Infrastructure as Code Security Insights
93% of people in a recent Snyk IaC survey said they’re still early in the IaC journey, but for the highest performers, the impact on reduced risk is significant. See the results and how you stack up below.
What does “best in class” IaC security look like?
We grouped respondents into three categories to see how their security results differ.
Those able to find and fix configuration issues the fastest were respondents treating IaC like other forms of code, subjecting it to continuous security checks from creation to deployment.
How quickly can organizations find and fix configuration issues?
How does your organization measure up?
Curious to see how your organization compares to these findings? Answer four short questions and we’ll show you! Your responses are anonymous – we won’t be shaming you!
How do you find out about security issues in your application and infrastructure?
Do you include IaC security and misconfiguration tests in your CI pipelines?
How long, on average, does it take your teams to find and fix security or misconfiguration issues?
What is preventing you from always integrating security checks into the IaC testing process?
A word about our survey
This vendor neutral research was independently conducted by Virtual Intelligence Briefing (ViB). ViB is an interactive on-line community focused on emerging through rapid growth stage technologies. ViB’s community is comprised of more than 2.2M IT practitioners and decision makers who share their opinions by engaging in sophisticated surveys across multiple IT domains. The survey methodology incorporated extensive quality control mechanisms at 3 levels: targeting, in-survey behavior, and post-survey analysis. The Calculated Margin of error at a 95% confidence level is 3.9%.
12%
16%
30%
31%
11%
Download the full report
The vast majority of our survey respondents are still early in their IaC adoption journey, so if you don’t think you’re in that top 7%, you’re not alone. Our full IaC Security Insights report has more details on what’s holding people back, and what they’re doing today, and how they’d like to improve.
Automate everything!
You consistently automate IaC security in all release pipelines
Classic security checks
You focus on testing deployed infrastructure, using classic tools like audits and pen testing
