Updated 2026-10-04 · Software delivery

DevSecOps
maturity and governance statistics.

A source-first view of control coverage, exception discipline and the freshness of operating evidence. Published findings provide context; the measurement framework shows what to calculate inside your own environment.

01 / Published evidence

What the public data says.

Each figure links directly to the organization that published it. Vendor telemetry and community surveys are labelled rather than blended into one invented industry average.

≈$2M

lower breach cost with extensive security AI and automation

IBM reported average savings of almost $2 million compared with organizations not using those capabilities.

IBM 2026 Cost of a Data Breach · 2026 ↗
81.5%

of contributions occurred in private repositories

GitHub’s dataset shows most day-to-day organizational development happens privately.

GitHub Octoverse 2025 · 2025 ↗

02 / Your baseline

Measure the system you actually run.

Use these formulas consistently for at least one complete operating cycle. Keep scope, exclusions and collection dates beside the result.

01

Automated control coverage

Automated controls ÷ applicable controls × 100

Use one stable denominator and record exclusions.
02

Median exception age

Median days an approved exception remains open

Use one stable denominator and record exclusions.
03

Evidence freshness

Evidence items inside their refresh window ÷ all required items × 100

Use one stable denominator and record exclusions.

03 / Interpretation

A number without a denominator is decoration.

Segment results by environment, workload owner and business criticality. A falling average can hide one critical service getting worse; a rising count can simply reflect better discovery.

  • Record the source system and collection window.
  • Separate discovered, in-scope and actively managed populations.
  • Keep medians and tail values where averages hide risk.
  • Annotate architecture, policy and tooling changes.
  • Recalculate after remediation instead of closing on intent.

Related benchmarks

Look at the adjacent signal.

Software delivery

adoption and scale

Continue with the how widely the capability is used and how quickly its footprint is growing view.

Software delivery

security risk

Continue with the exposure, attack paths and the speed at which material findings are closed view.

Software delivery

cost and efficiency

Continue with the unit economics, waste and the engineering effort needed to operate the capability view.

Want these numbers from your cloud?

Gritt can map the data sources, calculate a defensible baseline and implement the changes behind it.

Build the baseline →