DORA Report: AI Adoption Hit 90% in 2025

AI Adoption Is Now the Default

Google’s 2025 DORA report says the software industry has crossed a line: 90% of survey respondents report using AI at work. That is not a pilot program anymore. It is the default workflow for most teams.

The same report adds a second point that matters just as much for security teams: more than 80% believe AI has increased their productivity, yet 30% report little or no trust in the code generated by AI. That split tells the real story. Adoption is high. Confidence is not.

DORA’s 2025 research is not a quick survey. It is based on more than 100 hours of qualitative data and survey responses from nearly 5,000 technology professionals worldwide. That scope matters because it shows the pattern is broad, not anecdotal.

For security teams, the key message is simple: AI is not just another tool in the stack. DORA says AI’s primary role is an amplifier. It magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones. That means strong review habits, clear ownership, and good platform foundations matter more, not less.

---

What the 2025 DORA Report Found

The report’s clearest finding is that AI use is already widespread. Google Cloud says 90% of survey respondents use AI at work. It also says more than 80% believe AI has increased productivity.

That sounds like a clean win until you read the trust data. 30% of respondents report little or no trust in AI-generated code. So teams are using AI heavily while still treating its output with caution. That is a healthy instinct, but it also means the review burden is not going away.

The report also frames AI as a force that magnifies what already exists. In strong organizations, AI speeds up good habits. In weak ones, it speeds up bad ones. If a team already ships with tight code review, good test coverage, and reliable platform support, AI can help. If a team already cuts corners, AI can multiply those shortcuts.

This is why the report should matter to anyone responsible for secure delivery. The danger is not that AI writes code. The danger is that AI writes code inside a process that was already fragile.

---

Why AI Changes Software Risk

The report’s language points to a systems problem, not a model problem. AI magnifies both performance and dysfunction. That means a secure team cannot stop at tool approval or policy language. It has to look at the whole delivery pipeline.

When AI is used inside a strong system, teams may get faster diffs, quicker prototypes, and better throughput. But the same speed can also increase the rate at which low-quality code reaches review. If reviewers skim because AI already “did the first pass,” then the team may miss the exact bugs it wanted to prevent.

The opposite is also true. Teams with strong controls can use AI safely because they already know where the guardrails are. That includes branch protections, required reviews, test gates, dependency checks, and clear ownership for deployment decisions.

If you want a deeper checklist for that layer, our piece on AI coding tools and AppSec risk breaks down what to review before AI code reaches production.

The report also aligns with a broader pattern we have covered before: teams that do better with AI usually have better foundations before they adopt it. That same idea shows up in platform engineering for enterprise web development ROI, where internal platforms turn individual speed into organization-wide reliability.

---

DORA AI Adoption and Platform Teams

The broader DORA materials show that AI success depends on the rest of the delivery system. Google Cloud says 90% of organizations have already adopted internal platforms, and 76% now have dedicated platform teams.

That combination matters because AI tends to expose weak workflows fast. If developers can generate code quickly but still have to fight slow environments, unclear build steps, or broken deployment paths, the productivity gain gets absorbed by friction. A good platform turns AI output into shipped software. A poor one turns it into local momentum with no system-level gain.

Google Cloud also says the DORA AI Capabilities Model identifies seven foundational capabilities. That is a useful clue. The report is not arguing for one magic AI policy. It is arguing for a set of connected capabilities that make AI useful without making delivery chaotic.

For many teams, the question is not whether to adopt AI. It is whether the platform is ready for the volume AI creates. If your internal platform is weak, adding AI can increase the amount of code without increasing the quality of the path that code takes to production.

---

How to Respond to the 2025 DORA Report

The right response is not fear, and it is not blind adoption. It is control.

Start with code review. Treat AI-generated code like code from a new contractor: useful, fast, and still untrusted until checked. Make sure reviewers look for auth mistakes, unsafe defaults, dependency changes, and edge cases that AI often misses.

Then check the pipeline. A team that uses AI at scale should have automated tests, policy checks, secret scanning, and deployment gates that do not depend on one tired reviewer catching everything by hand.

Next, look at platform quality. The DORA data says organizations with stronger internal platforms are better positioned to unlock AI’s value. That means platform work is not separate from AI work. It is part of the same security decision.

If you need a formal review of that setup, our AI Code Security Audit is meant for teams that want a clear read on where AI changes their risk posture.

Finally, do not treat the 30% trust figure as a nuisance. It is a warning. If nearly a third of respondents do not trust AI-generated code, then many teams are already feeling the cost of rushing adoption without enough guardrails.

---

What Security Teams Should Do Next

The report gives security teams a practical order of operations.

First, assume AI is already in use. Google Cloud says 90% of respondents use it at work, so policy that starts from “we may adopt AI later” is already behind reality.

Second, focus on the process, not the pitch. AI can improve throughput, but DORA’s own framing shows it will also magnify weaknesses. That means your controls must be strong enough to survive more output, faster.

Third, invest in the platform. The organizations most likely to benefit are the ones that already have internal platforms and dedicated platform teams. The report’s message is not subtle: AI rewards maturity.

Fourth, measure trust and review quality over time. If 30% of respondents already distrust AI-generated code, then your own team should know whether that number is rising or falling after you change workflows.

The takeaway is blunt. AI is now normal, but normal does not mean safe. Teams that win with AI will be the teams that pair it with strong review, good platforms, and clear ownership. Teams that skip those basics will scale their problems faster.

---

Sources and Further Reading

The 2025 DORA State of AI-assisted Software Development Report is available in 9 languages, and Google says it includes seven distinct team profiles from “harmonious high-achievers” to a “legacy bottleneck.” Those profiles reinforce the same lesson: AI does not flatten team differences. It exposes them.

If you are planning a rollout, read the report, check your platform, and audit the code path before AI becomes a hidden dependency in your delivery process.