Engineering Maturity Models for Regulated Financial Services

Narrative

Analyst and market coverage of engineering maturity converges on a small set of durable reference points, with the DORA (DevOps Research and Assessment) programme dominating the outcome-metrics conversation. The 2024 Accelerate State of DevOps Report, the tenth in the series, drew on more than 39,000 professionals globally and confirmed that its four key metrics, introduced in 2013, remain the industry benchmark for software delivery performance. The 2025 State of AI-assisted Software Development report marked a significant methodological break: DORA removed its long-standing elite/high/medium/low performer clusters in favour of seven multidimensional team archetypes, and added a fifth core metric alongside the original four. Google Cloud's own account of the 2025 report states plainly that AI amplifies whatever already exists in a team, and that without strong automated testing and mature version control, rising change volume from AI-assisted coding increases software delivery instability even as throughput rises, a finding independently echoed by Faros AI's telemetry study of over 10,000 developers showing individual output gains without matching organisational delivery-metric gains.

Gartner's platform engineering research functions as a de facto capability-maturity ladder even though it is framed as trend analysis rather than an assessment instrument: its widely cited prediction that 80% of large software engineering organizations will establish dedicated platform teams by 2026, up from 45% in 2022, has been used by vendors and practitioners as a benchmarking anchor, and the 2025 DORA report claims actual platform adoption has already reached nearly 90%, a year ahead of Gartner's forecast. Gartner's 2025 Market Guide for Internal Developer Portals explicitly warns of "Backstage disillusionment," noting that organisations misconstrue Backstage as a ready-to-use portal when it in fact demands considerable in-house software engineering skill to operate, a caution directly relevant to a bank deciding whether to build or buy a scorecard and catalogue layer. Separately, Gartner's Market Guide for Value Stream Delivery Platforms projected that 60% of organisations would move from point solutions to value stream delivery platforms by 2024, up from 20% in 2021, framing VSM/VSDP tooling as a governance and compliance-integration layer rather than a pure productivity play.

McKinsey's Developer Velocity Index, first published in 2020 and still actively marketed as a benchmarking survey across 13 capabilities and 46 performance drivers, has drawn sustained and specific practitioner pushback since its 2023 relaunch as "Yes, you can measure software developer productivity." Critics including the Pragmatic Engineer newsletter and LeadDev argued the added McKinsey metrics (Developer Velocity Benchmark Index, Contribution Analysis, Talent Capability Score) add little beyond DORA and SPACE and risk being gamed or misapplied by CFOs unfamiliar with engineering nuance; this is a rare case of a named vendor framework being publicly contested rather than merely adopted. On the regulatory side, coverage of the EU Digital Operational Resilience Act (DORA regulation, distinct from the DevOps research programme) confirms it entered into application on 17 January 2025 after being enacted in January 2023, requiring ICT logging, monitoring and incident-response capability that vendors like Microsoft and JFrog have mapped into cloud and DevSecOps product positioning, though these mappings are vendor compliance guides rather than independent assessments. Independent practitioner evidence specific to regulated finance is thin in analyst coverage; the clearest named case is Swiss financial infrastructure firm SIX, whose head of software development described a five-plus-one-dimension DevOps model (skills, organisation, process, infrastructure, architecture, plus mindset and attitude) used to break down silos between IT and the business, reported via InfoQ rather than a vendor-commissioned study.

Forrester's contribution centres on its DevOps Platforms Wave (most recently Q2 2025, succeeding what it previously scoped as Integrated Software Delivery Platforms) and an older, still-referenced continuous-deployment maturity self-assessment built around four competencies: process, structure, measurement and technology. Forrester's broader financial-services research (Digital Banking Experience Report, bank future-readiness surveys) tracks digital and AI maturity self-classification, with 58% of surveyed banks placing themselves in the top three tiers of digital maturity in 2023, but this is self-reported survey data rather than telemetry-verified capability measurement, and Forrester itself flags in its DevOps blog category that AI code-generation platforms are "collapsing the SDLC" in ways that outpace existing governance frameworks. Across all sources, the pattern is consistent: outcome metrics (DORA, and by extension SPACE-influenced derivatives) are treated as the credible, contestable, evolving layer, capability ladders (Gartner platform engineering stages, McKinsey DVI) are used more for peer benchmarking and vendor positioning than independent audit, and genuinely independent, regulator-grade evidence from named banks or insurers is scarce in analyst literature compared to the volume of vendor and consultancy material.