Organizations can increase employee productivity and earn a better return on their security investments by shifting cloud security left at the infrastructure and application layer, according to Palo Alto Networks.

The vendor’s State of Cloud Security Report 2022, which surveyed more than 3,000 security, IT, and development professionals, found that smart investments in cloud security drive better business outcomes. And it also provides “real-world data points” that link automation and DevSecOps with stronger security posture, said John Morello, Palo Alto Networks VP of product for compute.

For example: organizations that implemented a high level of security automation were two times more likely to have low friction and strong posture than their counterparts with low levels of security automation.

“It’s not optional to focus on automation and shifting security left,” he said. Organizations that integrate security into the build process instead of thinking about security as something that happens after the application is deployed report business benefits beyond better security Morello added, pointing to a couple other statistics from the report.

Organization with tightly integrated DevSecOps principles were more than seven times likely to have strong or very strong security posture. They were also more than nine times more likely to have low levels of security friction.

“It’s a matter of having a real cultural shift and/or an operational shift about how you do business,” Morello said. “And I think the more that we can show the benefits of that with data, the better it is and easier it is for people to make that case within their organizations.”

In addition to reporting lower levels of security friction, organizations with strong cloud security posture reported other benefits to their workforce including better productivity and job satisfaction. In fact, 80% of those with strong cloud security posture reported increased workforce productivity.

This points to the efficiency gains of building security into the early stages of development, Morello said.

“It’s not just a security benefit, but a real operational benefit to move that enforcement and checking as early in the lifecycle as possible,” he said. “You’re able to find those problems and inform people — potentially even fix those problems early enough so that they don’t get into production.”

This leads to happier developers, business users, and customers, Morello added. “If you don’t do that shift-left approach, your developers end up being really frustrated with having to retrofit problems later, and your business users that depend on those developers to be building software for them and their customers get frustrated because of delays and features that don’t work because of the security requirements.”

The report also found organizations that spend more on security have better security postures. More than two-thirds with strong or very strong security posture invested 16% or more of their cloud budget on security. Among companies with weak or very weak security posture: less than one-fifth spent the same percentage of their cloud budget on security.

Additionally, the strong security posture group plans to increase its security spending: 71% of organizations with strong or very strong security posture plan to spend 16% or more of their cloud budget on security over the next 12 months compared to only 46% of the weak or very weak security posture group.

“There is return on investment with security, both in terms of protection and risk mitigation, and also your ability to innovate and to maintain your position in the market or grow your market share,” Morello said.

And although the whole software-eating-the-world concept gets overplayed, “the reality is that if you look across any industry and vertical, software is becoming an increasingly vital part of the way that everybody does business,” he said. This means that securing code earlier in the development process allows companies to ship software faster and provide better services and experiences to customers and employees, Morello added.

“Security is not just a cost,” he said. “If you do it well, it can be transcendent in that it can be about more than just protecting you. It can help you achieve your business outcomes more efficiently because you’re able to operate faster and with greater automation.”