., & Khalil, M. (2007) · Journal of Systems and Software · doi:10.1016/j.jss.2006.07.009 · Cited by 2,394 · see citing works
Adams, R. J., Smart, P., & Huff, A. S. (2017) · International Journal of Management Reviews · doi:10.1111/ijmr.12102 · Cited by 995 · see citing works
Garousi, V., Felderer, M., & Mäntylä, M. V. (2019) · Information and Software Technology · doi:10.1016/j.infsof.2018.09.006 · Cited by 831 · see citing works
Searching for grey literature for systematic reviews: challenges and benefits
Mahood, Q., Van Eerd, D., & Irvin, E. (2014) · Research Synthesis Methods · doi:10.1002/jrsm.1106 · Cited by 814 · see citing works
Ebert, C., Gallardo, G., Hernantes, J., & Serrano, N. (2016) · IEEE Software · doi:10.1109/ms.2016.68 · Cited by 504 · see citing works
The pains and gains of microservices: A Systematic grey literature review
Soldani, J., Tamburri, D. A., & van den Heuvel, W. (2018) · Journal of Systems and Software · doi:10.1016/j.jss.2018.09.082 · Cited by 438 · see citing works
Publication Bias in the Organizational Sciences
Kepes, S., Banks, G. C., McDaniel, M. A., & Whetzel, D. L. (2012) · Organizational Research Methods · doi:10.1177/1094428112452760 · Cited by 400 · see citing works
Salleh, N., Mendes, E., & Grundy, J. (2010) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2010.59 · Cited by 361 · see citing works
A Map of Threats to Validity of Systematic Literature Reviews in Software Engineering
Zhou, X., Yu-qin, J., Zhang, H., Li, S., & Huang, X. (2016) · Asia-Pacific Software Engineering Conference (APSEC) · doi:10.1109/apsec.2016.031 · Cited by 304 · see citing works
Proceedings of the 11th Working Conference on Mining Software Repositories
Devanbu, P., India, I. '. 3. I. C. O. S. E. 2. H., Association for Computing Machinery-Digital Library, ACM Special Interest Group on Software Engineering, & SIGs, A. (2014) · doi:10.1145/2597073 · Cited by 272 · see citing works
An Introduction to Agile Methods
Cohen, D., Lindvall, M., & Costa, P. (2004) · Advances in computers · doi:10.1016/s0065-2458(03)62001-2 · Cited by 258 · see citing works
John, N. (2013) · The Communication Review · doi:10.1080/10714421.2013.807119 · Cited by 251 · see citing works
Development and Deployment at Facebook
Feitelson, D. G., Frachtenberg, E., & Beck, K. L. (2013) · IEEE Internet Computing · doi:10.1109/mic.2013.25 · Cited by 243 · see citing works
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2021.106700 · Cited by 235 · see citing works
Human and organizational factors in computer and information security: Pathways to vulnerabilities
Kraemer, S., Carayon, P., & Clem, J. (2009) · Computers & Security · doi:10.1016/j.cose.2009.04.006 · Cited by 216 · see citing works
Garousi, V., Felderer, M., & Mäntylä, M. V. (2016) · Proceedings of the 20th International Conference on Evaluation and Assessment in Software Engineering · doi:10.1145/2915970.2916008 · Cited by 210 · see citing works
DevSecOps: A Multivocal Literature Review
Myrbakken, H., & Colomo-Palacios, R. (2017) · Communications in Computer and Information Science · doi:10.1007/978-3-319-67383-7_2 · Cited by 205 · see citing works
DevOps in practice: A multiple case study of five companies
Lwakatare, L. E., Kilamo, T., Karvonen, T., Sauvola, T., Heikkilä, V. T., Itkonen, J., Kuvaja, P., Mikkonen, T., Oivo, M., & Lassenius, C. (2019) · Information and Software Technology · doi:10.1016/j.infsof.2019.06.010 · Cited by 197 · see citing works
Proceedings of the 22nd international conference on Software engineering
Ghezzi, C., Jazayeri, M., & Wolf, A. L. (2000) · Cited by 191 · see citing works
Kanban in software development: A systematic literature review
Ahmad, M. O., Markkula, J., & Oivo, M. (2013) · Euromicro Conference on Software Engineering and Advanced Applications (SEAA) · doi:10.1109/seaa.2013.28 · Cited by 168 · see citing works
DevOps: A Definition and Perceived Adoption Impediments
Smeds, J., Nybom, K., & Porres, I. (2015) · Lecture Notes in Business Information Processing · doi:10.1007/978-3-319-18612-2_14 · Cited by 158 · see citing works
DevOps Adoption Benefits and Challenges in Practice: A Case Study
Riungu-Kalliosaari, L., Mäkinen, S., Lwakatare, L. E., Tiihonen, J., & Männistö, T. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-49094-6_44 · Cited by 154 · see citing works
Toward successful DevSecOps in software development organizations: A decision-making framework
Akbar, M. A., Smolander, K., Mahmood, S., & Alsanad, A. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2022.106894 · Cited by 128 · see citing works
Lwakatare, L. E., Kuvaja, P., & Oivo, M. (2015) · Lecture notes in business information processing · doi:10.1007/978-3-319-18612-2_19 · Cited by 121 · see citing works
SecDevOps: Is It a Marketing Buzzword? - Mapping Research on Security in DevOps
Mohan, V., & Othmane, L. B. (2016) · 2016 11th International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2016.92 · Cited by 112 · see citing works
Characterizing DevOps by Hearing Multiple Voices
de França, B. B. N., Jeronimo, H., & Travassos, G. H. (2016) · doi:10.1145/2973839.2973845 · Cited by 109 · see citing works
Grey Literature in Library and Information Studies
Farace, D. J., & Schöpfel, J. (2010) · Saur eBooks · doi:10.1515/9783598441493 · Cited by 104 · see citing works
Software security in DevOps: synthesizing practitioners' perceptions and practices
Ur Rahman, A. A., & Williams, L. (2016) · Proceedings of the International Workshop on Continuous Software Evolution and Delivery · doi:10.1145/2896941.2896946 · Cited by 86 · see citing works
The kanban approach, between agility and leanness: a systematic review
Al-Baik, O., & Miller, J. (2014) · Empirical Software Engineering · doi:10.1007/s10664-014-9340-x · Cited by 66 · see citing works
An Empirical Study on Culture, Automation, Measurement, and Sharing of DevSecOps
Tomas, N., Li, J., & Huang, H. (2019) · 2019 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecpods.2019.8884935 · Cited by 66 · see citing works
Self-Service Cybersecurity Monitoring as Enabler for DevSecOps
Díaz, J., Pérez, J., Peña, M. Á. L., Mena, G. A., & Yagüe, A. (2019) · IEEE Access · doi:10.1109/access.2019.2930000 · Cited by 64 · see citing works
Security as Culture: A Systematic Literature Review of DevSecOps
Sánchez-Gordón, M., & Colomo-Palacios, R. (2020) · Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops · doi:10.1145/3387940.3392233 · Cited by 58 · see citing works
Recognizing gender of stack overflow users
Lin, B., & Serebrenik, A. (2016) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/2901739.2901777 · Cited by 53 · see citing works
Three New Dimensions to People, Process, Technology Improvement Model
Prodan, M., Prodan, A., & Purcarea, A. A. (2015) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-16486-1_47 · Cited by 49 · see citing works
DevOps for information management systems
Gill, A. Q., Loumish, A., Riyat, I., & Han, S. (2017) · VINE Journal of Information and Knowledge Management Systems · doi:10.1108/vjikms-02-2017-0007 · Cited by 49 · see citing works
Preliminary Findings about DevSecOps from Grey Literature
Mao, R., Zhang, H., Dai, Q., Huang, H., Rong, G., Shen, H., Chen, L., & Lu, K. (2020) · 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs51102.2020.00064 · Cited by 49 · see citing works
Prates, L., Faustino, J., Silva, M., & Pereira, R. (2019) · Lecture Notes in Business Information Processing · doi:10.1007/978-3-030-29608-7_7 · Cited by 45 · see citing works
Multivocal literature reviews in software engineering: Preliminary findings from a tertiary study
Neto, G. T. G., Santos, W. B., Endo, P. T., & Fagundes, R. A. A. (2019) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1109/esem.2019.8870142 · Cited by 29 · see citing works
Ethnographic research in software engineering: a critical review and checklist
Zhang, H., Huang, X., Zhou, X., Huang, H., & Babar, M. A. (2019) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3338906.3338976 · Cited by 27 · see citing works
Observations on the Future of Grey Literature
Schöpfel, J. (2006) · Cited by 20 · see citing works
Cloud Security Issues Based on People, Process and Technology Model: A Survey
Ghaffari, F., Gharaee, H., & Arabsorkhi, A. (2019) · International Conference on Web Research (ICWR) · doi:10.1109/icwr.2019.8765295 · Cited by 15 · see citing works
Kao, D. (2015) · IEEE Annual Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac.2015.10 · Cited by 4 · see citing works
Data analysis of social community reputation: Good questions vs. good answers
Low, J. F., & Svetinović, D. (2015) · doi:10.1109/ieem.2015.7385836 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 4
- Modi, V., et al.: Impact evaluation of smoke-free mass media campaign on knowledge, attitude and behavior of the target audience in India. In: Proceedings of the 2012 National Conference on Health Communication Marketing and Media (2012)
- Bird, J.: DevOpsSec: Delivering Secure Software through Continuous Delivery. O'Reilly Media (2016)
- Zou, J., et al.: Which non-functional requirements do developers focus on? an empirical study on stack overflow using topic analysis. In: Pro- ceedings of the 12th Working Conference on Mining Software Re- positories, pp. 446-449. IEEE (2015)
- Fetterman, D.M.: Ethnography: Step-By-Step, vol. 17. Sage (2019)
Cited by
Sorted by citations
Prates, L., & Pereira, R. (2025) · International Journal of Information Security · doi:10.1007/s10207-024-00914-z · Cited by 49 · see citing works
Boisrond, K., Tardif, P.-M., & Jaafar, F. (2024) · IEEE Access · doi:10.1109/access.2024.3434618 · Cited by 27 · see citing works
Alghawli, A. S. A., & Radivilova, T. (2024) · Alexandria Engineering Journal · doi:10.1016/j.aej.2024.07.036 · Cited by 23 · see citing works
Navigating the DevOps landscape
Zhang, X., Zhao, P., & Jaskolka, J. (2025) · Journal of Systems and Software · doi:10.1016/j.jss.2024.112331 · Cited by 21 · see citing works
Integrating security controls in DevSecOps: Challenges, solutions, and future research directions
Sinan, M., Shahin, M., & Gondal, I. (2025) · Journal of Software: Evolution and Process · doi:10.1002/smr.70029 · Cited by 13 · see citing works
Extensive Review of Threat Models for DevSecOps
Nagasundari, S., Manja, P., Mathur, P., & Honnavalli, P. B. (2025) · IEEE Access · doi:10.1109/access.2025.3547932 · Cited by 12 · see citing works
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8 · see citing works
Integrating Security Testing in CI/CD Pipelines: Current Trends from Literature and Market
Meliala, R., Lim, C., & Andreas, J. (2024) · International Conference on Informatics and Computing (ICIC) · doi:10.1109/icic64337.2024.10957011 · Cited by 3 · see citing works
DevOps Dynamics: Tools Driving Continuous Integration and Deployment
Gowda, P. G., A, N. S. S., & Joyce, J. E. (2024) · IEEE International Conference on Information Technology, Electronics and Intelligent Communication Systems (ICITEICS) · doi:10.1109/iciteics61368.2024.10624986 · Cited by 2 · see citing works
Achibat, M. Y., Aqili, N., & Ziti, S. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-07718-9_15 · Cited by 1 · see citing works
Unmasking Threat Vectors in Large Language Models
Joshi, N., Ravikumar, R. N., Kishore, S., Pandit, S., Pandit, S., & Aarthi, S. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-8252-4.ch001 · Cited by 1 · see citing works
Canedo, E. D., Spósito, S. L., de Melo, L. P., Nunes, R. R., & Ladeira, M. (2026) · Computers & Security · doi:10.1016/j.cose.2026.105026 · Cited by 1 · see citing works
Ramaj, X., Sánchez‐Gordón, M., Colomo‐Palacios, R., & Gkioulos, V. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-61382-1_6 · Cited by 2 · see citing works
A Practical Approach of Devsecops Integration in Multi-Tier Web ApplicationsPreprint
Rida, A., Bakhil, A., & Lahcen, A. A. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5337693
The Agile PMO Paradox: Embracing DevOps in the UAE
Peerzada, I. (2025) · Software · doi:10.3390/software4040024
Validation of a Governance Framework Supporting Security Controls across Emerging Systems
Sinan, M., Shahin, M., & Gondal, I. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00362
Luu-Minh, T., Quach-Thi-Hoai, P., Le-Anh, T., Nguyen-Van, B., & Le‐Trung, Q. (2025) · RIVF International Conference on Computing and Communication Technologies (RIVF) · doi:10.1109/rivf68649.2025.11365030
Benchmarking DevSecOps Pipelines: A Performance and Security Analysis of Laravel and CodeIgniter
Raihan, M. F., & Setiawan, H. (2025) · IEEE International Conference on Cryptography, Informatics, and Cybersecurity (ICoCICs) · doi:10.1109/icocics68032.2025.11383915
Singh, N. (2025) · International Conference on Advanced Computing and Emerging Technologies (ACET) · doi:10.1109/acet67282.2025.11430387
Implementing DevSecOps: A Systematic Literature Review on Integrating Security into DevOps
Guyong, J. A., Balaybay, R. M., Macario, J. M., Pangan, E. J., & Clemente, J. R. D. (2025) · World Symposium on Software Engineering (WSSE) · doi:10.1145/3779657.3779664
MCP-SecLint: An Open-Source Static Analyzer for Detecting Vulnerabilities in LLM Tool Integrations
Ridao, A. P., Safari, M., Kang, Z., & Dragoni, N. (2026) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3806007.3810961
Ogata, K., Koide, K., Toshizane, G., Satoi, Y., Honjo, T., Matsumoto, J., Sato, M., & Hamatsu, Y. (2026) · Lecture notes in intelligent transportation and infrastructure · doi:10.1007/978-3-032-13861-3_12
Modern Trends of Lifecycle Optimization in Software Development
Simakin, G., & Zykov, S. V. (2026) · Smart innovation, systems and technologies · doi:10.1007/978-3-032-04186-9_10
- Authors
- Zhou, X., Mao, R., Zhang, H., Dai, Q., Huang, H., Shen, H., Li, J., & Rong, G.
- Affiliations
- State Key Laboratory of New Technology of Computer Software (CN)
- Huatai Securities Co., Ltd. Nanjing China
- State Grid Nanjing Power Supply Company (China) (CN)
- Australian Catholic University (AU)
- Norwegian University of Science and Technology (NO)
- Corresponding author
- Zhang, He
- Venue
- IET Software
- Published
- 2023-07-26
- Volume
- 17
- Issue
- 4
- Pages
- 435-454
- ISSN
- 1751-8806 (ISSN-L)
- OpenAlex
- W4385377587
- Cited by
- 23
- References
- 45
- Citations by year
- 2026: 6 · 2025: 11 · 2024: 6
- FWCI
- 5.39
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- IET Software (publishedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- NORA - Norwegian Open Research Archives (submittedVersion, cc-by-nc-nd)
- Funders
- National Natural Science Foundation of China (2019YFE0105500)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- DevSecOps, DevOps, software security, DevOps pipelines, security practices, technological enablers, practitioner perceptions
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
