DevOps is a set of practices, tools, and cultural principles that merges software development (Dev) and IT operations (Ops) into a single, automated lifecycle so organizations can build, test, and release software faster and more reliably.
DevOps combines software development and IT operations into one continuous workflow. Development and operations teams share responsibility for building, testing, deploying, and running software, and they automate each stage with CI/CD pipelines, infrastructure as code, and continuous monitoring. The goal is to ship changes quickly without sacrificing stability or security.
Key Takeaways
- DevOps merges development and operations into one automated lifecycle built on CI/CD pipelines, infrastructure as code, and continuous monitoring.
- The term DevOps was coined at the first DevOpsDays conference, organized by Patrick Debois in Ghent, Belgium, in October 2009.
- The four DORA metrics measure DevOps performance: deployment frequency, lead time for changes, change failure rate, and failed deployment recovery time.
- DevSecOps embeds security into every pipeline stage; NIST SP 800-218, the Secure Software Development Framework, defines the baseline practices.
- Every pipeline runs on secrets, keys, and certificates. Unsigned artifacts and hardcoded credentials are among the most common software supply chain weaknesses.
Where DevOps Came From
DevOps grew out of frustration with the wall between development teams, who were rewarded for shipping changes, and operations teams, who were rewarded for keeping systems stable.
At the Agile 2008 conference in Toronto, Belgian consultant Patrick Debois and Andrew Clay Shafer connected over the idea of applying agile methods to infrastructure and system administration. In October 2009, Debois organized the first DevOpsDays conference in Ghent, Belgium, and the event’s shortened name gave the movement its label.
The idea matured through The Phoenix Project (2013) and The DevOps Handbook (2016), both co-authored by Gene Kim, and through the DORA (DevOps Research and Assessment) program founded by Nicole Forsgren, Jez Humble, and Gene Kim. Google Cloud acquired DORA in 2018 and still publishes its annual research.
How Does DevOps Work?
DevOps works by giving one team, or a set of tightly integrated teams, ownership of the entire application lifecycle: plan, code, build, test, release, deploy, operate, and monitor.
Instead of developers handing finished code over the wall to operations, both functions share the same goals, the same tooling, and the same accountability for what runs in production. Feedback from monitoring flows straight back into planning, which closes the loop.
Automation makes the model work at scale. Manual handoffs (building code, provisioning servers, running test suites, promoting releases) become pipelines that run the same steps the same way every time. When security engineering joins the same lifecycle, the model is called DevSecOps.
Core DevOps Practices
Seven practices form the operational core of DevOps.
- Version control. All code, configuration, and infrastructure definitions live in a version-controlled repository, typically Git, which serves as the single source of truth.
- Continuous integration (CI). Developers merge changes into the shared repository frequently, and every merge triggers an automated build and test run so integration problems surface within minutes.
- Continuous delivery (CD). Every change that passes testing is automatically prepared for release to a staging environment, so the software stays in a deployable state at all times.
- Continuous deployment. An extension of continuous delivery in which changes that pass all automated checks are released to production without a manual approval step.
- Continuous testing. Automated unit, integration, security, and performance tests run at every pipeline stage rather than in a separate testing phase.
- Infrastructure as code (IaC). Servers, networks, and cloud resources are defined in machine-readable files and provisioned through APIs, which makes environments reproducible and auditable.
- Monitoring and observability. Logs, metrics, and traces from production feed dashboards and alerts, and site reliability engineers use them to hold services to defined reliability targets.
Popular DevOps Tools
Most DevOps toolchains combine tools from six categories.
| Category | Widely used tools | What they do |
| CI/CD | Jenkins, GitHub Actions, GitLab CI/CD | Automate build, test, and release pipelines |
| Containers and orchestration | Docker, Kubernetes | Package applications and run them across clusters |
| Infrastructure as code | Terraform, OpenTofu, AWS CloudFormation | Define and provision infrastructure from versioned files |
| GitOps | Argo CD, Flux | Continuously reconcile live systems against a Git repository |
| Secrets management | HashiCorp Vault | Store and issue credentials, API keys, and certificates |
| Observability | Prometheus, Grafana | Collect metrics and visualize system health |
One licensing note: Terraform moved from open source to the Business Source License in August 2023, which led the Linux Foundation to back OpenTofu, an open source fork that reached its first stable release in January 2024.
How Is DevOps Performance Measured?
The industry standard for measuring DevOps performance is DORA’s set of four key metrics, introduced in 2013.
- Deployment frequency: how often code reaches production.
- Lead time for changes: the time from code commit to running in production.
- Change failure rate: the percentage of deployments that cause a failure in production.
- Failed deployment recovery time: how quickly service is restored after a failed deployment (formerly called time to restore service).
DORA added reliability as a complementary measure in 2021 and a rework rate metric in 2024. In 2025, the annual study was renamed the State of AI-Assisted Software Development report, and the familiar low-to-elite performance tiers were replaced with seven team archetypes that combine delivery and organizational signals. One finding has held for a decade: teams that deploy faster are also more stable. Speed and stability are not a trade-off.
What Is DevSecOps?
DevSecOps extends DevOps by making security a shared, automated responsibility at every stage of the pipeline instead of a final review gate.
In practice, that means static and dependency scanning in CI, secrets detection before commit, signed build artifacts, and policy checks before deployment. The shift accelerated after the 2020 SolarWinds supply chain attack and US Executive Order 14028 (May 2021), which directed federal agencies toward secure software development. NIST codified the practices in SP 800-218, the Secure Software Development Framework (SSDF), published in February 2022, and the OpenSSF SLSA framework (version 1.0, April 2023) defines maturity levels for supply chain integrity.
Cryptography carries much of this weight. Pipelines authenticate with machine identities issued from your public key infrastructure (PKI), artifacts are signed with code signing certificates, and TLS protects every connection. Since June 1, 2023, the CA/Browser Forum has required publicly trusted code signing keys to be generated and stored in a hardware crypto module meeting at least FIPS 140-2 Level 2, Common Criteria EAL 4+, or equivalent. A DevOps pipeline is only as trustworthy as the keys, secrets, and certificates that run it.
Benefits and Challenges of DevOps
The measurable benefit of DevOps is faster delivery with equal or better stability; the recurring challenge is organizational change.
DORA research consistently shows that top performers deploy more often, recover faster, and fail less often than their peers. Automation removes manual error from builds and deployments, and whole-lifecycle ownership pushes teams to optimize the system rather than individual silos.
The hard parts are rarely technical. Adopting DevOps means restructuring team boundaries, retiring entrenched processes, and choosing metrics that reward outcomes rather than raw speed. An increase in deployment frequency means little if the change failure rate rises with it. Tool sprawl creates a second wave of problems: every new pipeline adds credentials, keys, and certificates that must be inventoried and controlled.
Current DevOps Trends
Three shifts define DevOps in 2026: platform engineering, GitOps, and AI-assisted delivery.
Platform engineering packages CI/CD, infrastructure, and security controls into an internal developer platform, so product teams consume vetted golden paths instead of assembling their own toolchains. GitOps applies the same discipline to operations, with tools such as Argo CD continuously reconciling production against a Git repository. AI now touches most of the lifecycle: DORA research published in 2025 found that 90 percent of surveyed technology professionals use AI in their daily work, and concluded that AI amplifies the strengths and weaknesses an organization already has rather than fixing weak foundations.
How Encryption Consulting Helps
Encryption Consulting’s Securing DevOps use case shows how to protect the cryptographic layer every pipeline depends on. CodeSign Secure centralizes code and artifact signing behind FIPS 140-2 Level 3 validated HSMs and integrates with CI/CD tools including Jenkins, GitLab, and Azure DevOps, so every build is signed, timestamped, and logged without slowing delivery. Advisory teams then help you manage the certificates, keys, and secrets your environments run on. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is DevOps in simple terms?
DevOps is a way of building and running software where the people who write the code and the people who operate it work as one team. They automate building, testing, and releasing software so changes reach users in days or hours instead of months, and they monitor production continuously so problems are caught and fixed quickly.
What is the difference between DevOps and DevSecOps?
DevOps integrates development and operations into one automated lifecycle. DevSecOps adds security as a third shared responsibility, embedding controls such as code scanning, secrets detection, and artifact signing directly into the pipeline instead of applying them in a final review. NIST SP 800-218, the Secure Software Development Framework, defines the baseline practices most DevSecOps programs implement.
What is CI/CD in DevOps?
CI/CD stands for continuous integration and continuous delivery (or deployment). Continuous integration merges and tests code changes automatically every time a developer commits. Continuous delivery keeps the software permanently ready to release, and continuous deployment goes one step further by pushing every change that passes automated checks straight to production. Tools such as Jenkins, GitHub Actions, and GitLab CI/CD run these pipelines.
What are the four DORA metrics?
The four DORA metrics are deployment frequency, lead time for changes, change failure rate, and failed deployment recovery time, formerly called time to restore service. Together they measure both delivery speed and stability. DORA research, published annually by Google Cloud, has shown for over a decade that high performers score well on all four at once.
Is DevOps a tool, a job title, or a methodology?
DevOps is primarily a methodology and culture, not a single tool. No product makes an organization DevOps by itself; the practices of shared ownership, automation, and continuous feedback do. That said, DevOps engineer is a common job title for practitioners who build and maintain pipelines and infrastructure, and a large tool ecosystem, from Jenkins to Kubernetes, supports the practices.
Secure Your DevOps Pipeline
Signed artifacts, protected keys, and managed certificates keep a fast pipeline trustworthy. Explore the Securing DevOps use case, see CodeSign Secure in action, or talk to an Encryption Consulting advisor.