Harness Report: AI-Assisted Coding Accelerates Development but DevOps Maturity Lags Behind
A new study by Harness surveying 700 engineering leaders reveals that AI-assisted coding is accelerating development velocity, but most organizations have failed to modernize their testing, security, and deployment pipelines to match. The report finds that 73% of teams lack standardized delivery templates, creating a widening gap between code production and delivery.
A sobering new report from Harness, based on a survey of 700 engineering leaders and practitioners, reveals a dangerous disconnect: while AI-assisted coding tools have dramatically increased the speed at which code is written, the DevOps infrastructure responsible for testing, securing, and deploying that code has not kept pace. The result is a growing "velocity gap" that is introducing more bugs, security vulnerabilities, and deployment failures into production.
Key Findings
The survey, conducted by independent research firm Coleman Parkes in February 2026 across the United States, United Kingdom, Germany, France, and India, paints a consistent picture across geographies. Among the most striking findings: 73% of respondents say "hardly any" of their teams have standardized delivery templates or "golden paths" — pre-configured, best-practice deployment pipelines that reduce human error.
Even more concerning, 51% of engineers who frequently use AI coding tools report experiencing more code quality problems than before adoption, and 53% report an increase in security vulnerabilities and incidents. The implication is clear: AI tools are making it easier to produce code, but without corresponding improvements in quality gates, that code is shipping with more defects.
The Speed-Quality Tradeoff
The report draws an analogy to automotive manufacturing: "Imagine a car factory that doubled the speed of its assembly line but didn't upgrade its quality inspection stations. You'd produce more cars, but you'd also ship more defects." In software, the equivalent is generating code faster without investing in automated testing, security scanning, and deployment guardrails.
Organizations that have invested in platform engineering — dedicated teams that build and maintain internal developer platforms — report significantly better outcomes. These teams are 3.2x more likely to have standardized delivery templates and 2.7x more likely to catch security issues before production.
Recommendations
The report recommends three immediate actions for engineering organizations: standardize delivery pipelines with golden paths that encode best practices, automate quality and security checks as mandatory pipeline gates rather than optional steps, and implement safety guardrails such as feature flags and automated rollbacks that limit the blast radius of defective deployments.
The full report, titled "The 2026 State of Software Delivery," is available for free download on the Harness website.
Related Articles
GitHub Expands Developer Platform with Actions Artifacts v5 and Copilot Extensions GA
GitHub has shipped Actions Artifacts v5 with immutable storage and artifact attestation for tamper-proof build outputs, alongside the general availability of Copilot Extensions that let third-party tools integrate directly into the Copilot chat experience. The platform also expanded GitHub Models with seven new providers.
Docker Engine 29.3 Ships with Native gRPC Support and BuildKit v0.28
Docker Engine 29.3.0 introduces native gRPC support on listening sockets, BuildKit v0.28.0, and a new bind-create-src option for flexible volume mounting. The release lowers the minimum API version to v1.40 for broader backward compatibility and fixes DNS configuration corruption during daemon reloads.
GitHub Adds Dependabot Pre-Commit Support and 28 New Secret Scanning Detectors
GitHub has shipped two major supply chain security features: Dependabot now parses .pre-commit-config.yaml files and opens PRs to update hook versions, while secret scanning gains 28 new detectors from 15 providers including Snowflake, Supabase, and Vercel. Push protection is now enabled by default for 39 secret types.