Pieter Danhieux
"Over a decade I saw the same secure coding mistakes being repeated and consultants like me were continually pointing out the problems, but no one was helping developers learn how to fix them, or not make those mistakes again. Learning about security needed to be more relevant and fun for developers and existing training tools were too boring and frankly, not accurate enough."
Pieter Danhieux
Pieter Danhieux is the Chief Executive Officer, Chairman, and Co-Founder of Secure Code Warrior.
In 2020, Pieter was recognised as a finalist in the Diversity Champion category for the SC Awards Europe 2020, and was awarded Editor's Choice for Chief Executive Officer of the Year by Cyber Defense Magazine (CDM), the industry’s leading electronic information security magazine. In 2016, he was No. 80 on the list of Coolest Tech people in Australia (Business Insider), awarded Cyber Security Professional of the Year (AISA - Australian Information Security Association) and is member of the Forbes Technology Council.
Pieter is also a Principal instructor for the SANS Institute teaching military, government and private organisations offensive techniques on how to target and assess organisations, systems and individuals for security weaknesses. He also serves as an advisory board member of NVISO, a cyber security consulting company in Europe. Before starting his own company, Pieter worked at Ernst & Young and BAE Systems. He is also one of the Co-Founders of BruCON, one of the most awesome hacking conferences on this planet.
He started his information security career early in life and obtained the Certified Information Systems Security Professional (CISSP) certification as one of the youngest persons ever in Belgium. On his way, he collected a whole range of cyber security certificates (CISA, GCFA, GCIH, GPEN, GWAP) and is currently one of the select few people worldwide to hold the top certification GIAC Security Expert (GSE).
How the Australian Government can build national cybersecurity resilience and stand tall against threats
It is clear from the Australian Government's push to get serious about cybersecurity that it has been identified as a key risk area on a national level, but is their strategy reaching far enough?
Shifting left is not enough: Why starting left is your key to software security excellence
Much of the initiative around "shifting left", that is, introducing security much earlier in the development process, simply doesnt move the needle far enough.
Certified security awareness: An Executive Order to elevate developers
The latest Executive Order from the US Federal Government touches on many aspects of functional cybersecurity, but for the first time, specifically outlines the impact of developers, and the need for them to have verified security skills and awareness.
The new NIST guidelines: Why customized training is essential to create secure software
The National Institute of Standards & Technology (NIST) released an updated white paper, detailing several action plans for reducing software vulnerabilities and cyber risk.
The growth spurt: Happy 5th birthday, Secure Code Warrior
I could have started this article with all the facts and figures indicating a thriving, hyper-growth startup; they are undeniably impressive and our ongoing company trajectory is strong. However, for me, these numbers don't reflect what I am most proud of in 2019.
Seven years of Secure Code Warrior, and it’s starting to feel real
Our birthday milestones are a wonderful reminder to reflect on the fruits of our labor, celebrate the team, and tackle the year ahead with confidence. And now, seven years since inception, I’m left wondering: Have we done it? Is this a real company yet? Of course, we have reached maturity, but I sure hope we never lose the sense of curiosity, passion, and geekiness we’ve had since the beginning.
Secure Code Warrior turns 8: All aboard the rocket ship
This week, we officially celebrate eight years of Secure Code Warrior. On the one hand, that’s 350 times the length of the Apollo 11 mission, as well as the equivalent of 45,000 games of football, or playing Super Mario Odyssey 5696 times to the end. On the other, it’s just one-thirtieth the lifespan of a Giant Tortoise (250 years, if you’re wondering). In the world of a high-growth startup, it represents a journey of many twists, turns, lessons, and accomplishments, many of which were unimaginable when we were first inking our business plan.
COVID-19 contact tracing: What's the secure coding situation?
The idea behind contact tracing apps is sound. This technology, when functioning well, would ensure hotspots are quickly revealed and comprehensive testing can occur - both essential components of fighting the spread of a contagious virus.
The forgotten human factor driving web application security flaws
How are developers supposed to write secure code if nobody ever teaches them about why its important, the consequences of insecure code, and most importantly, how to prevent writing these vulnerabilities in their respective programming frameworks in the first place?
The most dangerous software errors of 2019: More evidence of history repeating
Towards the end of last year, the amazing community at MITRE published their list of the CWE Top 25 Most Dangerous Software Errors that affected the world in 2019. And most of it was no surprise.
Secure Code Warrior - Happy 3rd Birthday to us
Our vision is to empower developers to be the first line of defence in their organisation by making security highly visible and providing them with the skills and tools to write secure code from the beginning.
Why we need to support, not punish, curious security minds
Teen security researcher, Bill Demirkapi, exposing major vulnerabilities in software used by his school certainly brought back some memories. I remember being the curious kid, lifting the hood on software to take a peek underneath and see how it all worked... and if I could break it.
Some CISOs are turning the security skills shortage into an opportunity
Empowering developers to write secure code from the start is an opportunity for CISOs to seize some proactive control from the security predicament, and where there is the chance for fast, easy and measurable improvements for both security and development teams.
DevSecOps: The Old Security Bugs Still Performing New Tricks
In cybersecurity, we are often like hunters. Our eyes are firmly glued to the horizon, scanning for the next breakout vulnerability. However, this forward-looking focus can have the surprising effect of dampening our overall security awareness.
OWASP AppSec Day 2019: Nurturing Secure Developers
These developer-focused events are among my favorite on the calendar; they provide a humbling reminder of the community that works tirelessly to educate and empower software engineers and specialists to champion security in their work.
Software Security is in the Wild West (and it's going to get us killed)
Software security is always front-of-mind for me, as is the very real danger posed by our increasingly digital, personal information-sharing lifestyles. After all, we are in a largely unregulated, unsupervised and blissfully ignored territory. We're in the Wild West.
Is your security program focused on incident response? You're doing it wrong.
Placing emphasis on a preventative - as opposed to reactive - approach may not be widely understood outside of the security team, especially if a big, bad, security incident has not taken place.
The Revamped PCI Security Standards Council Guidelines: Do They Shift Far Enough Left?
This year, the PCI Security Standards Council released an all-new set of software security guidelines as part of their PCI Software Security Framework. This update aims to bring software security best practice in-line with modern software development.
Malice in the metaverse: Fighting known cyber threats on a new frontier
The advent of the digital darling of the moment - the metaverse - adds a vast new attack surface for both code-level vulnerabilities and social engineering. And we’re simply not prepared for battle on this new playing field that thrives on smoke and mirrors.
Are your developers the first line of risk or defense? Rate your company against our Secure Coding Checklist
As CIOs aggressively build their enterprise agile capabilities, secure coding skills will be a weapon of innovation and not having them will be an instrument of destruction.
Huawei security UK problems demonstrate the need for secure coding
A recent report from the UK's Huawei Cyber Security Evaluation Centre identified major security issues within Huawei's software engineering processes. But it's a problem that can be fixed.
Static Vs. Dynamic Cybersecurity Training: Impulsive Compliance, Future Problems
While regulatory initiatives will undoubtedly improve and grow over time, if organizations are already hitting the panic button and leaping into training now, they might just find themselves ill-equipped for the future.
GitHub Users Held to Ransom with Plaintext Pain
The recent attack on GitHub repositories highlights a well-known issue within the security industry: most developers are simply not sufficiently security-aware, and valuable data could be at risk at any time.
A Brighter Future For DevSecOps? It's Closer Than You Think
There are many solutions that find vulnerabilities in code, but security needs to place more emphasis on teaching developers to follow security guidelines that will prevent them from making these mistakes in the first place.
DevSecOps in DACH: Key findings from secure coding pilot programs
With the advent of GDPR, as well as a revised strategy following a multi-stage attack that exposed the sensitive data of many public figures - as well as servers in the German federal government - it is clear that cybersecurity awareness and action are front-of-mind for leaders in the DACH region.
How do developers define "secure coding"?
The perception of what constitutes the act of secure coding is up for debate. According to recent research in collaboration with Evans Data, this sentiment was revealed in black and white. The State of Developer-Driven Security 2022 survey delves into the key insights and experiences of 1200 active developers, illuminating their attitudes and challenges in the security realm.
Women in Security: Spotlight on Fatemah Beydoun
Our VP of Customer Success, Fatemah Beydoun, recently presented her talk, "Mentoring for the future: How we can all do better in fostering female cybersecurity talent" to a very receptive audience. She has been an integral part of driving positive change within the cybersecurity industry.
In-depth security training is raising questions in education
While secure coding needs to become a mandatory component of software engineering at the tertiary level, some universities are leading the charge in providing top-notch training and prioritizing security as part of the development process from the very beginning.p
How creative CISOs and CIOs can innovate and transform their security program
Creative, inspiring CISOs and CIOs have the power to innovate and shape our digital world, but they can also be instrumental in transforming an organizations security culture.
The Great Global Patch: VxWorks Flaws Set to Compromise Millions of Devices
While VxWorks isn't a household name to the average consumer, this software product benefits many people just like you and me, each and every day. And now, we are faced with the possibility that hundreds of millions of VxWorks-powered devices are now compromised.
Why gamification is the key to leveling up your software security
We must work to change the conversation, to make security an integral part of every developer's working life. And I think one of the best ways to do this is by empowering and engaging with developers on security through, for example, gamification.
Six Years of Secure Code Warrior: Are we grown up yet?
It’s that special time of the year (for us, anyway) where I reflect on our most recent lap around the sun, and what has been done in the previous 365 days to position us for a new year of growth, lessons, and inevitable unpredictability.
Developer Tournaments: AppSec's Secret Weapon to Improve Security Culture and Engagement
Don't you think it's time we gave security a makeover? It's as simple as changing the conversation and making everything a little more positive (not to mention fun!) for both sides, especially the development team.
Take a lesson from this mindreader and make security fun again!
It doesn't matter whether you are training the C-suite in cyber security or helping developers in JAVA or C# secure coding skills, there's a place for creativity, gamification and fun.
Empathy, Gratitude, and Staying Humble: The Foundation of Our Culture
The software security industry isn't exactly known for its warm and fuzzy feelings, whimsical observations and life commentary, but, perhaps as I get older, I find myself reflecting on the impact we can all have in the world.
For Cybersecurity Best Practice, Look to the Finance Industry
With cyberattacks on the rise - affecting every type of organisation in every vertical - the threat of expensive, embarrassing and bottom-line-affecting data breaches is very real. The problem is not getting smaller, it's growing like a tumour.
The future of cybersecurity: What WON'T be happening in the year to come
In our industry, many security experts have started predicting the hot-button issues for the year, but with more than five billion sensitive data records stolen in 2019, we figured it would be more accurate to predict what won't be happening in cybersecurity in the foreseeable future.
Rethinking Software in the Organizational Hierarchy
By helping define the responsibilities of our apps and software within a tight hierarchy, and enforcing those policies with least privilege, we can make sure that our apps and software also survive and thrive despite the threat landscape arrayed against them.
Are we mature enough for the Open Source Software Security Mobilization Plan?
The Open Source Software Security Mobilization Plan represents a positive step for developer-driven security. However, we must all take stock and honestly assess if we're mature enough in our organization - and if our development teams have the right level of security awareness and skills - to implement the latest and greatest defensive strategies.
Best of the Brunch: Our Leaders in AppSec Share Their Wisdom
Addressing hot-button issues like how to make the most of an organization's AppSec budget, as well as several curly questions from the audience, the Leaders in AppSec panel delivered some real morning magic that will help security specialists build out viable programs within their organizations.
Happy 4th Birthday Secure Code Warrior, You Cheeky Little Toddler
The older my daughter and the company gets, the more I realise there are so many similarities between a startup journey and the ���first-time� parent journey. I am in my fourth year for both now.pi
Cybersecurity industry analysis: Another recurring vulnerability we must correct
We’re not getting realistic advice, nor the fastest solutions, to combat the non-stop onslaught that is modern cybersecurity. Of course, each breach is different in its own way, and there are numerous attack vectors that can be exploited in vulnerable software. Feasible generic advice will be limited, but the best practice approach is looking more flawed by the hour.
PCI-DSS 4.0 will be here sooner than you think, and it’s an opportunity to elevate your organization’s cyber resilience
Earlier this year, the PCI Security Standards Council revealed version 4.0 of their Payment Card Industry Data Security Standard (PCI DSS). While organizations won’t need to be fully compliant with 4.0 until March 2025, this update is their most transformative to date, and will require most businesses to assess (and likely upgrade) complex security processes, and elements of their tech stack. This is in addition to implementing role-based security awareness training and regular secure coding education for developers.
Proactive protection: Leveraging the National Cybersecurity Strategy for advanced threat prevention
CISA's National Cybersecurity Strategy represents the best chance we have at raising software standards across the board and, finally, ushering in a new era of security-skilled developers.
LLMs: An (im)perfectly human approach to secure coding?
While it is looking inevitable that LLM-style AI technology will change the way we approach many aspects of work - not just software development - we must take a step back and consider the risks beyond the headlines. And as a coding companion, its flaws are perhaps its most “human” attribute.
Raising the bar for secure coding: Infusing agile learning into future-ready enterprises
We announced the closing of our Series-C funding round, having raised USD $50 million towards the next phase of our mission: helping more pioneering organizations harness the power of their development cohort in thwarting common vulnerabilities.
Revealed: An exciting partnership to elevate agile learning and developer-driven security in the enterprise
Fresh off the back of our Series C funding announcement, I am thrilled to announce another step in our company’s journey. Security industry leader, Synopsys, has welcomed an exciting new addition to its product suite: Synopsys Developer Security Training, powered by Secure Code Warrior.
Is Your Security Program Ready for CISA's Cybersecurity Strategic Plan?
The Cybersecurity Strategic Plan pushes major changes to the way most organizations approach cybersecurity, and developers are in a unique position to help achieve those new goals.
The Power of Nine: Growing Secure Code Warrior’s legacy in an exciting time for cybersecurity
Today is our ninth birthday, and I remain immensely proud and grateful for our achievements and enduring place in cybersecurity land as the scene continues to change rapidly.
The XZ Utils backdoor in Linux points to a wider supply chain security issue, and we need more than community spirit to keep it at bay
A critical vulnerability, CVE-2024-3094, was discovered in the XZ Utils data compression library used by major Linux distributions, introduced through a backdoor by a threat actor. This high-severity issue allows for potential remote code execution, posing significant risks to software build processes. The flaw affects early versions (5.6.0 and 5.6.1) of XZ Utils in Fedora Rawhide, with an urgent call for organizations to implement patches. The incident underscores the critical role of community volunteers in maintaining open-source software and highlights the need for enhanced security practices and access control within the software development lifecycle.
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
The Decade of the Defenders: Secure Code Warrior Turns Ten
Secure Code Warrior's founding team has stayed together, steering the ship through every lesson, triumph, and setback for an entire decade. We’re scaling up and ready to face our next chapter, SCW 2.0, as the leaders in developer risk management.
Is Vibe Coding Going to Turn Your Codebase Into a Frat Party?
Vibe coding is like a college frat party, and AI is the centerpiece of all the festivities, the keg. It’s a lot of fun to let loose, get creative, and see where your imagination can take you, but after a few keg stands, drinking (or, using AI) in moderation is undoubtedly the safer long-term solution.
AI Can Write and Review Code — But Humans Still Own the Risk
Anthropic’s launch of Claude Code Security marks a defining collision point between AI-assisted software development, and the rapid augmentation of how we approach modern cybersecurity.
Observe and Secure the ADLC: A Four-Point Framework for CISOs and Development Teams Using AI
While development teams look to make the most of GenAI’s undeniable benefits, we’d like to propose a four-point foundational framework that will allow security leaders to deploy AI coding tools and agents with a higher, more relevant standard of security best practices. It details exactly what enterprises can do to ensure safe, secure code development right now, and as agentic AI becomes an even bigger factor in the future.
Securing the Future of Software: SCW and KnowBe4 Join Forces
I am thrilled to announce today an upcoming strategic partnership between Secure Code Warrior and KnowBe4. KnowBe4 is a world-renowned leader in comprehensively managing human and agentic AI risk, making them the perfect partner to help us distribute foundational security awareness to organizations across the globe.
Equipping Developers for the Generative AI Era: AWS Collaboration
I am proud to announce that Secure Code Warrior has signed a strategic collaboration agreement with Amazon Web Services (AWS). Given the rapid evolution of the threat landscape, this strategic collaboration could not come at a more mission-critical moment for both security leaders and future-focused developers.
SCW Learning Content for KnowBe4
Secure Code Warrior content available through KnowBe4 helps technical teams build secure coding and AI governance awareness through structured learning covering OWASP Top 10 risks, AI-assisted development, and modern secure coding practices.
.png)
Why most CISOs are navigating AI adoption blindfolded (and how they can remove it)
Today, Secure Code Warrior issued an all-new white paper covering a prescriptive, directional AI adoption model that security leaders can use to identify their adoption stage and make real progress in bringing the AI security risks within their organization under control.
Understand how AI is transforming software development—and how security must evolve with it.
From AI autocomplete to autonomous agents—explore how software development is evolving and what it means for security, governance, and your team.