Platform engineering, which centralizes best practices and components for development teams, is gaining prominence as DevSecOps practices and frameworks become increasingly embedded across organizations. Platform engineering aims to normalize and standardize developer workflows by providing developers with optimized “golden paths” for most of their workloads and flexibility to define exceptions for the rest.
Gartner® predicts that “by 2026, 80% of large software engineering organizations will establish platform engineering teams as internal providers of reusable services, components, and tools for application delivery, up from 45% in 2022” [1]. Platform engineering allows organizations — especially larger organizations with many engineering initiatives happening in parallel — to scale DevSecOps principles and tooling more easily. This approach is incredibly important when businesses are pressured to do more with less.
Key benefits of platform engineering
Increase speed to market: Platform engineering promises to help organizations deliver better-quality software faster and more cost-efficiently. Building a platform engineering team will pay off over the long term, enabling large organizations to move quickly with less tooling, resulting in significant cost savings.
Reduce security and compliance risks: Less tooling and more normalized workflows reduce organizations' compliance overhead and potential attack surface. According to IBM’s Cost of a Data Breach Report, the global average data breach cost in 2023 was $4.45 million. Still, organizations that managed their attack surface effectively could contain breaches faster.
Improve developer experience: DevEx is a growing priority, with companies competing to attract and keep the best developer talent. Platform engineering teams can help improve the developer experience by building efficient, automated workflows or golden paths and lifting some manual, extraneous tasks from developers’ workloads. This simplifies their day-to-day, allowing them to efficiently build, test, and deploy applications and focus on more impactful, business-critical work.
Platform engineering best practices
Start with the culture
If “platform” describes what we should build, then “engineering” describes how it should be built. Too many organizations leap into buying and installing technology without considering how they’ll need to evolve their organizational culture to make the adoption a success.
Platform engineering teams should consider themselves product owners, with developers as their customers. They should conduct discovery to understand developers’ needs and then reach out to end users to help them become successful with the resources provided. This requires internal marketing, communication, and customer support skills, which are often lacking in technical teams.
The key here is a product-oriented mindset and culture, which allows platform engineering teams to focus on creating value for their end users (developers) by listening to user feedback and continuously iterating and improving their product (the developer platform). Leaders should create an environment where team members feel empowered to seek ways to help their specific (internal) customers. They’ll be focused on making it as easy as possible for people to consume their services — likely through self-service interfaces or programmable APIs.
Stay focused on delivering business value
When starting a platform engineering initiative, organizations may be tempted to look at highly productive teams and copy what they do. Unfortunately, there’s often too much initial emphasis on the team's structure or the tools it uses. These are often the results of a highly productive team, not the cause. Instead of team structure and tools, leaders should focus on the business outcomes they want to see and then identify the right tools and team structures to achieve those goals.
Define the goal of your platform engineering practice in terms of business impact. Developing software faster is great — but why? What business goal does it serve?
Increasing speed and agility, for instance, is a common goal — but there could be several business goals behind it. Slow time to market has an obvious opportunity cost, as organizations must make difficult choices about what products to prioritize. Organizations that can move more quickly are also better equipped to respond to fast-moving markets. And there are security implications — organizations must know they can respond quickly and efficiently if a security incident occurs.
Common productivity and efficiency metrics are helpful, but leaders should try translating those metrics into dollar values to clarify the business value. For example, suppose a platform engineering effort reduces the time a new developer takes to perform their first commitment to production. In that case, the organization is saving a certain percentage of that developer’s year-one salary and part of the salary of those around them who are helping them onboard. The organization will also likely increase retention, reducing the need for expensive hiring (including advertising, recruiters, and lengthy interview cycles).
Leaders can optimize platform engineering initiatives by staying laser-focused on business value to drive the right results.
Keep it measurable
It’s important to have metrics that help track the platform engineering team’s progress and understand how developers are using (or not using) the services provided. This allows for continuous improvement, identifies areas of success or need for additional resources, and helps with internal marketing efforts.
Some potential metrics to consider include:
-
Adoption rate: How many developers are actively using the platform?
-
Time to value: How long does it take for a new developer to start delivering code on the platform?
-
Community engagement: What percentage of components within the platform were provided by the community? (For example, when a team develops a new CI job that could benefit others, do they share it with the platform engineering team for broader application and maintenance?)
Build for everyone
The early adopters of a developer platform might be the most visible (and vocal) early in the process. However, remember that early adopters — who typically make up less than 20% of an organization — may have very different needs than most users who will eventually leverage the platform. As you define the golden paths that make sense for your organization, ensure you’re building for the majority, not just early adopters.
One common golden path worth investing in early is an end-to-end CI/CD pipeline supporting a particular type of workload on one set of target platforms (such as Kubernetes). Once this base workload is supported, it provides a strong foundation for others and confidence that the platform can deliver value. Define your organization’s priority golden paths regarding the business outcomes they enable.
The DevSecOps platform: A foundation for platform engineering
A DevSecOps platform provides one user interface, a unified data store, and security embedded within the DevSecOps lifecycle. With a DevSecOps platform, organizations can build a foundation for platform engineering with workflows-as-a-service for the entire software development process.
Here are a few critical elements of a DevSecOps platform that set teams up for success with platform engineering:
-
Planning and collaboration: Platform engineering won’t work without transparency. Bringing everyone into the same platform streamlines communication and helps developers stay in the loop on strategy and scope — enabling more efficient planning, building, testing, securing, deployment, and monitoring of code.
-
CI/CD and orchestration: Orchestration sits at the heart of platform engineering. A platform helps developers check code quality and get it to production. It also provides a templating mechanism to ensure common best practices are baked in, and every change goes through a consistent quality process.
-
Developer experience: DevEx is all about simplifying developers’ day-to-day by automating manual tasks and abstracting away unnecessary decisions. With a DevSecOps platform, all code is in a single place, making it easier for developers to find what they need with minimal context switching. In addition, providing developers with reusable templates and AI-powered features such as code suggestions and code explanations removes obstacles so developers can onboard quickly and start creating value immediately.
-
Integrated security: With a DevSecOps platform, automated security scanning ensures that all code meets a baseline policy — and, more importantly, developers have self-service access to that data. They're not waiting until the day of a production rollout to find out that the security team has found a critical vulnerability.
-
Metrics and analytics: For a platform engineering initiative to be successful, organizations need to identify the business goals behind the project and be able to monitor their progress towards those goals. Dashboards and analytics that pull data from across the software development lifecycle enable organizations to easily track key metrics, assess the impact of process improvements, and drill down into roadblocks. That empowers leaders to quickly identify trends and bottlenecks so they can focus efforts on at-risk projects.
Learn more about how GitLab accelerates software development by providing DevSecOps teams with a single self-service portal for tools and workflows — reducing cognitive load and making software delivery more scalable.
[1] Gartner, Top Strategic Technology Trends for 2024, Bart Willemsen, Gary Olliffe, and Arun Chandrasekaran, 16 October 2023. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.
2024 Global DevSecOps Survey
Read our survey findings from more than 5,000 DevSecOps professionals worldwide for insights on how attitudes towards security, AI, and developer experience are evolving.
Read the report