Empowering developers, enhancing productivity, and mitigating risk

What an amazing year in the ever-evolving landscape of cybersecurity! Secure Code Warrior is proud to continue our mission of equipping developers and organizations with the skills needed to combat ever-evolving security threats. In 2023, we worked with more than 600 enterprises, and in analyzing data from nearly 75,000 developers, our research shows that those who engage with Secure Code Warrior reduced vulnerabilities as much as 53%. This in turn leads to massive gains in productivity for developers, as well as supporting AppSec and security teams in hedging against risk and strengthening their organization’s security posture.

As we head towards 2024, we thought it would be helpful to walk you through some of the key product advancements, strategic partnerships, and company updates we have made this year. 

‍

Product innovations

We saw a banner year for secure code learning in our community of developers. Here are some of the highlights:

• We added 2 new languages to the platform - Terraform:GCP and Dart:Flutter- and shipped Coding Labs in 9 different languages and frameworks. 
• Secure Code Warrior hosted 820 Tournaments in 2023.
• On average, developers spent 2.3 minutes on Coding Labs, completing over 100,000 labs in 2023. That adds up to over 4,200 hours spent on Secure Code Warrior’s newest learning activity! 
• Finally, here’s a look at the top 10 industries our developers come from based on the number of active learners on the platform. 

In 2023, Secure Code Warrior introduced Coding Labs - our most advanced and interactive learning activity - designed to elevate developer security education. This addition provides real-time, contextual feedback and is currently available in 9+ languages and frameworks. Coding Labs acts as a personal trainer, facilitating faster learning and skill improvement, and making it quicker for developers to go from “learning” to “doing”. 

Secure Code Warrior continued to broaden its industry-leading library of content with the addition of two new programming languages - Dart:Flutter and TeraformGCP. Further enhancements include incorporating Guidelines into courses and the SCW Jira integration, offering developers deeper insights and in-depth remediation advice within their workflows. The introduction of Multi-company Tournaments helps foster friendly competition between developers from various companies and subsidiaries, ensuring a scalable secure coding culture. Additionally, the rollout of SCIM allows program owners and company admins to manage Secure Code Warrior licenses programmatically, ensuring accuracy and compliance at scale.

Curious to learn more about our latest product innovations? Contact your Customer Success Manager or visit our resource library for one of the many product deep dive webinars available. 

‍

‍

Strategic partnerships and integrations

A noteworthy collaboration emerged with Synopsys Developer Security Training, powered by Secure Code Warrior. This integration offers a closed-loop strategy to preempt security risks at the developer desktop, accelerating issue remediation across the software development life cycle (SDLC) and CI/CD pipelines. The partnership aims to establish a comprehensive approach to secure development, with quantifiable risk reductions.

Learn more about the partnership here. 

‍

Devlympics 2023

Devlympics, an annual global tournament hosted by Secure Code Warrior, witnessed over 1000 developers participating in 2023. The event garnered attention from security professionals worldwide, with overwhelmingly positive feedback:

• 94% enjoyed participating in the tournament.
• 90% expressed interest in joining next year's event.
• 62% rated the SCW platform 10/10, and 91% would recommend it to their peers.
• Over 85% would use the SCW platform if their organization had full-time access.

Read the full report here. Don’t want to miss out on next year’s Devlympics? Mark your calendar for October 15-16, 2024 and register your interest to be kept in the loop. 

‍

Hear from your peers

As we’ve partnered with our customers, Secure Code Warrior has become deeply embedded in their security ecosystem, and made a profound impact on their developer productivity and reduction of risk. We heard from several customers this year, and collected key learnings and insights from their subject matter experts to share with our colleagues in the broader Application Security community.  

• Workday: A remarkable reduction from 4662 security issues to zero in approximately 18 months.
• Thales: Achieved an overall reduction in vulnerabilities over two years, with no reintroduction at the source code level.
• Envestnet: Developers fixed 2.7 times more vulnerabilities than their peers, closing issues at a rate of 4.5 per developer.
• Netskope: Meet their compliance goals without traditional "check-the-box" training, with higher engagement rates in their secure coding program.
• Colgate-Palmolive:  Placed developers at the core of their secure code strategy, and embedded Secure Code Warrior seamlessly into their workflows using Okta.
• Sage: Built a best-in-class security champion community and reduced the mean time to fix vulnerabilities by 82%.

Hear directly from our customers about how they’ve built their secure code programs, fostered a security-first culture, and improved their security posture. 

‍

SCW’s Rapid Response to cybersecurity vulnerabilities

Secure Code Warrior’s Rapid Response program addresses current critical vulnerabilities plaguing our world, such as the MOVEit zero-day exploit, high-severity libcurl/curl vulnerabilities, and mvcRequestMatcher Spring. These incidents underscore the importance of proactive security measures and continuously educating engineering teams about recent vulnerabilities. Learn more about these critical vulnerabilities below, each comes with a free mission that you can play through hands-on.

• MOVEit Zero-day free mission
• libcurl/ curl vulnerability mission 
• mvcRequestMatcher Spring mission 

‍

Major funding and recognition

With office locations in Sydney and Melbourne Australia, Boston USA, Belgium, and Iceland - SCW is proud to host a community of developers that represent a wide variety of industries and regions. 

On July 13, 2023, Secure Code Warrior announced a groundbreaking achievement—the closure of its Series C funding round led by Paladin Capital Group, securing an impressive $50 million USD. This brings the total funding to over $100 million USD, underlining the confidence and support garnered since the company's inception.

‍

Join the growing community 

Secure Code Warrior's commitment to innovation, strategic partnerships, and customer success makes us proud to celebrate our successes as the leader in secure coding education and implementation. 

Interested to learn more? Follow us on X and LinkedIn to stay up-to-date on all announcements. 

That’s all for now, see you in 2024!

How agile learning with Secure Code Warrior reduces vulnerabilities

Security education needs to evolve 

One of the challenges facing security teams today is there is not enough time to integrate secure coding earlier in the development cycle. Security leaders also need to rethink the value developers are getting from the secure code learning experience, how to make the program more engaging and, most importantly, more impactful. The last thing you want is for your security education program to be seen as a hindrance to productivity. The goal of approaching developer security training should instead be built on engaging pathways, integrations with workflows, and a breadth of content that helps the concepts to stick, resulting in a reduction of the vulnerabilities being introduced. 

By integrating secure code learning with your developers’ workflow and reducing the burden on their time, developers can see a big boost in their ability to code more securely and be more productive. Secure Code Warrior has looked at data from over 75,000 developers using our platform and found that agile learning helps developers introduce 53% fewer vulnerabilities into the codebase. 

This requires a shift in approach so that developers get excited about the subject through more hands-on learning and integrations with their tools and environment to drive deeper engagement and moments of micro-learning with a big impact. 

According to Derek Fisher, a leader in application security, “We’re all pretty well familiar with the annual compliance training that we’re all subjected to in any organization. It’s usually what I call ‘death by Powerpoint’, a bunch of slides and maybe an assessment at the end...  just really ineffective and time-consuming. We had training, but it was the usual compliance based with some specific-to-security training that was slide/audio recording based. We noticed that developers weren’t very engaged and learning from the materials, so we had to shift our strategy.”

Integrate the learning experience with your developer workflows

Secure Code Warrior’s platform delivers just-in-time microburst content into the developer’s daily workflow. This integration with security tools is designed to eliminate context-switching and enable AppSec teams to build more prescriptive and engaging programs. 

With these devtool and security integrations, you can measure how your secure code learning program is working by tracking developers’ progress and measuring response times to tickets, as well as observing the reduction of vulnerabilities over time through IAST/ DAST/SAST tools. 

Here are three key ways Secure Code Warrior can integrate with your tools and workflows to help reduce vulnerabilities by up to 53% 

1. Streamline your approach 

Integrate Secure Code Warrior with your scan and pen-testing tools. This allows you to automatically correlate specific vulnerabilities and expose developers to trusted learning content needed for remediation. Secure Code Warrior has integrations with Synopsys, Snyk, Bugcrowd, Fortify, Contrast, and many more to help keep your program laser-focused. 

2. Improve productivity

Enable development teams to learn by doing through hands-on Challenges, Coding Labs, and Guidelines embedded in Jira, Gitlab, GitHub, and Azure Boards. Learning happens in minutes, not hours, without hampering developer productivity or disrupting their flow. 

2. Scale your program 

Reduce the admin burden for a security program with SCORM and SCIM capabilities built for the enterprise. Easily integrate Secure Code Warrior with your LMS, and manage user provisioning automatically. Enable SSO with the Okta integration. 

Reduce 53% of vulnerabilities earlier in the SDLC 

It’s possible to remediate vulnerabilities much earlier in the SDLC by shifting focus to writing more secure code from the start when it costs significantly less to fix them. By looking at the source of many vulnerabilities, namely, insecure code being shipped into production by developers, reducing the vulnerabilities introduced can help alleviate your tech debt and strengthen security. 

Meaningfully reducing vulnerabilities through developer education doesn't happen through boring, static training that disrupts the developers' flow. By embedding learning from the most flexible agile learning platform on the market with your tools, your existing investments in security and devtools become more valuable, potentially resulting in a substantial 53% reduction in vulnerabilities. 

Learn more tips from Secure Code Warrior 

In our next blog post, we’ll explore how you can build a highly engaging program that ties everything back to risk reduction, allowing you to focus on what the material impact is for a successful secure coding program.

Secure Code Warrior is here for your organization to help you securely code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

Learn how hands-on security education can reduce vulnerabilities by 53% 

The challenge facing development teams today 

Developers are under enormous pressure to build faster and accelerate production cycles more than ever before. This leads to a higher volume of code being introduced into organizations, some coming from open-source, A.I., or other third parties. While these may help accelerate productivity, this also raises the risk of introducing insecure code into the code base.

Despite mounting pressure to deliver faster, a software development team reworks about 26% of its code prior to release. This means a developer can spend up to 13.5 hours a week on just technical debt. That’s over 700 hours a year spent on fixing past mistakes. The hours of lost productivity can slow down development cycles, and worse, introduce new risk into the code through shortcuts and third-party sources. This creates a challenge in balancing the pressure to release code quickly but also securely. 

According to Secure Code Warrior’s research, 67% of developers admit to shipping code with vulnerabilities, and with each new line of code written each day, more and more vulnerabilities are being introduced. There is a better way to approach this - embed security from the start. In this blog, we’ll explore how developers can be the first line of defense in securing code and reducing up to 53% of vulnerabilities in their code with agile learning. 

Stop vulnerabilities from even being introduced 

Secure Code Warrior works with over 600 different enterprises to help them secure their code. Our researchers looked at data from 30% of our user base - almost 75,000 developers - and noted that developers who learn and apply secure coding practices with Secure Code Warrior introduce 53% fewer vulnerabilities into their organization than their peers. When developers stop creating new vulnerabilities - this unlocks hours and hours of productivity gained. This time can be spent reducing the technical debt backlog, or even on shipping new, innovative solutions and features. The possibilities become endless when introducing vulnerabilities becomes a thing of the past and can result in a number of efficiency improvements to the software development lifecycle. 

How can developers benefit from agile learning?  

Secure Code Warrior has integrated agile principles into the design of our learning platform to encourage developers to learn secure coding by doing. This is done through breaking up what used to be long, boring security training into small microbursts of learning that is interactive and engaging. 

Secure Code Warrior is the only agile learning platform that combines multiple microburst learning formats so developers can learn, test, and apply their knowledge quickly, in the context of real work they are already doing - in the language of their choice.

With customizable programs, highly impactful hands-on learning activities, and developer tool-ready integrations, Secure Code Warrior is the most effective way to teach developers to identify and fix vulnerabilities at the start of the SDLC, and stop vulnerabilities from being introduced in the first place.

Why Secure Code Warrior

Secure Code Warrior gives your developers the skills to write secure code. Our learning platform is the most effective secure coding solution because it uses agile learning methods for developers to learn, apply, and retain software security principles. Over 600 enterprises trust Secure Code Warrior to implement agile security training programs for learning code with agile methodology, deliver secure software rapidly, and create a culture of developer-driven security. Ready to learn more? Request a demo.

Just a short time ago, the security and development communities were put on notice with an advisory from the curl Project’s lead developer, Daniel Stenberg, who dropped the unfortunate missive that a new version of curl - distributed October 11 - was released to address two high-impact security vulnerabilities, one of which he describes as "probably the worst curl security flaw in a long time."

A postmortem on Stenberg’s blog noted that affected versions of the curl library are susceptible to a Heap-based buffer overflow vulnerability, related to a legacy issue with the SOCKS5 proxy protocol in use since 2002.

With its usage as a command line tool dating all the way back to 1998, curl is widely regarded as a foundational pillar of the internet. With such a storied history and widespread use, it is a dependency that, if found to be vulnerable, could have ongoing implications for general cyber safety.

This incident shares similarities with the devastating Log4Shell attack in Log4j, another vulnerable dependency that is still being exploited almost two years later.
‍
>>> Test your knowledge right now with our curl Mission!‍

The vulnerability: Buffer Overflow

The exploit is detailed under CVE-2023-38545, and impacts curl versions 7.69.0 up to and including 8.3.0. The primary bug is a Heap-based Buffer Overflow vulnerability, with initial reports noting that successful exploitation could lead to a more devastating Remote Code Execution (RCE) attack. While this is a possible workflow for a threat actor, it is a rare use case rather than a given.

Perhaps the one saving grace to mitigate some of the risks is that the malicious communication must go through a SOCKS5 proxy, which is a relatively uncommon deployment.

Comparable to the curl exploit, let’s take a look at this Buffer Overflow explainer:

When curl is told to use a SOCKS5 proxy, it will pass on the hostname and have the proxy resolve it. However, if the hostname exceeds the 255 bytes limit, curl will resolve the hostname locally (as seen in the code snippet below: source).

In case there is a slow handshake between the client and proxy, it is possible that the long hostname is copied into the memory buffer instead of the (shorter) resolved address. The allocated memory portion only allows for a 255-byte value, so if it receives a value that exceeds this limit, the data will overflow the memory buffer’s boundaries.

>>> Try it out for yourself in this playable mission!

Buffer Overflow is a powerful attack vector, and one that can be prevalent in a lot of legacy programming languages. In this particular case, exploitation made way for a more serious and damaging attack in the form of RCE in some contexts, though this pathway remains uncommon and unlikely.

How can you mitigate Buffer Overflow risk?

At this stage, the highest priority remediation is to apply the patches to all vulnerable instances, with a reminder that the use of curl is so widespread, it may not necessarily be obvious or advertised that components of your system include the dependency in use. In that case, auditing and subsequent patching are required. 

In general, buffer overflow flaws can be mitigated by using a memory-safe language like Rust, however, as is the case with a sprawling project like curl, it isn’t practical to port to another language or rewrite on a whim. As Stenberg notes while discussing the potential to use and support more dependencies written in memory-safe languages - or the alternative of gradually replacing parts of curl piecemeal - “... development is… currently happening in a near glacial speed and shows with painful clarity the challenges involved. curl will remain written in C for the foreseeable future.” It is no small undertaking, and the security implications are immense.

Security mistakes can and will happen, and it’s not always possible to rely on scanners and tests to pick up every possible attack vector. Therefore, our greatest weapon in the fight against these bugs is a commitment to ongoing security awareness and skill-building.
‍

Want to learn more about how to write secure code and mitigate risk?

Try out our Heap Overflow challenge for free.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

Here at Secure Code Warrior, we’re constantly innovating to help equip developers and organizations with the right skills to tackle today’s ever-changing security challenges. We do this through our agile learning platform for secure coding that allows developers to learn how they want, with the most complete and reliable vulnerability content in the industry today.  

This past quarter, Secure Code Warrior has implemented new ways for company admins to expand tournaments to multiple brands and entities, in addition to managing their users through SCIM provisioning more simply. We are also thrilled to announce that new coding guidelines are available in Jira, as well as performance overview reporting and new program workflows available in preview. 

Let’s dive in to learn more!

Expanding the SCW platform’s breadth and depth 

Secure Code Warrior’s continued expansion into new content helps to keep our modules relevant, timely, and tailored to what you need to know in today’s cyber-security landscape. With industry-leading breadth and depth of over 60 languages, it’s easy to build and scale an agile learning program for developers in a large number of languages and frameworks. 

Now available: Coding Guidelines in Jira 

The addition of Guidelines to our Jira integration offers developers contextual learning that covers security mitigation. Guidelines are more in-depth than videos, focus on a specific language or framework, and offer code snippets to help developers solve an issue even faster. In addition to accessing videos and challenges, now developers can read coding guidelines directly in a Jira issue to access in-depth remediation advice.

Now available: New front-end developer content 

Front-end developers need secure code enablement, too! That’s why we have released additional front-end vulnerabilities in Missions and Walkthroughs. Front-end developers will also be able to access front-end specific Missions through Courses. 

These updates strive for comprehensive coverage of frontend-specific vulnerabilities - from common ones like DOM-based XSS, to less frequently encountered vulnerabilities such as CSS Injection.  Step-by-step Walkthroughs provide front-end developers with trusted guidance on how vulnerabilities are being exploited, while more advanced developers can also test their skills in front-end Missions in Tournaments. 

Exciting new ways to scale your culture of security 

Now available: Multi-company Tournaments 

‍

Multi-company Tournaments can be created to enable friendly competition between developers from multiple business entities, company subsidiaries, partners, and other companies. This ensures that a secure coding culture can scale across an entire organization and its multiple brands.  

Interested in participating in the ultimate Multi-company Tournament? Register for the 3rd annual Devlympics - SCW’s global tournament for Cybersecurity Awareness month! If you are already a customer, you can register through the platform. 

Simplifying the admin and developer experience

Now available: Course filtering 

The ability to apply additional filters on the Course Management page makes it much simpler for admins to filter down to the course they want to work on. Courses can be filtered by several attributes such as status, end date, and teams enrolled.

Now available: Manage your SCW licenses with SCIM 

Now program owners and company admins can programmatically manage developers at scale and enjoy the certainty of knowing that access controls are always up to date.

SCIM provisioning uses your identity provider to synchronize access to Secure Code Warrior. Automating these tasks ensure accuracy, security, and compliance to save both time and resources when provisioning users. Currently, SCW supports SCIM provisioning on the user level only and not yet for SCIM groups.

Available in preview: Program workflows

 Configuring a scalable and engaging secure code education program is now easier than ever with key usability improvements to the platform. Programs were created to provide more guidance for learners through the sequencing of courses and assessments into multi-level programs. Automated program workflows are now available to customers who have enabled preview in the platform. Program workflows ensure that developers know where to start, can navigate to what is next, and move easily through different levels in a secure code learning program. It also enables company admins to spend less time setting up, managing their program, and nudging developers to complete their next learning activity. 

Need some tips about how to kickstart secure code learning at your organization? Read our handbook about how to structure your program to meet your security goals. 

Reporting and program insights

Available in preview: Performance Overview 

As a company admin, the need to monitor activity across your organization is crucial to understanding developer participation and measuring the success of your secure code learning program. We’ve built an enhanced reporting interface that ensures company admins are gleaning the most actionable insights from their reports.

Performance Overview provides insight into developer course and assessment completion, along with the average accuracy over time. The report also generates an insightful industry benchmark to see how your program compares to your industry’s average assessment score for your selected assessment. 

This simple, and yet powerful report marks the beginning of Secure Code Warrior’s set of insights and metrics that are planned for 2024. 

Interested in trying out Secure Code Warrior but don’t have an account yet? Book a demo to learn more today. 

That’s a wrap on this quarter’s new capabilities! Follow Secure Code Warrior on LinkedIn and X (formerly Twitter) to get updates about the latest releases and improvements.

‍

‍

Software supply chain cyberattacks are becoming increasingly common, sparking a flurry of legislative changes at the US government level, while enterprises scramble to mitigate their expansive risk profile and rapidly improve software quality. There have been three zero-day vulnerabilities linked to file-sharing services this year alone, with the largest and most destructive coming in the form of the MOVEit mass exploit.

Spearheaded by the CL0P ransomware group, the MOVEit incident has dominated cybersecurity news for some time, with more than 1,000 organizations impacted. This number is set to keep growing, rendering this one of the most potent software supply chain attacks since Solarwinds in 2021.

The catalyst for this widespread breach was a cluster of SQL injection vulnerabilities, ultimately receiving a severity score of 9.8 out of 10 from MITRE. SQL injection has been the bugbear of security professionals since the late 90s, and despite being a fairly straightforward fix, it continues to find its way into modern software and provide a red carpet to sensitive data for threat actors. 

The MOVEit scenario is a little different from what many developers and AppSec professionals may have previously experienced, and you can test your SQLi-slaying skills in a live simulation right here:

>>> PLAY THE MOVEit MISSION

The vulnerability: SQL injection

How exactly was SQL injection used to exploit Progress Software’s MOVEit file transfer application?

CL0P ransomware group was able to exploit SQL injection vulnerability CVE-2023-34362, granting them unrestricted and unauthorized access to MOVEit’s database. From there, they were able to install LEMURLOOT, a web shell that would ultimately allow them to run several high-risk, critical processes like retrieval of system settings, enumerating the SQL database, file retrieval from the MOVEit Transfer system, and creating a new account with full administration privileges.

Needless to say, this attack vector may be the result of a relatively simple error - one that could be put down to the perpetual use of poor coding patterns - but its potential to cause ongoing problems at the enterprise level is immense. 

Comparable to the MOVEit exploit, let’s take a look at this SQLi explainer, which simulates the method of injecting and executing malicious SQL:
‍

This query string and variable:
‍

string emailAddress = "contact@scw.com";

var query = $"SELECT u.UserName From Users as u WHERE u.Email = '{emailAddress}'";

will result in the following query:
‍

var query = $"SELECT u.UserName From Users as u WHERE u.Email = 'contact@scw.com'";
‍

… and with malicious crafted input:
‍

string emailAddress = "contact@scw.com'; DELETE FROM Invoices WHERE Id = 2;--";

var query = $"SELECT u.UserName From Users as u WHERE u.Email = '{emailAddress}'";
‍

it will become:
‍

var query = $"SELECT u.UserName From Users as u WHERE u.Email = 'contact@scw.com'; DELETE FROM Invoices WHERE Id = 2;--'";
‍

How does that look in flight?

Note that due to the string concatenation, the input is being interpreted as SQL syntax. First, a single quote is added to make sure the SELECT statement is valid SQL syntax. Next, a semicolon is added in order to terminate the first statement. 

Once this is in place, a valid DELETE statement is added, followed by two hyphens to comment out any trailing characters (the single quote). An UPDATE statement could just as easily be added, for example, if the malicious SQL was to update users' roles or passwords.
‍

Try it out for yourself in this playable mission:
‍

>>> PLAY THE MOVEit MISSION
‍

While relatively straightforward, SQLi remains a powerful attack vector, and one that is all too common. In the case of MOVEit, this exploit made way for a damaging backdoor installation, and a group of further attacks of similar severity.

How can you mitigate SQL injection risk?

For any companies utilizing MOVEit as part of their business operations, it is imperative that they follow the recommended remediation advice from Progress Software. This includes but is not limited to applying security patches as an emergency-level priority.

For SQL injection in general, check out our comprehensive guide.

Want to learn more about how to write secure code and mitigate risk? Try out our SQL injection challenge for free.

If you’re interested in getting more free coding guidelines, check out Secure Code Coach to help you stay on top of secure coding best practices.

Fresh off the back of our Series C funding announcement, I am thrilled to announce another step in our company’s journey. Security industry leader, Synopsys, has welcomed an exciting new addition to its product suite: Synopsys Developer Security Training, powered by Secure Code Warrior. You can read the full press release here.

This expansion of their industry-leading portfolio of application security solutions signifies a positive step in the right direction for enterprise security programs, enabling them to embrace best-practice DevSecOps methodologies - especially those relating to the shared responsibility for security. Put simply, this integration will grow the global base of security-skilled developers, and this is a wonderful opportunity for every organization to support code-level vulnerability reduction through developer enablement in secure coding. 

Global governments are placing increasing scrutiny on software vendors in the wake of some of the worst cyberattacks on record, with CISA in the United States releasing their Security-by-Design and -Default Guidelines this year, in which they recommend that the ultimate responsibility for cybersecurity outcomes is placed on the vendor rather than end-user. For many software vendors, this will require a significant overhaul of their internal security practices, or they run the risk of hefty fines. This will quickly become a non-negotiable across the globe, and any excuses relating to a cybersecurity skills shortage won’t fly: we need security-aware developers to play their vital role in safer software creation, and we need them now.

Flexible, customizable agile learning solutions are a powerful antidote to poor coding patterns, in addition to the negative experience many developers have had with AppSec initiatives to date. They need to be won over, accommodated, and given learning pathways that fit in with their workflow to deliver the right information at the right time. Synopsys’ integration with our platform is a viable, market-leading solution to this problem, and can fundamentally change the developer relationship with security for the better.

Cybercrime is set to cost companies globally an estimated $10.5 trillion annually by 2025, a consistent rise from $3 trillion in 2015. Cybersecurity Ventures also reports that cybercrime represents the “greatest transfer of economic wealth in history”. This is not a drill; we as a collective industry must start prioritizing secure coding education for every individual writing code, and set a new benchmark for security as a measure of software quality. With Synopsys’ comprehensive suite of tools now including engaging, hyper-relevant hands-on agile learning for developers, there has never been a better time to make a meaningful switch to developer-driven, preventive security programs.

Agile learning for secure code in the SDLC pays off 

This is the third in a three-part blog series discussing the attributes and benefits of an Agile Learning Platform for secure code. In part 1 we introduced the concept of agile learning and how Secure Code Warrior’s platform exemplifies several agile principles.  In part 2 we explored how an agile learning platform replaces traditional compliance-oriented security training.  

An agile learning platform delivers a learning experience that allows the learner to internalize and use new skills more effectively, through a combination of hands-on, in-context education that’s truly integrated into their day-to-day job, as part of the job.  This approach to learning, as SCW has applied it to developers acquiring secure coding skills, separates SCW from traditional learning modalities and sets us apart. In this third and final blog in the series we walk you through the ROI organizations can expect from an agile learning platform for secure code and how to model the numbers for your organization.

Business impact

Organizations that adopt an agile approach for secure code learning see 2x to 3x business impact from two levers: the ability to fix vulnerabilities faster and rework cost avoidance. 

‍

‍

The earlier in the SDLC that vulnerabilities are addressed, the less damage they can cause and the less costly they are to remediate. According to security expert Jim Routh, who previously served as Chief Security Officer at Aetna and CISO at MassMutual, the cost per defect during the phases of the SDLC rise to greater than $14,000 if performed during maintenance mode after the software is released to production. Costs can be halved if addressed during testing and they can be 14 times less expensive if addressed during the coding phase.  

‍

‍

The more well-equipped developers are to fix vulnerabilities faster or to avoid them altogether, the less cost and risk an organization must accept in its software products and internal applications. Organizations that want to invest in vulnerability prevention and software quality provide developers with an agile learning platform that delivers flexible experiences and multiple pathways for them to learn, specifically designed for immediate business impact.

‍

Research from NIST indicates that the hours required to fix a vulnerability varies, but the estimates in the table below have been identified in real-world scenarios with large enterprise customers.

‍

‍

After teams develop new secure coding skills, SCW customers have noted their developers fix vulnerabilities as much as 50% to 60% faster and produce 50% fewer high-risk vulnerabilities in production code. Every organization’s experience varies, but these results have been observed at large enterprises with more than 5,000 developers. Increasing developer productivity has had a bottom line impact.

Operational cost reduction: fix vulnerabilities faster

To understand the financial impact of a more secure software development process and how an investment in an agile learning platform helps developers fix vulnerabilities faster, use the model below and substitute your own numbers for the variables in blue:

 Baseline:

‍

Assumed benefit of agile learning platform on MTTR (Mean Time To Remediate)

‍

Prevention value: rework cost avoidance

An agile learning platform helps developers write secure code from the start.  The model for determining this financial impact is presented below.

‍

Agile learning approach makes a difference

The SCW agile learning platform for secure code is superior to alternative developer security training approaches. SCW customers have seen outstanding results, which of course vary according to the individual costs and vulnerability metrics of their unique situation. One large financial services company, Envestnet, found that SCW-educated developers fixed 2.7x more vulnerabilities than their peers.  Additionally, a group of 1,200 SCW-educated developers increased remediation rates in their queue by 120%.   

As with any business solution investment, It’s important to evaluate your unique circumstances.  Our team can partner with you on an assessment of your current state and develop a customized business case. If you’re looking to assess the impact on your own, use the models outlined in this blog and take a look at a recent customer webinar with Sage, the UK-based $2B Accounting and ERP software company, who discuss an 82% reduction in MTTR for vulnerabilities as part of a robust program to build a security culture.

About Secure Code Warrior

Secure Code Warrior gives your developers the skills to write secure code. Our learning platform is the most effective secure coding solution because it uses agile learning methods for developers to learn, apply, and retain software security principles. Over 600 enterprises trust Secure Code Warrior to implement agile learning security programs, deliver secure software rapidly, and create a culture of developer-driven security. Ready to learn more?  Request a demo. 

Embedded, agile learning is the future 

In a previous blog we introduced the concept of agile learning and how Secure Code Warrior’s platform for secure code exemplifies several agile principles.  In this second of a three-part blog series, we continue exploring how an agile learning platform for secure code can replace the traditional compliance-oriented security training most organizations are used to.

The traditional compliance-oriented approach to secure code learning is a static, point-in-time training enforced on a quarterly or annual basis. The problem with this format is that it creates no incentive for developers to learn about secure coding nor does it help them acquire new skills and use them in their jobs. No one likes to spend hours cramming in a compliance training when it takes you away from valuable work, leaving you to catch up on hours of lost productivity. 

According to Gartner, the agile learning approach recognizes that people learn the most at the moment of need, and when training occurs in small units called microbursts, embedded within everyday work activities.¹

Secure Code Warrior is the only agile learning platform that combines multiple microburst learning formats so developers can learn, test, and apply their knowledge quickly, in the context of real work they are already doing in the format of their choice. Agile learning for secure code not only preserves hours of productivity, but it provides developers a path to easily go from learning to doing.   

‍

¹ Source: The Agile Learning Manifesto Gartner

Flow of value delivery and learning to earning

Agile learning systems are effective because they weave learning opportunities inside the flow of value delivery, where they can see direct impact in their jobs, and tie learning to earning (as Gartner puts it). Point-in-time compliance training doesn’t stick with developers over time and doesn’t build skills - nor does it create an incentive for them to learn as a part of their job. Agile learning makes learning part of the job, not time away from the job.  

Secure Code Warrior’s platform delivers just-in-time microburst content into the developer’s daily workflow, eliminating context-switching and making it convenient for them inside the dev tools they use every day, such as GitLab, GitHub, AzureBoards, and Jira. This keeps them connected to their job, while learning at the same time. 

‍Social amplification and community compounding

Developers have a strong sense of community - we see this in spaces such as GitHub where knowledge is shared and consumed by millions of developers across the globe. Agile learning principles recognize that people learn more within a group rather than on their own. Social communities are a useful means to reinforce new skills and compound the benefits of teaching secure code through social amplification. 

Because Secure Code Warrior’s security content is easily accessed and consumable with social amplification baked-in via tournaments and an internal points system, SCW’s platform acts as a motivation multiplier that builds the confidence of individual developers and makes them want to learn.  Tournaments raise the profile of secure coding skills publicly in the enterprise and provide a powerful incentive for developers to build secure coding skills.

‍Make the switch from training to agile learning

Shifting your approach from security training to agile learning for secure code is a powerful way to enable your developer workforce, recapture wasted developer hours, and apply that time to more productive projects.  Start your journey with a learning solution built on agile principles. The SCW Agile Learning Platform is the most effective learning solution for secure code because it gives developers choices over how they build new skills. Incorporating agile learning methods vastly improves the developer’s ability to pick up new skills, internalize them, and apply in their jobs. Over 600 enterprises trust Secure Code Warrior to implement agile learning security programs, deliver secure software rapidly, and create a culture of developer-driven security.  Ready to see an agile learning platform in action? Request a demo.