The Global CTO Survey 2020 Report

How long does it take to become a CTO?

_______________________________

The road to CTO is (usually) long

For 78% of the respondents, becoming a CTO took 5 years or more; 42% didn’t become a CTO until over a decade into their career. Most of the respondents were Software Engineers and/or Tech Leads in the past; on average, they took on at least two different roles before transitioning to CTO. The median amount of companies respondents worked at before becoming CTO was three.

The fastest way to become a CTO: claim the title while joining a small organization

There’s a big difference between being a CTO founder of a startup and leading a global corporation as a CTO. Our data reflects this; respondents working at larger organizations typically reported that it took them longer  to become CTO: from 5 up to 16+ years. Corporate CTOs were also noticeably older than other respondents—from 33 to 55 years old.

As for the actual steps taken to become CTO, over half of the respondents assumed the role when they joined an organization (both joining an established organization as well as founding a new one fall under this category). The second most common case was getting promoted —meaning there’s still hope for those with CTO ambitions who aren’t eager to jump ship.

How did you become a CTO?

Expert commentary

What technologies are CTOs using to build their software?

____________________________

The most popular languages:

JavaScript/TypeScript, Python, Java, and PHP

Different needs, different code

Depending on the company size, there are noticeable differences in the programming languages chosen by CTOs’ teams.

Language popularity by company size:

C#, PHP, and Java are used
more at larger companies

However, JavaScript/Typescript remains popular across the board, no matter the company size.

Language popularity by company size:

The top 4 web frameworks were JS frameworks, with React leading the way

The most popular web frameworks used by our respondents’ teams were React, Angular, Express, and Vue. React is the clear leader in the JavaScript space; it was nearly twice as popular as the runner-up.

Among non-JavaScript frameworks, ASP.NET, Spring, Laravel, and Django were the leading solutions for their respective languages. The common denominator between them seems to be strong support, either from Microsoft in the case of ASP.NET or the open source community for Spring, Laravel, and Django.

Most popular web frameworks

Python is the king of data science

Most popular data science frameworks

"The results of the srvey confirm that it's hard to imagine a data science project without NumPy and/or Pandas. Even if they are not used directly, their fundamental data structures, namely ndarrays and DataFrames, are often used to represent data when using other libraries from the Python scientific stack.

 

It is also worth noting that the most popular deep learning framework, TensorFlow, is by far more popular than the most popular "old-school" machine learning framework, Scikit-Learn. This proves that the boom in productionizing machine learning solutions in recent years is mainly due to deep learning algorithms, which can provide results that were impossible to achieve ever before thanks to massive volumes of data."

 

Jerzy Kowalski,  Senior Full-stack Developer @ STX Next

The choice of language often influences the choice of database solutions

"One interesting finding from our data is that the teams’ choice of programming language often influences the choice of database solutions. The most popular database, PostgreSQL, is the primary choice for Python teams. However, there’s a clear synergy in the technologies supported by Microsoft: C# teams most often use Microsoft SQL Server. It’s also curious to note
that PHP developers most often use MySQL."

Łukasz Grzybowski, Head of Machine Learning and Data Engineering @ STX Next

CTOs’ teams work a lot in the public cloud

Over 75% of CTOs are using Cloud, Agile, and Continuous Integration

We asked our respondents whether they have adopted some of the industry’s trending practices. The average CTO develops software in the cloud using Agile methodologies. Their teams also apply test automation to safeguard quality.
On the delivery front, more often that not CTOs are already using CI/CD and DevOps.
Microservices seem to be slowly transitioning to an industry standard; over half
of our respondents have implemented them. On the flipside, Platform as a Service, Infrastructure as a Service, and DevSecOps are among the least adopted practices.

Which of the following have you implemented?

"Cloud providers naturally fulfill the needs of flexibility introduced by Agile methodologies. Using the Cloud is a major benefit to speed up the time-to-market of the product. Companies realized that the typical work of DevOps with CI/CD and automated tests is much easier, cheaper and predictable with the Cloud. From a budget perspective, controlling infrastructure costs is crucial; Cloud solutions make that easy."

Szymon Piasecki, Head of DevOps @ STX Next

Server virtualization and containerization tools

What containerization tools do your teams use?

40% of respondents aren’t monitoring their infrastructure for performance issues

It appears that a significant portion of our respondents haven't reached the point where they would consider monitoring the infrastructure on which their applications are deployed. This might be due to budget constraints, small scale or lack of maturity of their digital business, or other factors.

Have you implemented any infrastructure/network monitoring solutions?

On top of that, respondents that have implemented monitoring mainly use older generation and/or open-source tools, including Prometheus, Nagios, and Zabbix.

How are CTOs protecting their data and intellectual property?

______________________

Dedicated security teams are a rarity in companies smaller than 300 people

Only 20% of our respondents have a dedicated security department in their organization. However, the proportion shifts significantly with company size; larger companies are much more likely to have a dedicated team.

It seems that many organizations still see security as a cost rather than an investment. However, one should bear in mind that for smaller organizations, the cost of a security team is significant relative to the size of the entire budget. Coupled with limited awareness of potential security issues and a focus on fast time-to-market, this may be pushing smaller companies to postpone work on security.

Do you have a dedicated team or department providing security services in your organization?

Implementation of dedicated security teams by company size

40% of the respondents are outsourcing their cybersecurity

Outsourcing cybersecurity seems to be the more popular choice among our respondents compared to dedicated teams. The majority of organizations with a headcount of 100 or more are tasking an external company with protecting their digital space. One reason for this trend might be cost-effectiveness. Internal cybersecurity teams are expensive, especially taking into account the budgets at smaller companies.

Secondly, cybersecurity is a broad term. For specific security tasks, it might be better to hire an external company specializing in that particular subject. The third reason might be separating cybersecurity topics from the company structure. At the largest companies, cybersecurity departments report directly to the board. This is to avoid potential conflicts and undue influence on decisions resulting from the company structure.

Are you using the services of external specialized companies for security and cybersecurity?

Implementation of cybersecurity outsourcing by company size

GDPR is the most commonly
enforced regulation

We asked respondents about whether they enforce one of the following regulations and standards: GDPR, ISO, PCI DSS, and HIPAA. GDPR was the only one enforced by a majority of respondents (74%). The runner-up was ISO, enforced by 38% of respondents.

Which of the following standards and regulations do you enforce for the systems in your organization?

"While GDPR is a widely recognized security-related regulation, compliance with Article 25 privacy by default and privacy by design can be challenging without proper expert knowledge when building applications or microservices containers."

Aleksander P. Czarnowski, CEO @ Defenselayers

Multi-Factor Authentication is commonly adopted; SIEM is a rarity

Data security is an important technological concern for companies due to law regulations and the steep costs of a data security breach, both in terms of money and reputation. That’s why we decided to ask what security measures CTOs have adopted, and to what extent.

Over 75% of our respondents are using some manner of Identity and Access Management (IAM); nearly half have implemented it in most or all cases. Multi-Factor Authentication is the most popular tool to manage access, followed closely by Single Sign-On.

The outlier of the bunch is Security Information and Event Management (SIEM). 61% of our respondents don’t use it at all. Some of the reasons may be the high cost of tools such as Splunk or the relatively large effort required to feed SIEM tools the right logs and data so they can do their job.

Bring your Own Device: convenient for employees, security concern for the C-level

Roughly half of our respondents allow their teams to use their own devices for work. For the most part, CTOs take the additional security threat seriously: the overall adoption rate of security tools was higher in companies with Bring Your Own Device policies in place.

Still, 13% of our respondents have a BYOD policy and yet don’t even use Multi-Factor Authentication.

Do you have a Bring Your Own Device policy in place?

Most respondents check the security of their containers in some fashion

However, most respondents don’t have special guidelines for container security. Most typically, they rely on their CI/CD vendor or cloud service provider to provide security checks for them.

How do you check the security of your containers?

"While the container ecosystem is blooming, it still doesn’t meet one basic security requirement: proper trust management. Without trust, any security system known to humanity must fail instantly. Since over a half of the respondents don’t h

ave specific guidelines to check the security of their containers, it poses a huge risk to their business. Imagine what would happen if a malware or backdoor installed in a container was to be uploaded to a customer production environment."

Aleksander P. Czarnowski, CEO @ Defenselayers

How are CTOs helping their teams grow?

_______________________________

When assessing their teams’ performance, CTOs typically consider Agile metrics, quality of deliverables, and feedback from peers on soft skills.

CTOs need to keep tabs on how well their teams are delivering what’s expected of them. We asked our respondents what tools they use to assess their teams, and what they take into account when evaluating the performance of individual team members.

The results show that the typical CTO will perform periodic performance reviews and monitor Agile metrics like team velocity and lead time. Roughly a third of our respondents use KPIs.

Team members looking to impress their CTOs are facing a balancing act: quality of deliverables and code is the #1 criterion for their assessment, but it’s closely followed by feedback from peers about their soft skills. Efforts towards mentoring more junior team members also won’t go unnoticed.

In short, CTOs reward team members who can code, communicate, and teach others. But they don’t pay that much attention to engagement in hackathons, conferences, or on social media.

Scrum reigns supreme among software development frameworks

1 in 4 CTOs doesn’t use any project management framework

What project management frameworks do your teams use?

To motivate their employees, CTOs bet on transparency, honesty, and being supportive

We asked CTOs how they motivate the employees. For this question, they could choose as many answers as they wanted.

The picture that emerges from the answers paints CTOs as leaders who like to keep an open line of communication and help their teams grow by giving them responsibility and decision-making power. On the flipside, CTOs don’t see value in material rewards, snacks, company stock options, and even team bonding activities. It’s also interesting to note that by their own admission, roughly half of the respondents don’t think that their tech stack is modern enough to excite their employees.

How do you keep your staff motivated?

Hiring: employee referrals, direct search and job ads find the best candidates

What are your most important
hiring criteria?

Expert commentary

People assume job boards and ads have been dead for a while now. Meanwhile, we can see them in the top 3 most efficient talent sourcing methods. I'm not surprised at all. Developers want relevant job offers and industry-specific job boards like Just Join IT deliver exactly that. We've been building an engaged community within the IT industry that attracts 200,000 tech professionals in Poland alone. That's an enormous and still growing talent pool that companies and CTOs can tap into.

Piotr Nowosielski, CEO @ Just Join IT

Just Join IT is a go-to job board for technology professionals in Poland and worldwide, creating a link between amazing companies and great talents.

What obstacles are CTOs trying to overcome?

_________________________________

The tech challenges CTOs are facing—in their own words

CTOs' main challenges: choosing what to focus on, and finding the budget and people to do it

CTOs' top 3 priorities

How are CTOs growing their skills?

_________________________________

70% of the respondents have formal education in software engineering

Only 10% of survey respondents had formal education in Management. 56% of respondents hold titles of either BSc or MSc.

The results seem to indicate that focusing on technical chops will get you further on the road to becoming a CTO.

CTOs' education and titles

CTO’s fields of qualification

Areas of improvement: CTOs want to grow their core skills first

When asked about the skills they want to improve in their work, CTOs primarily indicated two areas: overall tech skills and managing people. One could say these form the “backbone” of the CTO role.

Aside from these two core competencies, CTOs also want to get better at growing professional relationships, setting goals and KPIs, managing technical debt, and building processes and workflows. The fact that each of these skills could be called an entire discipline in itself illustrates the breadth
of work that the CTO is involved in.

The least popular answers could be interpreted as areas where CTOs feel confident about their abilities. Such areas include implementing Agile principles and giving technical presentations.

Which of the following areas would you like to improve the most in?

CTOs see value in continued learning

60% of respondents spend 3 hours or more on educating themselves. 18% spend over 8 hours on self-education.

Programming, software architecture and Agile/Scrum are among the most popular disciplines in which CTOs seek additional education. On the other hand, it seems that cybersecurity is not on CTOs’ minds; only 26% of our respondents have taken a cybersecurity course.

What courses have you finished?

How much time do you spend on learning weekly?

CTOs’ tech skills are sharper in smaller companies

“Should CTOs code?” is a common dilemma in the technology world. We decided to explore it by asking our respondents about their personal programming chops. They were asked to assess their skills in several languages from 1 to 5.

Our results show that JS, Python, and Bash/Shell/PowerShell are the programming languages most commonly known among CTOs. One interesting find is that CTOs from companies up to 100 people assess their language knowledge higher than CTOs from bigger companies. This probably relates to the fact that in smaller companies, CTOs are sometimes called upon to do some of the coding themselves—so they need to keep their coding skills sharp by necessity.

The key skills for a CTO: balancing tech, business, and people

Expert commentary

CTOs’ knowledge, experience, and leadership style impact the rest of their organization. It’s not surprising that most CTOs identify improving their technical skills as top priority.

Technical leaders face the need to improve their skills while having only a few hours per week to invest in their personal development and learning.

This is hardly enough to both identify the right resources to learn from and thoughtfully consume them. We see our students in software engineering, machine learning and cybersecurity solving this challenge through learning 100% online at a flexible pace, learning these critical new skills in 6 to 9 months.

Jonathan Heyne, VP, GM of Data & Eng. Programs @ Springboard

How satisfied are CTOs with their jobs?

_________________________________

CTOs tend to be satisfied with their job overall

The average for job satisfaction was 3.94 out of 5.

Our data indicates that CTOs are the happiest either in small companies or very large organizations with over 1000 people.

CTOs at medium-sized companies are not only less satisfied with their job overall, but also the least satisfied with their software development velocity. This could be attributed to the “growing pains” of SMEs, where headcount and complexity are already high, but no processes have been implemented yet to ensure smooth software development.

Who took part in our survey?

_______________________________

Europe was the most represented region in this year’s survey

CTOs from all over the world responded to our survey, but this year the majority of responses (76%) were from Europe, mainly Western Europe. The second most represented continent was North America.

Respondents by location

Our main group of respondents: software CTOs from companies with 100 employees or less

The “T” in CTO stands for Technology; that doesn’t always mean IT, but in our survey that was very often the case. 49% of our respondents came from the IT/Software industry, nearly matching all other industries combined.

In terms of company size, over 80% of our respondents work at organizations with a headcount of less than 100. This indicates that the results of our survey can be considered an accurate indicator of the situation of startup and SME CTOs. On the other hand, readers looking to extrapolate our findings about corporate CTOs should take our conclusions with a grain of salt due to the relatively small sample size.

Respondents by industry

Respondents by company size

Expert commentary

"The CTO is a manager first and foremost, but their work has always been a balancing act. On the one hand, nothing is more important than managing people right: hiring the right talent, supporting juniors so they can grow, and learning to delegate work to seniors so they can make autonomous decisions. On the other, the current situation makes IT infrastructure a big priority; most of the work that used to happen in a physical space now depends on the infrastructure that the CTO is responsible for. This is likely part of the reason behind the rise of DevOps—if our clients' needs are any indication, the importance of DevOps will only continue to grow.

 

Even though the future is uncertain, CTOs still need to make tech decisions looking not just at the current landscape, but trying to predict which solutions will stand the test of time 3-5 years from now. It’s not an easy task, and we’re proud we can play our role in helping CTOs rise up to the challenge."

 

Maciej Dziergwa, CEO @ STX Next

Who helped make this survey a reality?

_________________________________

Huge thanks to our partners

The Global CTO Survey would not have been possible without the support of our partners, who provided expert commentary, publicity for the survey, and freebies for survey respondents.

Brought to you by STX Next

In case you were wondering who put all of this information together...

We're STX Next, Europe's largest Python software development agency. We help CTOs and other software managers deliver their projects faster.

If you need some extra developers to speed up work or you're looking for help implementing an unfamiliar technology, we can help with that.

If you have just a vague idea for a digital product and you need it defined, designed, developed, and deployed—we can help with that too.

Go ahead and click here if you want to know more about our services.

And if you're just looking for more free insights and guides, head over to our Resources section and our blog.