Developers at large enterprises are becoming more confident in security processes but feel constrained by the amount of time they have to spend on security-related tasks, according to a new report from Checkmarx.

The application security firm’s latest research report, DevSecOps Evolution: From DevEx to DevSecOps, has found that almost all (99%) of developers now have access to security training, with 90% ranking the effectiveness of their firm’s training as either medium or high. 

The study found that 72% of the 1,500 developers and engineers surveyed are forced to spend more than 17 hours each week on security-related tasks, while one in four spends more than 25 hours.

However, despite feeling confident in their training and spending more time on security-related issues, just 21% of developers said that security is their top priority when coding, while only 42% said that they understand the vulnerability tickets they’re sent up to half of the time.

The report found that larger firms are working towards achieving more mature DevSecOps, with 30% having moved beyond focusing only on the developer experience to building more sophisticated processes.

Almost a third (28%) of organisations are now tracking mean time to remediate as a metric, while 45% are measuring code security, and even more (46%) are tracking the ability to meet deadlines.

Checkmarx’s research shows a distinct culture shift in the relationship between security and DevOps teams, with developers now more inclined to believe those in AppSec are working with their best interests at heart.

Asked how in-tune the AppSec team is with their release schedules, 47% of developers said that security teams care and actively work to improve developer experience, although a further 28% said those in AppSec don’t have the tools or resources yet to adequately help. 

Added to that, the study found that software engineering (64%) and product management (62%) teams are driving security requirements, well ahead of those working in AppSec (40%). 

Recommended reading

• Developer Disconnect Could Waste Billions on Cloud Infrastructure
• Comment | Navigating Today’s Cloud Security Challenges
• Dev Teams Losing Fifteen Hours a Week to Tool Sprawl

With overall market maturity in its early stages, Checkmarx said the study reveals that there is not yet widespread adherence to established best practices for operation and measurement of effective DevSecOps, and that while organisations have made forward strides, there is still more progress to be made.

“The massive increase in the number of development teams and DevOps pipelines within large organisations shows how critical it is for DevOps and security teams to build a shared culture for successful collaboration,” said Martin Lindsay, VP of regional marketing at Checkmarx.

“With the ultimate goal of delivering high-performing code – which, by definition is secure code – these two teams are finding that improving the developer experience with application security is just the first step and that security must find a way to match the pace of agile development.”