Security Is a Delivery Accelerator, Not a Gate

The 2025 DORA report found that most developers now use AI tools and individual productivity is up, yet organizational delivery metrics remain flat. AI acts as an amplifier: it magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones. The tools aren't the bottleneck. The underlying practices are. Security is one of those practices. DORA's core capability model includes pervasive security : integrating security into daily development work rather than treating it as a final gate. Their research shows high-performing teams spend significantly less time remediating security issues. That's time returned to shipping features. The report is blunt: AI productivity gains are "swallowed by bottlenecks in testing, security reviews, and complex deployment processes." Automate the security, and you remove a bottleneck. What this looks like in practice This past week I needed to deploy and integrate a new API across two cloud providers. Nobody asked for fully