Are Companies Overlooking Security on the Path to Digital Transformation?
November 25, 2019

Michael O'Malley
Radware

The shift to DevOps production models, and the increasing reliance on serverless or containerized architectures is often driven by the need for operational speed and consistency. Digital transformation is supposed to make work smoother and more productive.

New research from Radware demonstrates the effect that the shift to microservices and the ever-evolving imperatives of digital transformation have had on organizations’ security posture.

A survey of 278 IT experts and executives from major companies (all of them had more than $250 million in revenue) found that security professionals aren’t always in the driver’s seat when it came to their company’s security posture. In fact, a full 70 percent of CISOs were not the top influencer when it came to deciding software policy, tools, or implementation.

That finding comes amid a massive shift in the operational structure and architecture of many IT teams that has engineers using new tools and finding new ways of working. These new methods have some wondering if security is an afterthought.

The Numbers Behind Digital Transformation

The survey illustrates the speed of two developments on the path to digital transformation. The first is the shift to DevOps or DevSecOps production models. The second is the increasing adoption of serverless or containerized architectures.

On the production model front, the data shows that more than 90% of respondents have DevOps or DevSecOps teams. It’s still a relatively recent phenomenon. Just one out of every five DevOps or DevSecOps teams have been in place for more than two years.

On the microservices side, the pace of change is even more in flux. Just ten percent of companies had no plans to migrate applications to serverless or containerized architectures. Most respondents saying they were either testing the water or were already moving along this particular path. Only about one in five respondents said they had migrated more than 50 percent of their apps to microservices architectures.

And these shifts are leading, as is the case, to some so-far unforeseen consequences. More than nine out of 10 reported data breaches in the prior year. More than half, 53 percent believe that some of these breaches were the result of poor communication or misunderstandings with their cloud provider over who was responsible for what.

Why Companies Are Still Vulnerable

One might suspect that companies in a state of flux are giving security considerations the short straw. And yet, that isn’t what the responses indicate. Companies are continuing to implement their current security architectures, however they are not evolving those same architectures for the new world.

More than half of the companies had multiple security protocol tools in place, with 70 percent having security controls on east-west traffic, 75 percent using a web application firewall, and more than half performing code reviews.

Companies are investing in tools, and using best practices, but they are still falling victim to successful cyberattacks. The shift in operations and architecture has exacerbated security dangers.

So, what can companies do about it?

The key lies in that first statistic in this article. CISOs have relevant security expertise. They need a seat at the table.

For one thing, companies need to defy — just a little — one of the imperatives driving the switch to containerless architecture: they need to slow down. The importance of planning can’t be ignored, and planning takes time. But it ensures that relevant stakeholders, like CISOs, play a strong role in decision-making.

The role of training can’t be ignored either. Terms like DevOps and digital transformation sound like technology-driven terms. In reality, they describe the way people are oriented toward and organized around their work. To get the most out of operational and architectural changes, invest in people.

It might seem unsatisfying to some to suggest that the solution to security woes doesn’t live in the technology stack. After all, the whole point of technology is the scalability of work. People are anything but scalable. But training, expertise, judgement, and consensus-building are critical components of security policy that add vital context to any organization.

Michael O'Malley is VP of Strategic Marketing for Radware
Share this

Industry News

April 02, 2025

Kong announced the launch of the latest version of Kong AI Gateway, which introduces new features to provide the AI security and governance guardrails needed to make GenAI and Agentic AI production-ready.

April 02, 2025

Traefik Labs announced significant enhancements to its AI Gateway platform along with new developer tools designed to streamline enterprise AI adoption and API development.

April 02, 2025

Zencoder released its next-generation AI coding and unit testing agents, designed to accelerate software development for professional engineers.

April 02, 2025

Windsurf (formerly Codeium) and Netlify announced a new technology partnership that brings seamless, one-click deployment directly into the developer's integrated development environment (IDE.)

April 02, 2025

Opsera raised $20M in Series B funding.

April 02, 2025

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, is making significant updates to its certification offerings.

April 01, 2025

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the Golden Kubestronaut program, a distinguished recognition for professionals who have demonstrated the highest level of expertise in Kubernetes, cloud native technologies, and Linux administration.

April 01, 2025

Red Hat announced new capabilities and enhancements for Red Hat Developer Hub, Red Hat’s enterprise-grade internal developer portal based on the Backstage project.

April 01, 2025

Platform9 announced that Private Cloud Director Community Edition is generally available.

March 31, 2025

Sonatype expanded support for software development in Rust via the Cargo registry to the entire Sonatype product suite.

March 31, 2025

CloudBolt Software announced its acquisition of StormForge, a provider of machine learning-powered Kubernetes resource optimization.

March 31, 2025

Mirantis announced the k0rdent Application Catalog – with 19 validated infrastructure and software integrations that empower platform engineers to accelerate the delivery of cloud-native and AI workloads wherever the\y need to be deployed.

March 31, 2025

Traefik Labs announced its Kubernetes-native API Management product suite is now available on the Oracle Cloud Marketplace.

March 27, 2025

webAI and MacStadium(link is external) announced a strategic partnership that will revolutionize the deployment of large-scale artificial intelligence models using Apple's cutting-edge silicon technology.

March 27, 2025

Development work on the Linux kernel — the core software that underpins the open source Linux operating system — has a new infrastructure partner in Akamai. The company's cloud computing service and content delivery network (CDN) will support kernel.org, the main distribution system for Linux kernel source code and the primary coordination vehicle for its global developer network.