JFrog-Sponsored IDC Study Shows Growing Developer Focus on Software Security, Impacting Companies’ Competitive Advantage

Rhea-AI Summary

JFrog (Nasdaq: FROG) released findings from an IDC survey revealing significant time and financial costs associated with software security tasks for developers. The study, titled 'The Hidden Cost of DevSecOps: A Developer's Time Assessment,' shows that companies spend an average of $28,000 per developer annually on security-related tasks.

Key findings include:

• 50% of developers experienced a significant increase in weekly hours spent on security tasks
• Developers spend an average of 3.5 hours manually reviewing security scanning findings
• 69% of developers agree that security responsibilities require frequent context switching between tools
• Developers devote 50% of their time to understanding and addressing secrets scanning results
• Only 23% of developers run static application security testing (SAST) scans before deploying code to production

The survey emphasizes the need for streamlined security processes, tooling, and training to improve efficiency and effectiveness in protecting the software supply chain.

Positive

• JFrog's sponsored IDC study provides valuable insights into DevSecOps challenges and costs
• The study highlights the growing importance of software security in the development process
• Findings may drive increased demand for JFrog's Software Supply Chain Platform and security solutions

Negative

• Increased time spent on security tasks may slow down development and innovation processes
• High costs associated with security-related tasks ($28,000 per developer annually) may impact company budgets
• Inefficiencies in current security processes and tools may lead to increased risks and vulnerabilities

Insights

Market Research Analyst

The IDC survey reveals significant hidden costs in DevSecOps, with companies spending an average of $28,000 per developer annually on security-related tasks. This impacts JFrog (FROG) and the broader software development industry in several ways:

1. Market Opportunity: There's a clear need for more efficient DevSecOps tools, which aligns with JFrog's product offerings. This could drive increased demand for their Software Supply Chain Platform.

2. Competitive Advantage: Companies that can streamline security processes may gain a significant edge. JFrog's focus on this area could strengthen its market position.

3. Industry Trends: The shift towards increased security focus in development processes indicates a long-term trend that could shape future software development practices and tools.

4. Potential Growth: As companies recognize these hidden costs, they may increase investments in DevSecOps solutions, potentially benefiting JFrog's revenue streams.

Tech Expert

The survey highlights critical inefficiencies in current DevSecOps practices:

1. Time Drain: Developers spend 19% of their time on security tasks, often outside work hours. This reduces innovation and productivity.

2. False Positives: An average of 3.5 hours per week is wasted on manual reviews due to inaccurate scanning results.

3. Context Switching: 69% of developers struggle with tool fragmentation, reducing efficiency and potentially increasing security risks through token mismanagement.

4. Secrets Management: Half of security-related time is spent on secrets scanning and remediation, indicating a significant challenge in this area.

5. SAST Underutilization: Only 23% of developers run static application security testing before production, leaving a major security gap.

These findings underscore the need for more integrated, accurate and automated DevSecOps solutions, which aligns with JFrog's product strategy and market positioning.

Titled the "Hidden Costs of DevSecOps," the IDC InfoBrief Reveals Companies Spend an Average of $28K Per Developer Annually on Identifying, Evaluating, and Addressing Software Security Concerns

SUNNYVALE, Calif.--(BUSINESS WIRE)-- JFrog Ltd. (“JFrog”) (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, released the findings of an IDC survey indicating developers are spending significantly more time and companies are spending $28K per developer yearly on security-related tasks such as manual application scan reviews, context switching, and secrets detection, among other items. The IDC InfoBrief, “The Hidden Cost of DevSecOps: A Developer’s Time Assessment,” sponsored by JFrog, showed 50% of senior developers, team leaders, product owners and development managers experienced a significant increase in the number of hours spent weekly on software security-related tasks, detracting from their ability to innovate, build, and deliver new business applications,

New IDC InfoBrief Shows Growing Developer Focus on Software Security, Impacting Companies’ Competitive Advantage (Graphic: Business Wire)

"Securing the software supply chain already poses significant challenges for organizations, but it becomes more complex when multiple tools are used, forcing developers to toggle between multiple environments, leading to inefficiencies, wasted time, and increased risk,” said Asaf Karas, CTO of JFrog Security. “IDC’s survey creates a compelling case for companies to invest in streamlined security processes, tooling and training, to empower their developers to be more efficient and effective in protecting the software supply chain.”

Half of survey respondents said they spend an estimated 19% of their weekly hours on security-related tasks, oftentimes outside normal working hours, which could lead to a reactive approach to security rather than a proactive one. Other key findings from the IDC survey include:

• Chasing Ghosts: Eliminating False Positives: Developers spend 3.5 hours on average manually reviewing security scanning findings because of false positives and duplicates.
• Context Matters: 69% of developers agree or strongly agree that their security-related responsibilities require them to frequently switch contexts between various tools, slowing efficiency. Multitool context switching can also increase token usage for bypassing reauthentication per platform. Tokens can be helpful in application development but can also be quickly forgotten and leave backdoors in companies’ systems for attacks.
• Secrets are No Fun: Developers devote 50% of their time to understanding and interpreting secrets scanning results, making changes to code to remediate findings, and updating secrets management measures.
• Infrastructure Investigation: Infrastructure-as-Code (IaC) – used to automate the provisioning and management of IT infrastructure, such as servers, networking, operating systems, and storage – must be scanned every time code changes, with more than 54% of developers saying they run IaC scans weekly or monthly.
• SAST Isn’t a Blast: Despite static application security testing (SAST) tools being integrated to local development environments to provide findings as developers code, only 23% of developers are running SAST scans before deploying code into production, leaving a huge gap for malicious code to slip through.

"DevSecOps is not just a business imperative; it is the cornerstone of building the secure applications of the future. However, a significant challenge lies in overcoming inefficient, poorly implemented tools that squander developers’ time and inflate costs,” said Katie Norton, Research Manager, DevSecOps and Software Supply Chain Security at IDC. “To be successful, IT and software development team leaders must automate repetitive and time-consuming tasks, ensure DevSecOps tools deliver accuracy with minimal false positives, and provide ongoing access for developers to application security education and resources so they can keep pace with a rapidly increasing threat landscape."

The IDC InfoBrief surveyed senior developers, team leaders, product owners and development managers from companies in 20+ industries with 1K+ employees across the U.S., UK, France and Germany. For more insights from the IDC InfoBrief, "The Hidden Cost of DevSecOps: A Developer’s Time Assessment," (IDC #US52537524, September 2024) download the report.

Like this story? Tweet this: New @IDC survey finds that developers severely underestimate the time they spend performing #DevSecOps tasks, leading to hidden costs for their organizations. Read the full report: https://bit.ly/4feUtjl #DevOps #security #MLOps #softwaresupplychain

About JFrog

JFrog Ltd. (Nasdaq: FROG), is on a mission to create a world of software delivered without friction from developer to device. Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform is a single system of record that powers organizations to build, manage, and distribute software quickly and securely, ensuring it is available, traceable, and tamper-proof. The integrated security features also help identify, protect, and remediate against threats and vulnerabilities. JFrog’s hybrid, universal, multi-cloud platform is available as both self-hosted and SaaS services across major cloud service providers. Millions of users and 7K+ customers worldwide, including a majority of the Fortune 100, depend on JFrog solutions to securely embrace digital transformation. Learn more at www.jfrog.com or follow us on X @JFrog.

View source version on businesswire.com: https://www.businesswire.com/news/home/20241009432650/en/

Media Contact:

Siobhan Lyons, Sr. Manager, Global Communications, JFrog, siobhanL@jfrog.com

Investor Contact:

Jeff Schreiner, VP of Investor Relations, JFrog, jeffS@jfrog.com

Source: JFrog Ltd.

FAQ

How much do companies spend annually per developer on security-related tasks according to the JFrog-sponsored IDC study?

According to the IDC study sponsored by JFrog (FROG), companies spend an average of $28,000 per developer annually on security-related tasks.

What percentage of developers experienced an increase in time spent on security tasks, as reported in the JFrog (FROG) IDC study?

The study found that 50% of senior developers, team leaders, product owners, and development managers experienced a significant increase in the number of hours spent weekly on software security-related tasks.

How many hours do developers spend on average reviewing security scanning findings, according to the JFrog (FROG) sponsored IDC survey?

Developers spend an average of 3.5 hours manually reviewing security scanning findings due to false positives and duplicates, according to the IDC survey sponsored by JFrog (FROG).

What percentage of developers run SAST scans before deploying code to production, as reported in the JFrog (FROG) IDC study?

The study revealed that only 23% of developers run static application security testing (SAST) scans before deploying code into production, according to the IDC survey sponsored by JFrog (FROG).