Integrating Security into DevOps: Empirical Assessment of DevSecOps Adoption Barriers and Enablers in Financial Services Organizations
The integration of security practices into DevOps pipelines — commonly termed DevSecOps or "shifting security left" — has attracted significant practitioner interest, yet academic understanding of the organizational dynamics that enable or impede this integration remains nascent. This paper reports findings from a grounded theory study conducted across nine financial services organizations undergoing DevSecOps transformation. Data was collected through 64 interviews with security engineers, DevOps leads, compliance officers, and CISOs, supplemented by documentary analysis of security policy artifacts and incident logs spanning 24 months. Our analysis yielded a substantive theory of DevSecOps adoption organized around three core categories: Security-Development Trust Formation, Toolchain Convergence, and Regulatory Constraint Navigation. We find that the predominant barrier to DevSecOps adoption is not technical but relational: the adversarial framing historically embedded between security and development teams. Organizations that successfully dissolve this framing through shared ownership models and joint blameless post-mortems exhibit twice the rate of automated security gate adoption. The paper contributes an empirically grounded theoretical model and a set of practitioner interventions for accelerating DevSecOps adoption in regulated industries.