New analysis collaborated on with Paladin Global Institute highlights the critical need for developer upskilling to properly measure Secure-by-Design progress
BOSTON – October 15, 2024 - Today, Secure Code Warrior, the global, developer-driven security leader, issued new findings on developer upskilling and its impact on organizations’ Secure-by-Design (SBD) initiatives. Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge. The new analysis shows that organizations across critical infrastructure industries, like financial services, defense, healthcare and IT, are making progress in preparing their developers to advance their SBD initiatives. Secure Code Warrior found that these industries’ developer teams possess an average security posture - as measured by the SCW Trust Score, a global benchmark that quantifies developer teams’ security competencies - that is higher than that of other industries.
Chief information security officers (CISOs) find it increasingly difficult to prove the true ROI in the early stages of their SBD initiatives. In recent years, the absence of a benchmark to evaluate how organizations are tracking against industry standards has been a key challenge. The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code, but also assuring industry and government regulators that those skills are set in place.
“Now more than ever, we have a national responsibility to ensure SBD upskilling programs are in place,” said Chris Inglis, Senior Strategic Advisor at Paladin Capital Group and former National Cyber Director. “Risk reduction is at the core of this latest analysis, and Secure Code Warrior is leading the charge to enhance developer security learning, prevent cyberattacks, and strengthen our nation’s critical infrastructure.”
Key Findings: Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:
Secure-By-Design is gaining momentum across the globe - as countries weave in similar guidelines to their broader cybersecurity strategies. However, providing secure defaults for developers and fostering a software developer workforce that understands security will be difficult to achieve without the right data points to inform a developer skills benchmark. A program of agile upskilling can resonate with developers, when built on established baselines, with hands-on sessions that address real-world problems developers are facing.
“At a time of unprecedented global cyber threats, these new findings demonstrate the need to enhance SBD initiatives across our digital infrastructure to reduce critical vulnerabilities,” said Kemba Walden, President of the Paladin Global Institute and former acting National Cyber Director. “This research issues a clear call to action for upskilling personnel and creating benchmarks to meet critical cybersecurity goals.”
“Baselines and benchmarks can greatly optimize an organization’s security posture by making secure coding an essential part of its DNA,” said Matias Madou, co-founder and CTO, Secure Code Warrior. “To know if a SBD initiative is making real progress, you need the quantitative evidence that developer upskilling efforts are effective, and that they absorb security best practices into their work habits. You must have complete faith that developers have truly earned their license to code.”
Many security leaders persistently highlight the difficulty of scaling most elements of an enterprise security program, especially those involving continuous upskilling and assessment of individual personnel. This is a valid concern, but in the wake of several global legislation reforms and guidelines demanding that developers have verified security skills, it must be overcome. Many organizations around the world are taking action and have implemented large-scale upskilling initiatives that are making a significant impact.
To learn more about Secure Code Warrior’s latest analysis and the SCW Trust Score, click here.
About Secure Code Warrior:
Secure Code Warrior is a secure coding platform that sets the standards that keep our digital world safe. We do this by providing the world’s leading agile learning platform that delivers the most effective secure coding solution for developers to learn, apply, and retain software security principles. More than 600 enterprises trust Secure Code Warrior to implement agile learning security programs and ensure the applications they release are free of vulnerabilities.
For more information about Secure Code Warrior, visit www.securecodewarrior.com.
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
The promise of artificial intelligence writing complex code at the touch of a button is intriguing, but the reality is that AI will need a lot of help from human developers to craft truly secure and reliable code.
