Report > State of DevOps Report: AI in Testing Edition 2026

Chapter 5: Governance and Compliance in Testing

As delivery speed increases, governance maturity becomes a differentiator. This chapter benchmarks compliance automation and secure-by-default adoption and summarizes the most common barriers teams report. 

Back to top

Automating Compliance 

Manual compliance checks are a bottleneck, creating risk and leaving organizations vulnerable to regulatory breaches in the rush to release. 

Benchmark 

39% report fully automated compliance workflows. 47% report manual or partially automated processes. 

Back to top

What it means 

Manual steps can increase cycle time and risk under high-velocity delivery, especially if evidence capture is inconsistent.

Recommendation 

Prioritize automation of policy checks and evidence capture within CI/CD so audit readiness is continuous, not periodic.

Back to top

Secure-by-Default Practices

Security is increasingly shifting left. Despite this progress, challenges remain.  

Benchmark 

52% report secure coding practices embedded in CI/CD pipelines. 50% report security practices embedded in code review. 49% report extension into runtime or production environments. 

Back to top

Barriers

44% cite limited skills or training. 39% cite time pressure. 

What it means 

Shift-left progress is meaningful, but teams still need enablement and low-friction controls to avoid security regressions under time pressure. 

Recommendations 

  • Automate Compliance Workflows: Replace manual checks with fully automated compliance workflows to remove bottlenecks and reduce the risk of regulatory breaches during rapid release cycles. 
  • Embed Security Early: Adopt a "secure-by-default" posture by integrating security practices into the earliest stages of the CI/CD pipeline (Shift-Left), mitigating risk without compromising release velocity. 

Service Virtualization for Scalable Testing: How Enterprise Teams Test the Untestable

Get eBook