Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.
Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.
We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Measuring ROI of Organizational Secure-by-Design Efforts
An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here.
In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices.
The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.
How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score
It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.
The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.
Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:
- The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
- The financial services industry possessed the highest Trust Score of 336;
- Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
- When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.
The Solution | Conclusion
SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.
Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.
Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.
We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Measuring ROI of Organizational Secure-by-Design Efforts
An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here.
In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices.
The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.
How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score
It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.
The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.
Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:
- The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
- The financial services industry possessed the highest Trust Score of 336;
- Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
- When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.
The Solution | Conclusion
SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.
Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.
It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.
Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.
We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Measuring ROI of Organizational Secure-by-Design Efforts
An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here.
In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices.
The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.
How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score
It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.
The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.
Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:
- The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
- The financial services industry possessed the highest Trust Score of 336;
- Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
- When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.
The Solution | Conclusion
SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.
Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
It has been heartening to witness CISA’s Secure-By-Design (SBD) movement gain momentum worldwide, as the United States, Australia, New Zealand, Canada, Singapore, Japan, Germany, and the UK commit to weaving similar guidelines into their broader cybersecurity strategies, and many of these nations also contributing to the original recommendations.
Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge, indicating broader industry commitment to higher software quality and security standards. We see these guidelines as a crucible moment for cybersecurity leaders who, for the first time, have global government support for significant cultural change in software development. While these recommendations are not yet mandatory outside of software vendors selling directly to the US government, I see this as not just the future, but a golden opportunity to start fighting back against threat actors. Central to the guidelines is striving toward removing categories of vulnerabilities, and industry-wide focus on this goal could see us making the most significant, positive impact on digital safety in decades.
We believe this movement is critical, and our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Measuring ROI of Organizational Secure-by-Design Efforts
An overhaul of long-established software development practices is no small undertaking. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels, with many expressing growing frustration at budget reduction and a lack of top executive buy-in to new cyber initiatives. However, a data-backed proposal will make all the difference here.
In recent years, the absence of a skills benchmark to enable organizations to evaluate how they’re tracking against industry standards has been a key challenge. This has made it incredibly difficult to devise and implement security programs that impact the right areas and foster continuous improvement of the development cohort, a crucial element of successful software security practices.
The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring the regulators that those skills are in place. So, we decided to analyze developer team readiness, and the results may surprise.
How Companies Trying to Accelerate Their SBD Initiatives Can Take Advantage of Trust Score
It’s virtually impossible to improve efficiently without a solid idea of where you’re starting and where you need to go. However, hundreds of enterprise customers effectively utilize SCW Trust Score—a global benchmark that quantifies developer teams’ security competencies—to provide these helpful, granular data points. These insights shape highly effective, developer-driven security programs that are conducive to successful Secure-by-Design initiatives.
The analysis revealed in our white paper shows that organizations across the top critical infrastructure industries are progressing in preparing their developers to advance their SBD initiatives. We also found that these industries’ developer teams possess an average security posture.
Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points, across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:
- The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally;
- The financial services industry possessed the highest Trust Score of 336;
- Most large-scale Secure-by-Design upskilling initiatives are successful, while smaller-scale initiatives tend to be scattered. However, when given a mandate, they have been shown to deliver a measurable return on investment (ROI) sooner;
- When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000 developers+ in a single company) can predictably reduce vulnerabilities by 47-53%.
The Solution | Conclusion
SCW Trust Score is a powerful tool in any security leader’s arsenal, allowing a comprehensive drill-down to specific areas within an organization. Reports can be filtered according to languages, teams, or categories, producing customized reports that allow companies to address the specific needs of developers or teams and identify the areas where additional training or coaching is needed. After all, security is a never-ending endeavor; effectively benchmarking performance will help identify opportunities for continuous improvement.
Accelerated software development and deployment, coupled with an ever-more-menacing cyber threat landscape and increasingly hawk-eyed regulators, have put cybersecurity on the front burner. Organizations, if they haven’t already, must prioritize developing an enterprise-wide security-first culture.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Secure by Design: Defining Best Practices, Enabling Developers and Benchmarking Preventative Security Outcomes
In this research paper, Secure Code Warrior co-founders, Pieter Danhieux and Dr. Matias Madou, Ph.D., along with expert contributors, Chris Inglis, Former US National Cyber Director (now Strategic Advisor to Paladin Capital Group), and Devin Lynch, Senior Director, Paladin Global Institute, will reveal key findings from over twenty in-depth interviews with enterprise security leaders including CISOs, a VP of Application Security, and software security professionals.
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
Finding meaningful data on the success of Secure-by-Design initiatives is notoriously difficult. CISOs are often challenged when attempting to prove the return on investment (ROI) and business value of security program activities at both the people and company levels. Not to mention, it’s particularly difficult for enterprises to gain insights into how their organizations are benchmarked against current industry standards. The President’s National Cybersecurity Strategy challenged stakeholders to “embrace security and resilience by design.” The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code, but also assuring the regulators that those skills are in place. In this presentation, we share a myriad of qualitative and quantitative data, derived from multiple primary sources, including internal data points collected from over 250,000 developers, data-driven customer insights, and public studies. Leveraging this aggregation of data points, we aim to communicate a vision of the current state of Secure-by-Design initiatives across multiple verticals. The report details why this space is currently underutilized, the significant impact a successful upskilling program can have on cybersecurity risk mitigation, and the potential to eliminate categories of vulnerabilities from a codebase.
Secure code training topics & content
Our industry-leading content is always evolving to fit the ever changing software development landscape with your role in mind. Topics covering everything from AI to XQuery Injection, offered for a variety of roles from Architects and Engineers to Product Managers and QA. Get a sneak peak of what our content catalog has to offer by topic and role.
Resources to get you started
Revealed: How the Cyber Industry Defines Secure by Design
In our latest white paper, our Co-Founders, Pieter Danhieux and Dr. Matias Madou, Ph.D., sat down with over twenty enterprise security leaders, including CISOs, AppSec leaders and security professionals, to figure out the key pieces of this puzzle and uncover the reality behind the Secure by Design movement. It’s a shared ambition across the security teams, but no shared playbook.
Is Vibe Coding Going to Turn Your Codebase Into a Frat Party?
Vibe coding is like a college frat party, and AI is the centerpiece of all the festivities, the keg. It’s a lot of fun to let loose, get creative, and see where your imagination can take you, but after a few keg stands, drinking (or, using AI) in moderation is undoubtedly the safer long-term solution.
Developer-driven coding.
Securely.
Contact us today and make software security an intrinsic part of your development process.
