How are you measuring platform engineering success?
DORA metrics, developer surveys, time-to-first-deploy, cost per service? What convinced leadership the platform team is worth it?
Evaluating DevOps & Platform Engineering this quarter? This page brings together what changed, which companies are most active, what practitioners are asking and how to build a shortlist.
Internal developer platforms, infrastructure as code, CI/CD and release tooling that let teams ship faster with guardrails.
Start with the news. These are the DevOps & Platform Engineering stories getting the most attention right now, so you know what has shifted before you talk to anyone.
Enable AI agents to securely access your resources while operating within enterprise identity, access, and audit controls.
Why it matters, from the Techarda editors: Most agent pilots still run on shared service credentials. Putting agents behind the same identity, session and audit controls as people is the pattern security teams will ask for before agents touch production.
Harness Cosmos Software Factory Agent automates engineering from idea to code, connecting code context with delivery, security, testing, and production workflow | Blog
External Interfaces let you build standalone apps on Port's catalog, where users log in with Port and keep their own permissions.
It’s been a weirdly great time to be building software. We’ve never had so many tools that help us get things done: endless cloud providers, regions, deployment frameworks, and now AI agents that can actually build and manage infrastructure for us. That’s part of what made this past week feel so big. TypeSafe AI opened early access to Jev, their SystemOne model, and we here at…
Step-by-step: connect GitHub, let Harness AI generate a CI pipeline for your Java project, add Docker push. Full pipeline ran in 3 minutes. | Blog
You do not have to migrate away from Jenkins to modernize. Learn how CloudBees helps scale software delivery without the cost and risk of rip-and-replace.
A first deployment walkthrough for Harness CD using a real sample app. | Blog
TL;DR Milestone : Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale : Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter's malicious packages, although its share declined from 96.6% in Q2. Behavior : Among packages containing…
Those stories keep returning to the same names. These are the companies we track in this category; each profile has its news, solutions and published reviews.
GitLab is a DevSecOps platform company whose single application covers source code management, CI/CD, security testing and software delivery, with AI features under GitLab Duo. Available as SaaS or self-managed and built on an open core model, it serves development and platform teams. GitLab Inc. was founded in 2014, operates all-remote and is listed on Nasdaq.
GitHub is a software development platform for hosting Git repositories and collaborating on code, used by developers, open source projects and enterprises. Its products include GitHub Actions for CI/CD, GitHub Copilot for AI-assisted coding, GitHub Advanced Security and Codespaces. Founded in 2008 and based in San Francisco, GitHub has been owned by Microsoft since 2018.
Atlassian is a software company founded in Sydney, Australia, in 2002 by Mike Cannon-Brookes and Scott Farquhar. It sells team collaboration and software development tools including Jira, Confluence, Jira Service Management, Bitbucket, Loom and the Rovo AI platform, delivered mainly through Atlassian Cloud. Atlassian is listed on Nasdaq and redomiciled to the United States in 2022.
JFrog is a software supply chain company whose JFrog Platform manages and secures software packages and binaries from development to production. Its products include JFrog Artifactory, a universal artifact repository, JFrog Xray and Advanced Security for vulnerability and licence scanning, JFrog Curation and JFrog ML. Founded in 2008 in Israel, JFrog is headquartered in Sunnyvale, California, and listed on Nasdaq.
Harness is a US software delivery platform company offering AI-assisted continuous integration, continuous delivery and GitOps, feature management, cloud cost management, security testing, chaos engineering and an internal developer portal. It serves engineering and platform teams in enterprises. Founded in 2017 by Jyoti Bansal, co-founder of AppDynamics, Harness is headquartered in San Francisco and privately held.
CircleCI is a US continuous integration and delivery (CI/CD) company founded in 2011 and headquartered in San Francisco. Its cloud and self-hosted server platform automates building, testing and deploying software, with configuration as code, orbs for reusable configuration, and support for Linux, macOS, Windows, Arm and GPU execution environments.
HashiCorp is a US infrastructure software company known for Terraform for infrastructure as code and Vault for secrets management, alongside Consul, Nomad, Packer, Vagrant and Boundary. It offers these through HashiCorp Cloud Platform and self-managed enterprise editions. Founded in 2012 by Mitchell Hashimoto and Armon Dadgar in San Francisco, HashiCorp was acquired by IBM in 2025.
CloudBees is a US software delivery company founded in 2010. It sells enterprise CI/CD and DevSecOps products built around Jenkins, including CloudBees CI and CloudBees Unify, with capabilities for release orchestration, feature management and compliance. CloudBees is a major contributor to the Jenkins open-source project and serves large enterprises with governed software delivery at scale.
Octopus Deploy is an Australian software company that makes a continuous delivery and release management platform for automating deployments and runbooks across on-premises, cloud and Kubernetes environments. Its products include Octopus Deploy, available as Octopus Cloud or self-hosted Octopus Server, and Codefresh, a GitOps platform built on Argo CD. Founded in 2012 by Paul Stovell, it is headquartered in Brisbane.
Pulumi is an infrastructure-as-code company headquartered in Seattle, Washington, founded in 2017 by Joe Duffy and Eric Rudder. Its open-source Pulumi IaC tool lets engineers define cloud infrastructure in general-purpose languages such as TypeScript, Python, Go, C# and Java. The commercial Pulumi Cloud adds state management, policy, secrets management (Pulumi ESC) and platform engineering features.
Buildkite is a software delivery platform company founded in Melbourne, Australia, in 2013. Its hybrid CI/CD platform runs pipelines on agents hosted in customers' own infrastructure or on Buildkite-hosted agents, and its product suite includes Pipelines, Test Engine and Package Registries. It is used by engineering teams that need to run large, fast and secure builds.
LaunchDarkly is a feature management and experimentation platform that lets software teams release features behind feature flags, roll out changes progressively, run experiments and roll back without redeploying code. It provides SDKs for major languages and serves engineering and product teams at enterprises and software companies. Founded in 2014 by Edith Harbaugh and John Kodumal, it is headquartered in Oakland, California.
Spacelift is an infrastructure-as-code orchestration platform used by platform engineering and DevOps teams to automate, govern and audit infrastructure workflows. It supports Terraform, OpenTofu, Pulumi, AWS CloudFormation, Ansible and Kubernetes, with policy-as-code, drift detection and self-service provisioning. Spacelift is a privately held, venture-backed company and a founding supporter of the OpenTofu project.
env zero, formerly env0, is an infrastructure-as-code automation, governance and cloud asset management platform for platform engineering and DevOps teams. It manages Terraform, OpenTofu, Pulumi, CloudFormation and other IaC workflows with self-service environments, policy as code, cost controls and drift detection, and added cloud asset inventory through its March 2026 merger with CloudQuery. env zero is privately held.
Humanitec is a Berlin-based platform engineering company that provides the Humanitec Platform Orchestrator, a backend for building internal developer platforms that standardises how applications and infrastructure are configured and deployed. It created Score, an open source workload specification, and organises PlatformCon, a platform engineering conference. Humanitec serves enterprise platform teams and is privately held.
Port is a software company that makes an internal developer portal for platform engineering teams. Its product combines a software catalogue, self-service actions, scorecards and dashboards so developers can find services, provision resources and follow engineering standards. Port was founded in 2022 by Zohar Einy and Yonatan Boguslavski and has roots in Israel.
Cortex is an internal developer portal company founded in 2019 and based in San Francisco. Its platform catalogues an organisation's services, owners and dependencies, and uses scorecards, initiatives and workflows to track engineering standards such as production readiness, security and reliability. Cortex serves platform engineering and developer experience teams and is a privately held, venture-backed company that went through Y Combinator.
Perforce is a DevOps software company offering version control, infrastructure automation, testing, static analysis and test data management tools. Its portfolio includes P4 (formerly Helix Core) version control, Puppet, Delphix, BlazeMeter, Perfecto, Klocwork and Helix ALM, used heavily in game development, embedded and regulated industries. Founded in 1995 by Christopher Seiwald, Perforce is privately owned by Clearlake Capital and Francisco Partners and headquartered in Minneapolis.
Progress Software is a US software company headquartered in Burlington, Massachusetts, founded in 1981. It sells infrastructure and application development software including the Chef DevOps automation suite, OpenEdge, Telerik and Kendo UI developer tools, MOVEit managed file transfer, Sitefinity, MarkLogic and ShareFile. Progress is listed on Nasdaq and grows substantially through acquisitions of established software products.
Sonatype is a US software supply chain security company founded in 2008 and based in Fulton, Maryland. It develops Nexus Repository, a widely used artifact repository manager, and the Sonatype Lifecycle, Firewall and SBOM Manager products for open source governance and dependency risk. Sonatype is the steward of Maven Central, the main public repository for Java components.
Vendor news only tells you half of it. This is what people working in DevOps & Platform Engineering are discussing and asking each other.
DORA metrics, developer surveys, time-to-first-deploy, cost per service? What convinced leadership the platform team is worth it?
Golden paths, templates, portals, self-service environments. Which parts get used every day and which became shelfware?
With the news, the companies and the open questions in view, pick three to five companies whose products match your problem, read their recent stories and put your remaining questions to the community before you speak to sales.
If you want more background, here is more of the recent coverage.
If you run application security across more than one top-level group, getting a single organization-wide view of your risk has meant manually pulling together data. That is operational work rebuilt in spreadsheets and one-off scripts every time someone asks. This manual work is easy to get wrong, and is often out of date the moment it is published. Every hour spent assembling that view is an hour…
Approvals from anywhere, CloudBees in Claude, and Jenkins ready for AI agents.
See how SPS Commerce built an AI software factory that moved 500+ Jira tickets from plan to pull request with zero incidents.
With ESC Approvals , you can propose, review, and apply environment changes with change requests. Until now, an environment could only have one open change request at a time. If a teammate’s change was waiting for review, others were blocked from opening change requests. Today, multiple people can open change requests on the same environment at the same time. A platform engineer can rotate…
TL;DR: we are releasing a new major version of the Google Cloud provider. To migrate, ask Neo or your coding agent to run the Pulumi provider-upgrade skill ( how to use it ) or follow the v10 migration guide . We are happy to announce the next major version of the Pulumi Google Cloud provider. This release is based on the new v8 major version of terraform-provider-google (see also the upstream v8…
Compare Teamwork Graph vs Port on deployments, incidents, service ownership and ontology, and see which fits a heterogeneous SDLC.
Secure open source consumption requires more than an approved package registry or a scan before release. Teams need to control where components come from, evaluate them when they are selected, choose suitable versions, and keep track of the m as new risks emerge .
Attackers disguise malicious packages as ones you trust. In June 2026, GitLab researchers found five malicious PyPI packages , four of them typosquats of Flask, Requests, and NumPy, that run at install time and steal CI/CD credentials. Additionally, AI coding agents now add open source dependencies on their own, often unreviewed, so developers don't have oversight into what packages may…
At Transcend, we made over a dozen announcements across all four layers of our architecture for agentic software engineering: agent orchestration, data and context, DevOps workflows, and governance and security. Watch the replay , or read on for what shipped and how to turn on the new capabilities. At a glance What we launched Release status What it does Goal-driven flows ( /goal ) GA this month…
Every software build is assembled from open source packages, base images, and libraries, with your code on top. When one of those components is missing or has drifted, the build fails. At agent speed, those failures multiply, and no team can clear them as manual exceptions. Project-by-project registry sprawl makes it worse because retention rules, storage limits, and publish access all live…
Discover how software delivery knowledge graphs unify fragmented SDLC data, enable schema-as-code, and power deterministic AI reasoning. | Blog
How Port split its integration pipeline so each step can scale, retry, and fail on its own and how that cut multi-hour syncs.
GitLab's engineering team builds a lot of our own internal tooling, but one platform in particular forced us to rethink how we handle authorization: our internal GRC tool that serves two very different customer bases under one roof, our Security Compliance team and our Internal Audit team. If you're building or maintaining an internal Django tool that's starting to serve more than one audience, …
The Git project recently released Git 2.56.0 . Let's look at some of the highlights of the release, including contributions from the Git team at GitLab. What's covered: Git Merge 2026 and schedule for Git 3.0 git-history(1) learns drop git-branch(1) learns to delete merged branches git-refs(1) learns to modify refs Google Summer of Code 2026 Linearizing history with git-replay(1) Making the…
Rebuild AI API classification with Jev to cut costs, reduce latency, improve calibration, and make production decisions more efficient without sacrificing accur | Blog
What the JFrog Agent Skills Registry does, the problems it solves, where it fits in an Agentic SDLC stack, and its alternatives.