Data Theorem and Enterprise Strategy Group (ESG) have announced the finding of an independent industry study focused on cloud-native applications. The study analyzed responses from 371 IT and cybersecurity professionals at organizations in North America responsible for evaluating, purchasing, and managing cloud security technology products and services.
It found that only 8 percent of companies are securing 75 percent or more of their cloud-native applications with DevSecOps practices today, with that number jumping to 68 percent of companies securing 75 percent or more of their cloud-native applications with DevSecOps practices in two years.
The study results also revealed that API (application programming interface) related vulnerabilities are the top threat concern (63 percent of respondents) when it comes to serverless usage within organizations. In line with this, API security was the top area reported for current or projected incremental spend.
“This study reveals that while organizations have started, there is more work to be done when it comes to securing their cloud-native apps with the benefits DevSecOps offers,” said Doug Cahill, senior analyst and group practice director of cybersecurity for ESG. “Fundamental changes to application architectures and the infrastructure platforms that host them are antiquating existing cybersecurity technologies and challenging traditional approaches to protecting business-critical workloads. Organizations should consider newer approaches to securing their cloud-native apps, particularly solutions that address API-related vulnerabilities, which tops respondents’ minds when identifying their top threat concern.”
According to the study, 82 percent of organizations have different teams assigned to secure cloud-native apps. Of this group, 50 percent of respondents’ organizations plan to merge these responsibilities in the future.
More than half of respondents indicated their organization’s software developers are already using serverless functions to some extent, with another 44 percent either evaluating or planning to start using serverless within the next two years.
Other findings from the study include a need for deployment flexibility and support for all types of servers and platforms when selecting products used to secure cloud-native apps.
“ESG’s industry report is aligned with what we’ve long suspected with organizations, and with what we have witnessed in the industry,” said Doug Dooley, Data Theorem COO. “Production workloads are shifting to public cloud platforms, and organizations are quickly adopting serverless functions. They need to understand the associated risks and new threat model they are facing, and the means of addressing these cloud native and API risks.”