Why containers are no longer the biggest software security challenge

Containers are no longer the new story. For most customers, containerization is already embedded in the way software is built and delivered.

More than half of organizations now use containers for most or all of their production applications, according to the Cloud Native Computing Foundation. That means the challenge for partners is no longer persuading customers to adopt containers, but helping them ensure the way software is being developed today does not create security and governance problems later. Development teams are under pressure to move faster than ever. They are using more open-source components, pulling in code from multiple sources, and increasingly using AI to help write, test, and review software.

Docker's Latest State of Application Development Report found that 64% of developers were already using AI to support coding, documentation, and research.

None of that is a problem in itself. The risk arises when security and governance don't keep pace. Small compromises that seem reasonable at the time can gradually introduce bigger problems. A team takes a shortcut to hit a deadline. Someone pulls in a component that hasn't been properly checked. Neither looks particularly serious in isolation, but together they can leave customers exposed.

A bigger conversation

This is why the conversation is no longer just about containers. It is about how modern software is being built, where code and components are coming from, and what controls are in place around AI use.

AI is a good example of this. It's helping development teams move faster, but it's also changing the questions organizations need to ask. Where did that code come from? Has anyone reviewed it properly? And were your security policies written for the way development teams are working today, or for an approach that's already changed?

The issue does not stop with developers. Across the wider business, employees are starting to use AI tools to speed up everyday work, creating a broader governance challenge.

The question is not simply whether AI can improve productivity, but whether organizations have the guardrails and visibility to ensure it is being used safely. The rapid evolution of AI agents has only added to those concerns. If AI agents can act in ways their users did not expect, organisations need to think more carefully about runtime visibility, access boundaries and what happens if those systems step outside the rules they were meant to follow.

That is exactly where partners should be adding value.

Most customers will not ask how to reduce security debt or tighten AI governance. They will ask how to modernize applications, speed up development, or get more value from AI.

The opportunity for the channel is to help them achieve those goals without creating unnecessary risk at the same time. That starts with asking the right questions. These are not just technical questions. They are business questions because the impact of getting them wrong is operational, financial, and reputational. Partners don’t need to be software developers, but they do need to understand how software is being built and how AI is being used today.

Customers are looking for help to move quickly without losing control. In that environment, experience, judgement and the ability to ask the right questions are just as valuable as the technology itself.

The wider issue is trust. Modern applications depend on increasingly complex software supply chains, and AI adds another layer of uncertainty if businesses do not know what tools are being used, what data they can access, or how decisions are being made. Security cannot begin once something is already live. By then, many opportunities to prevent problems have already passed.

We know that customers will always want to move faster. That’s not going to change. The partners that stand out will not just be the ones recommending the latest tool. They’ll spot risks early, ask the questions their customers haven’t thought about yet, and help to build security and governance into the process from the start.

Sometimes that simply means asking a few awkward questions before anyone starts building. Those conversations may not always be comfortable, but they are far easier and less expensive than trying to fix problems once software is already live.

Five questions every partner should ask

• Where are your container images coming from, and who is verifying them?
• How much third-party or open-source code is making its way into production?
• Has AI changed the way developers write, review, or ship code?
• Are employees using AI tools outside development without clear guardrails in place?
• If an AI agent behaved unexpectedly, would you have the visibility to detect it quickly?

Ultimately, the partners that add the most value will be those who help customers move faster without losing control. As software development evolves and AI becomes more deeply embedded, that means identifying risks early and making security and governance part of the process from the outset.