Progress(link is external) announced its recognition in the 2025 Gartner Magic Quadrant for Digital Experience Platforms.
Only 8 percent of companies are securing 75 percent or more of their cloud-native applications with DevSecOps practices today, with that number jumping to 68 percent of companies securing 75 percent or more of their cloud-native applications with DevSecOps practices in two years, according to a new survey by Enterprise Strategy Group (ESG) and Data Theorem entitled Security for DevOps – Enterprise Survey Report.
The study results also revealed that API-related vulnerabilities are the top threat concern (63 percent of respondents) when it comes to serverless usage within organizations.
“This study reveals that while organizations have started, there is more work to be done when it comes to securing their cloud-native apps with the benefits DevSecOps offers,” said Doug Cahill, Senior Analyst and Group Practice Director of Cybersecurity for ESG. “Fundamental changes to application architectures and the infrastructure platforms that host them are antiquating existing cybersecurity technologies and challenging traditional approaches to protecting business-critical workloads. Organizations should consider newer approaches to securing their cloud-native apps, particularly solutions that address API-related vulnerabilities, which tops respondents’ minds when identifying their top threat concern.”
Additional key findings of the study include:
■ API security was the top area reported for current or projected incremental spend; and API security was reported as most important by respondents among the cloud-native application security controls, at 37 percent.
■ 82 percent of surveyed organizations have different teams assigned to secure cloud-native apps. Of this group, 50 percent of respondents’ organizations plan to merge these responsibilities in the future, while 32 percent of respondents’ organizations do not plan to merge these responsibilities.
■ More than half of respondents indicated their organization’s software developers are already using serverless functions to some extent, with another 44 percent either evaluating or planning to start using serverless within the next two years.
■ When asked what are the most important pre-deployment cloud-native application security controls, software vulnerability scanning of registry-resident container images was the top answer at 26 percent from respondents. The next most important pre-deployment cloud-native application security control was API vulnerability management, at 25 percent.
■ Deployment flexibility and support for all types of servers and compute platforms were the top two answers (both at 38 percent) when indicating the most important attributes of products used to secure cloud-native apps.
“ESG’s industry report is aligned with what we’ve long suspected with organizations, and with what we have witnessed in the industry,” said Doug Dooley, Data Theorem COO. “Production workloads are shifting to public cloud platforms, and organizations are quickly adopting serverless functions. They need to understand the associated risks and new threat model they are facing, and the means of addressing these cloud native and API risks.”
Methodology: ESG completed its research for the report this summer to determine the composition of cloud-native applications, their challenges, and future priorities for securing cloud-native applications. Overall, the study analyzed responses from 371 IT and cybersecurity professionals at organizations in North America responsible for evaluating, purchasing, and managing cloud security technology products and services. These organizations are mature cloud users in terms of public cloud services and/or containers. Survey participants represented a wide range of industries, including manufacturing, financial services, health care, communications and media, retail, government, and business services.
Industry News
Copado announced comprehensive DevOps support for Salesforce Data Cloud deployments, enabling organizations to streamline the development and deployment of Agentforce solutions.
Appfire announced its acquisition of Flow, an enterprise software product for Software Engineering Intelligence (SEI), from Pluralsight.
Check Point® Software Technologies Ltd.(link is external) announced new Infinity Platform capabilities to accelerate zero trust, strengthen threat prevention, reduce complexity, and simplify security operations.
WaveMaker announced the release of WaveMaker AutoCode, an AI-powered plugin for the Figma universe that produces pixel-perfect front-end components with lightning fast accuracy.
DoiT announced the acquisition of PerfectScale, an automated Kubernetes (K8s) optimization and governance platform.
Parasoft(link is external) earned a top spot as a Leader and Fast Mover in the latest GigaOm Radar Report on API Functional Automated Testing.
Linux Foundation Europe and OpenSSF announced a global joint-initiative to help prepare maintainers, manufacturers, and open source stewards for the implementation of the EU Cyber Resilience Act (CRA) and future cybersecurity legislation targeting jurisdictions around the world.
OutSystems announced the general availability (GA) of Mentor on OutSystems Developer Cloud (ODC).
Kurrent announced availability of public internet access on its managed service, Kurrent Cloud, streamlining the connectivity process and empowering developers with ease of use.
MacStadium(link is external) highlighted its major enterprise partnerships and technical innovations over the past year. This momentum underscores MacStadium’s commitment to innovation, customer success and leadership in the Apple enterprise ecosystem as the company prepares for continued expansion in the coming months.
Traefik Labs announced the integration of its Traefik Proxy with the Nutanix Kubernetes Platform® (NKP) solution.
Perforce Software announced the launch of AI Validation, a new capability within its Perfecto continuous testing platform for web and mobile applications.
Mirantis announced the launch of Rockoon, an open-source project that simplifies OpenStack management on Kubernetes.
Endor Labs announced a new feature, AI Model Discovery, enabling organizations to discover the AI models already in use across their applications, and to set and enforce security policies over which models are permitted.