The DevOps.com stories enterprise IT leaders actually read.
Volume 341, Issue 4 · 20 articles from 5 issues
DevOps.com argues stage-gated waterfall becomes useful again as a lightweight control structure over fast AI-generated work.
The article argues waterfall is becoming useful again in the LLM era, not as a slow bureaucratic process but as a lightweight control structure for fast AI-generated work.
Waterfall 2.0 follows five stages: vision, architecture decision records, prototypes, an architectural skeleton, and code plus tests.
The key inversion is that backtracking becomes a strength rather than a failure, because LLMs can regenerate earlier artifacts quickly. That makes revisiting an earlier stage cheap in a way it never was with human-written documents. A shared knowledge corpus keeps the stages consistent as work regenerates.
GitHub's Copilot update lets developers switch AI models mid-session rather than committing to one.
GitHub has positioned Copilot as a multi-model orchestration platform, adding Kimi K3 and MAI-Code-1.1-Flash and enabling per-turn model switching in VS Code.
Agent Plugins 1.0 unifies plugin systems across surfaces, Copilot CLI gains subagent management and queued prompts, and the JetBrains integration adds Memory and Ollama support.
The platform still lacks governance features to track which model generated specific lines of code.
AI test generators produce too many tests while missing boundary and business-logic cases; separating judgment from mechanics helps.
DevOps.com argues AI-generated API tests can be fast without being useful. Generators often produce large volumes of tests while still missing important boundary, business-logic and cross-field scenarios.
Better prompting improves results but tends to plateau, because the hardest testing problems require judgment rather than more instructions.
The article proposes a stronger architecture that separates judgment from mechanics, with fine-tuned models deciding what to test and separate machinery generating the test code. The distinction is what allows quality to improve rather than volume.
Post-quantum migration starts with discovering where vulnerable cryptography exists, which requires a continuous cryptographic inventory.
DevOps.com argues post-quantum cryptography migration starts with visibility rather than algorithm replacement. Teams must first discover where vulnerable cryptography actually exists before they can swap anything.
Cryptographic dependencies hide across source code, libraries, containers, CI/CD pipelines, Kubernetes, cloud services and SaaS platforms. Software bills of materials help map components, but cryptographic bills of materials and dedicated inventories provide deeper visibility into keys and algorithms in use.
The article argues the inventory must be continuous rather than a one-time audit, because dependencies change with every build.
AI-driven code generation accelerates productivity but introduces technical debt, security gaps, and quality issues.
AI coding tools are producing code faster than engineering teams can properly review, creating hidden risks in technical debt, security vulnerabilities, and quality issues.
Mladen Lazic, CTO of Scopic, explains that reviewing AI-generated code is harder because context and developer intent are missing. His solution involves keeping developers engaged from the start, treating AI as junior contributors requiring guidance rather than autonomous builders.
Critical to success is separating AI agents for coding, testing, and review-with some testing agents deliberately isolated from source code to validate against requirements rather than what the coding agent produced.
AI adoption in CI/CD pipelines is growing, but most enterprises lack operational readiness and face integration challenges.
A Techstrong survey reveals that active interest is running ahead of operational readiness, with most organizations still experimenting with AI in isolated areas of their CI/CD pipelines.
The research identifies fragmented toolchains, governance concerns, and integration complexity as primary barriers preventing broader AI operationalization.
Though enterprises increasingly recognize AI's potential in software delivery, most lack the necessary infrastructure and processes to scale implementations effectively across their entire delivery architectures.
AI coding assistants increase development speed faster than teams can verify code, creating hidden enterprise risk.
AI-assisted coding has accelerated software output while verification capacity remains flat, creating validation debt that leadership dashboards fail to measure. Industry experts emphasize that organizations must track test escape rates as visible metrics and treat AI-generated changes as a distinct category to manage this risk.
In regulated industries, unverified code poses audit and compliance dangers that extend months beyond deployment. As agentic systems become more prevalent, continuous validation practices become essential since deterministic testing assumptions no longer apply. Leaders should fund verification as a first-class capability to maintain reliability alongside accelerated development velocity.
A practical guide to a seven-stage DevSecOps CI/CD pipeline on Azure using GitHub Actions.
This practical guide shows how to build automated security into a CI/CD pipeline using Azure and GitHub Actions.
It describes a seven-stage pipeline with CodeQL static analysis, Gitleaks secrets detection, dependency vulnerability scanning, build and test, staging deployment with smoke tests, production approval gates, and audit logging.
The core philosophy is that security checks run automatically on every change, just like unit tests, and should run early to catch issues before slow builds finish. The article provides real YAML, flags common mistakes like storing credentials in variables and using shallow clones, and recommends starting with free tools before adding paid ones.
Enterprises must implement centralized governance frameworks to manage AI coding agents at scale safely.
Most organizations never completed their DevOps transformations, and AI coding agents are now exposing those gaps. Moritz Plassnig, newly returned CEO of CloudBees, argues that agentic coding represents DevOps's second chance to deliver on its original promise.
He proposes encoding organizational policies as versioned governance that can be enforced across multiple tools. The key insight: as code generation accelerates, the bottleneck shifts to safe production deployment, requiring AI-scale governance to prevent supply chain risks from compounding with every automated step.
Using multiple AI agents in debate to design software systems as an automated architecture review board.
The article proposes using multiple AI agents in debate to design software systems rather than relying on a single model. Five specialized agents (Requirement Clarifier, Architect, Red-Team, Implementation, and Decision) collaborate to weigh tradeoffs across scalability, cost, and reliability.
By forcing tension and disagreement between agents, the workflow creates an automated architecture review board that surfaces better design decisions.
Rather than replacing human architects, it provides a faster, stricter, more consistent review before final human approval, and the author envisions architecture reviews eventually joining continuous delivery pipelines.
AWS CloudWatch moves past reactive dashboards with AI-powered anomaly detection and automated incident analysis.
CloudWatch now combines three major capabilities: S3 Tables with Apache Iceberg for petabyte-scale log storage and analysis at lower cost, native GenAI observability for tracking LLM token usage and RAG pipeline latency, and AI-assisted five whys incident analysis to accelerate root cause investigation.
Together these shift operations from manual troubleshooting toward proactive intelligence. Teams can detect issues before they reach users and reduce mean time to resolution through guided investigations and automated insights.
Most outages start as gradual degradation, so baselines and user-facing monitoring matter most.
The article notes that many system failures start quietly, appearing as gradual increases in latency or error rates rather than dramatic crashes.
It emphasizes establishing performance baselines to separate normal variation from genuine problems that warrant alerts.
Effective monitoring should track user-facing outcomes, like whether login works, rather than individual component health, since a few failed servers may not require escalation if the service still works.
Data shows about 68% of outages occur outside business hours, making long-duration failures the primary alert focus. The piece also warns that alert fatigue is a critical risk and teams should regularly audit notifications to cut noise.
Self-managed open-source search platforms hide substantial infrastructure and labor costs that managed alternatives now address.
While Apache Solr and similar open-source search tools eliminate upfront licensing fees, organizations must still invest significantly in servers, storage, monitoring, and engineering expertise to maintain them.
As generative AI raises user expectations for search capabilities and relevance, the operational burden of self-managed platforms becomes increasingly problematic.
Amazon OpenSearch Service and comparable managed solutions offer automated scaling, built-in AI features, and reduced maintenance overhead, allowing engineering teams to focus on product development rather than infrastructure management.
Survey shows 54% of organizations use AI across most of the SDLC, but quality concerns and governance gaps persist.
A Futurum Group survey of 839 IT decision-makers reveals that 54% work for organizations using AI across more than half their software development lifecycle, with 40% reporting AI generates most production code.
While DevOps spending is expected to grow 14% in 2027 and reach $226 billion by 2030, significant challenges emerge: 75% encountered production issues linked to AI, yet only 43% mandate human code review.
The article emphasizes that the volume of code being generated by AI coding tools is starting to overwhelm DevOps pipelines, highlighting the critical need for better code review processes before deployment.
Common CI/CD pipeline mistakes cause delayed delivery, higher costs and reduced engineering productivity.
The article identifies ten recurring CI/CD failures, including treating pipelines as static infrastructure, building monolithic pipeline designs, lacking performance visibility and mishandling secrets.
Recommendations include running separate pipelines for different purposes, enabling parallel task execution, maintaining consistent build environments and prioritizing developer experience.
Organizations can achieve significant improvement through effective caching strategies, balanced testing approaches and regular pipeline reviews rather than one-time setup.
A ten-step guide for developers building fully homomorphic encryption applications that compute on encrypted data.
Fully Homomorphic Encryption (FHE) lets servers perform calculations on encrypted data without decrypting it, keeping sensitive information secure. The article outlines a methodical approach starting with plaintext prototypes, then addressing architectural constraints such as eliminating branching logic and managing noise budgets through multiplicative depth optimization.
Developers must handle polynomial approximations for non-linear functions, convert to integer arithmetic, and select an appropriate FHE scheme such as BFV, BGV, or CKKS.
OpenFHE is recommended as the primary library, with performance testing and refinement afterward, acknowledging that FHE applications consume significant memory and processing resources.
When 40 alerts fire for one broken payment service, correlation is the bottleneck, not detection.
The scenario the article opens with is familiar: a payment service starts throwing errors at 2 a.m., and within minutes the observability stack fires 40 alerts covering latency, error spikes, memory warnings, and dependency timeouts.
Somewhere in that noise is the one signal explaining what actually broke. AI-driven incident correlation targets triage and diagnosis directly by grouping related signals across metrics, logs, and traces.
The piece is a practical walkthrough of applying that correlation to cut mean time to resolution rather than adding more detection coverage.
A study finds no universal best model for secure code, and higher cost does not mean safer output.
A Secure Code Warrior and RMIT study testing six frontier LLMs across 660 codebases found no model gained a universal advantage in security.
Performance varies dramatically by framework, with different models leading in Java, Python, Swift and API work.
Higher per-token cost does not guarantee better security. Tool-calling frequency drives expense, with one model costing $44 per run versus $5.60 for another at comparable security.
AI is transforming DevOps by embedding intelligent automation into CI/CD, incident response, and infrastructure management.
AI-native DevOps represents a fundamental shift in how teams deliver software, moving beyond rule-based automation to intelligent systems that understand context and spot patterns.
Rather than replacing engineers, AI enhances their capabilities by analyzing deployment risks, accelerating incident troubleshooting, and filtering observability data.
Success requires strong human oversight, clear approval processes, quality data, and robust security practices. Without those guardrails, production reliability and accountability suffer even as delivery speed increases.
Developers push back on AI because it redefines the job, not because they fear losing it.
Developers are commonly assumed to resist AI out of fear it will take their jobs, but the article argues the real driver is that AI has permanently changed what the job of a developer is.
A 2024 peer-reviewed study supports this: developers' stated concerns center less on job loss and more on how AI reshapes the work itself.
Not every developer is or has to be comfortable with that shift. For engineering leaders, the practical implication is that adoption resistance will not be resolved by job-security reassurances, because that is not the objection being raised.
More from DevOps.com · All IT section newsletters · This week