Tech Show Paris 2025: Day 1 DevOps Insights

At DevOps Live, discussions indicated that AI, observability, and security automation are reshaping how Europe delivers and operates software at scale.

– – – – – –

A New DevOps Mandate: Speed Without Compromise

Day 1 of the DevOps Keynote Theatre opened with a challenge to the discipline’s own buzzwords. The session “DevSecOps without the hype: how to industrialise security without slowing down delivery” brought together practitioners from Vestiaire Collective, Decathlon, ALD Automotive, and Women4Cyber to strip the concept down to its operational truth.

Moderator Anne Perrin framed it clearly: the goal was to share what works in real delivery environments, not in slides.

Nassim Hassairi (RSSI, ALD Automotive) explained that true DevSecOps begins by integrating security at the start of the lifecycle — a shift-left model that embeds authentication, logging, and audit mechanisms directly into development templates.

“At Eva, for every new development, we created an API template. This API template contains the entire authentication process, the logging process, and all the security features we want to implement at the API level. This template is reused by everyone,” said Hassairi.

Using this method, developers can focus on business logic rather than reinventing compliance.

The panel agreed that legacy systems remain the biggest drag on this ideal. Tony Ghilain (Decathlon) noted that many teams still lack pipelines or automated scans altogether:

“We often arrive at this highly critical system, the mainframe, etc., and we’re told we have to put it in DevOps. You ask again, where are the pipelines to add the SAS, the SCA? We’re told we don’t have them; it’s a legacy system, and we’re still delivering manually. So I think that to successfully implement DevSecOps in your DevOps program, we often need to already be in DevOps.”

Instead of “big-bang” overhauls, several participants advocated incremental remediation, fixing one risk category at a time and funding security as a standing budget line rather than a one-off project. Hassairi described it as “stopping the bleeding”, starting with high-impact basics like removing plaintext credentials and enforcing secret-vault storage.

Ayoub Houkmi (Vestiaire Collective) offered the most practical advice for teams buried under debt: Start by decommissioning what you don’t use. His teams run ‘clean-athons’,  two-day sprints dedicated solely to deleting obsolete code and outdated dependencies, freeing engineers from maintaining liabilities that no longer create value but still create risk.

By the end, the session’s consensus was pragmatic: secure delivery is an exercise in shared ownership. Security must design guardrails that developers actually want to use.

Balancing Velocity, Security, and Scale

The late-morning keynote, “Favoriser l’innovation des développeurs : trouver le bon équilibre entre rapidité, sécurité et mise à l’échelle,” extended this theme from philosophy to platform architecture.
Thibaut Genevois of Harness presented what he called a “modern software-delivery pipeline that unifies CI/CD, governance, and financial visibility.”

Genevois cited a Gartner statistic that resonated across the room:

“Developers, OPS, DBAs, the people who gravitate around the rescue team, spend 30 to 40 minutes on IT actions that don’t directly impact revenue growth, price reduction, or risk reduction. So they spend 60 to 70 minutes of their time on IT actions, but more specifically on IT-related ones. And the question is, where do we spend the most time in this delivered software?”

His core argument: automation has fragmented instead of simplifying delivery. Tool sprawl and duplicated scripts are slowing organisations down even as generative AI accelerates code creation. The result is what he called “the paradox of productivity” — we generate more code, yet ship slower, because our delivery pipelines haven’t evolved.

Genevois’s demonstration of template-based workflows illustrated a key shift for 2026: standardisation as velocity. By treating CI/CD pipelines as reusable, version-controlled templates rather than one-off scripts, platform teams can roll out secure and compliant delivery patterns across thousands of projects in hours.

Harness’s system uses a policy-as-code engine similar to OPA to prevent risky modifications: For engineers, the tangible takeaway was the rise of governed autonomy — developer self-service backed by automated controls. Templates and rule-based pipelines are becoming the real levers of both speed and reliability.

Observability Under Pressure: Visibility, Cost, and Control

At midday, Valentin Jacquemond and Nils Bunge from French start-up Tsuga delivered a data-driven wake-up call: observability is breaking under its own weight.

“What we’ve observed over the last five years is that, on average, your companies generate 30 years’ worth of revenue, but your IT budgets only increase by an average of 7% per year. This means that you start the year on January 1st, and the game is already lost.”

Their message was simple: the old promise of ‘observe everything’ no longer scales. The pair advocated object-storage-based observability, using columnar storage and caching to retain more telemetry at lower cost.

Beyond technology, Tsuga stressed governance, consistent tagging, retention, and ownership as the new differentiator. The lesson: Observability is shifting from data collection to data curation. The leaders of 2026 will be those who know which data matters, not just how to store it.

The Self-Service Trap: When Autonomy Kills Monitoring

Dylan Jamet (CBTW) used blunt data to expose how self-service monitoring can backfire. Jamet explored an example whereby out of 5,000 monitors, 914 have been paused for 30 days and 642 for 60 days. Surprisingly, most of these paused monitors still show an “OK” status (739 and 549 respectively) meaning roughly one in six monitors is silent and not alerting as expected.

“So what does that mean? It means that the developers deployed monitors because they wanted to, because they thought they would be useful, but that wasn’t the case. They’re there, but they’re useless, and they’ve been silenced,” said Jamet.

The result: alert fatigue, orphaned metrics, and 29 % quarterly cost spikes. Jamet urged teams to evolve toward a managed-service model, base monitoring standardised by platform teams, with advanced layers opt-in.

His takeaway was operational: autonomy works only with lifecycle controls. Define baseline templates, enforce tag hygiene, and automate cleanup before self-service turns into chaos.

AI-Augmented DevOps: Acceleration Without Losing Control

The afternoon’s headline panel on AI-enhanced DevOps examined how artificial intelligence is transforming software delivery without eroding accountability. Ardian’s Amir Hassanein described an AI agent that classifies incoming requests and generates tickets (around 80 so far) while keeping humans involved in validation.

At L’Oréal, Ismail El Maarouf outlined how the Beauty Genius platform uses MLOps to retrain and evaluate models with every release, a process he likened to industrialising trust.

Worldline’s Raphaël Semeteys reported that anomaly-detection models have cut detection time by a factor of five, while CloudBees’ Sylvain Deyris showcased an AI-driven test-selection tool that trimmed pre-integration from six hours to two. Moderator Agnès Seuret of AWS closed the session by stressing the need to balance grassroots innovation with strategic direction.

Together, the panellists painted a picture of DevOps’ next evolution — one defined by human-in-the-loop automation, where speed is matched by context and control.

Automating the Network Layer: Custom IaC for Scale and Control

Decathlon detailed how they rebuilt their GCP network baseline around a custom Terraform provider (Go) fronted by internal APIs and orchestrated with GCP Workflows, so product teams can deploy a compliant network stack in minutes without ticket hand-offs.

They moved away from a legacy Shared VPC model (quotas, coupling, overlap) to an “open-spoke” design: each project owns local networks; shared “routed” networks traverse managed hubs; NetBox serves as the source of truth/IPAM. The custom provider mediates permissions (users call the provider/API; strong service accounts do privileged work), bakes standards into resources (addressing, DNS, firewall/Cloud Armor), and hides complexity behind a single entry point.

Final Insight

For platform leaders, the competitive edge won’t come from more tools but from smarter orchestration of the ones already in play. From AI-assisted testing to secure-by-design containers, the new DevOps mandate is not to release faster — but to release wisely, where velocity, visibility, and verified trust meet.