Can your operations handle your security ambitions?

For software companies, security is inseparable from software quality. That makes security excellence a real competitive advantage. But closing the gap between security ambitions and operational reality is much harder than it looks.

“Closing the gap between security ambitions and operational reality is much harder than it looks.”

Here’s a scenario that plays out more often than it should. You just approved the purchase of an AI security tool that automatically detects and triages vulnerabilities during production. It perfectly complements your vision for advanced security: comprehensive CI/CD automation, mature platform engineering, and sophisticated security orchestration. 

It’s only after onboarding that a messy reality emerges. Your security stack doesn’t fully align with how your engineering counterparts operate, and the existing legacy systems create manual work for teams that must toggle between different tools to fill gaps and check alerts. As a result, you lose any efficiency gains that this new tool may have delivered. 

“Security becomes a bottleneck instead of an enabler.”

If this sounds familiar, you’re not alone. I’ve seen this pattern at many enterprise software factories. For large software producers facing high operational complexity, well-intentioned additions to a security program can introduce even more complexity, creating unexpected problems. Security becomes a bottleneck instead of an enabler.

Security excellence starts with operational excellence

Before scaling security operations, you need a strong understanding of the existing processes underpinning your organization’s security. Operational maturity will look slightly different for every organization, but there are three key indicators that you’re prepared to implement more advanced security capabilities:

1. Your architecture is modern. Mature organizations use platforms that make it easier to meet security standards. As you start to modernize architecture with cloud-native solutions, you’ll notice that it simplifies updates and maintenance, unlike legacy systems riddled with technical debt and complexity.

2. Your deployment processes are automated and well-documented. Mature teams automate pipelines and use API-driven operations to eliminate busy work and scale their security programs. They also document their processes and collaborate closely with infrastructure and reliability teams to maintain sophisticated monitoring and visibility across all systems. Less mature organizations often rely on manual processes and institutional knowledge, making it nearly impossible to replicate workflows and engage in cross-functional collaboration efficiently. 

3. Your security culture is proactive and flexible. Culture can simplify or complicate how your organization reacts when problems arise during implementation. A culture that promotes blameless post-mortems and proactivity will make it easier to evaluate mistakes and implementation gaps, helping prevent future problems. Teams stuck in reactive cycles within their existing workflows will be overwhelmed by new capabilities as their security programs grow.

Success depends on building efficiency and managing technical debt, without relying on linear scaling. If you’re on the mature end of these indicators, you will have an easier time scaling your security program.

If you’re not ready, take it step by step

If you find yourself lagging on maturity indicators, prioritize strengthening your existing operational engineering foundations, rather than adding more advanced capabilities.

Hybrid security approaches will work the best during this transition. As you modernize CI/CD pipelines, strangler-fig solutions, which gradually bridge legacy systems and modern platforms, help you maintain security coverage while incrementally modernizing your tooling and processes. This ensures that you can continue to grow your security program over time, while maintaining software velocity. 

Avoid becoming overly ambitious with aggressive transformation timelines or overloading teams. Simultaneous re-platforming and process overhauls, for instance, can cause widespread disruption and complicate the pace (and effectiveness) of both initiatives. 

Time will be your most important investment. Organizations managing both high-complexity and significant modernization efforts should expect this process to take up to 48 months.  While more ambitious timelines can be achieved, rushing risks failed implementation and places unrealistic demands on teams. Be sure to inform leadership of the multi-year timeline, and flag the anticipated milestones along the way.

For example, a timeline toward increasing operational readiness could look like: 

• Phase 1 Stabilize and Plan: Assess the current state of your software security operations and identify transformation requirements. This is when you begin building a hybrid security architecture that supports legacy and modern systems and establish a transformation roadmap with milestones and success metrics.
• Phase 2 Foundation Building: Take steps to reduce technical debt and begin deploying hybrid models that launch modern platforms alongside legacy systems. Pilot automated capabilities in high-value areas of your program that already demonstrate ROI and incorporate cultural initiatives that reduce organizational resistance and build momentum.
• Phase 3 Acceleration: Continue transformation momentum. Assess progress on legacy system migration and modernization efforts, and ensure that emerging platform capabilities enable self-service.
• Phase 4 Optimization: Measure how your program is improving efficiency relative to your baseline. Confirm the status of legacy constraints and evaluate how further security automation can build business velocity.

This will look different for every organization.

The path toward your ultimate security program

The path to real business value starts with building solid operational foundations. Organizations limited by legacy constraints, technical debt, and manual processes will never achieve security excellence, no matter how much they invest in tooling. Your operational maturity can determine whether a new solution becomes a productivity driver or expensive shelfware.

“Your operational maturity can determine whether a new solution becomes a productivity driver or expensive shelfware.”

Organizations must prioritize getting their software security tools and processes right first; only then will their investments in advanced security capabilities deliver the transformational value, and competitive differentiation, they promise.

Jamie is the Director of Security Platforms and Architecture at GitLab, leading Security Architecture, Security Research, and AppSec. Her expertise spans product security, AppSec, DevSecOps, security tooling and automation, and GRC. Before transitioning into cybersecurity, she spent 8 years as…

Read more from Jamie Dicken