DevOps has come a long way since Puppet launched its first State of DevOps Report in 2011. Back then only 9% of respondents even knew what DevOps was. However, even today a majority of organizations are stuck in the middle, unable to reach the high-performing organizational levels. This is especially true for security, where the DevOps movement has created a culture of autonomy, but those autonomous units don’t necessarily do what’s best, or most secure, for the organization. Automation certainly helps, but it’s only a piece of the puzzle.