Driving Meaningful Success for Enterprise Secure-by-Design Initiatives

It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.

Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.

We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings. 

Measuring ROI of Organizational Secure-by-Design Efforts

An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here. 

In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices. 

The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.

How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score

It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.

The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.

Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:

• The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
• The financial services industry possessed the highest Trust Score of 336;
• Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
• When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.

The Solution | Conclusion

SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.

Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.