Secure Code insights

For those deep in the weeds of AI implementation in enterprise software development ecosystems, few would trade places with their friendly neighborhood CISO right now. Security concerns are popping up with greater frequency as more and more processes are AI-augmented, and between making tech-stack-friendly model choices, developers using shadow AI, and, generally, the deluge of AI-written code highlighting that the security skills gap is in no danger of closing, their already complex role is getting more challenging by the month. 

The phrase “AI governance” is invoked in response to these challenges, positioned as a catch-all solution for safe AI integration and ongoing use, even by those who are not security-proficient. While yes, that is a solution, it’s a little hard to execute from a security best-practices playbook when the company’s AI adoption stage is unclear.

Even if we focus solely on the development cohort, there will still be variation in AI adoption among team members. For example, some may just ask Copilot a few questions here and there, using it as a replacement for a traditional discussion forum, while others may be experimenting with agentic AI systems that represent a significant jump in autonomy, power, and access to potentially sensitive codebases. A range of frontier and open source large language models are used to build code, agents are using Model Context Protocol (MCP) technology and Skills to access external tools, and innovative supply chain attacks are putting the whole ecosystem on alert. This behavior will dramatically increase an organization's attack surface, and controlling this growing risk keeps security leaders up at night.  

How do you convince the laggard AI-adopters to accelerate, and give them peace of mind regarding the outcomes of AI tools in software development, but at the same time, make them acutely aware of the security mistakes these tools will still make? How do you convince early adopters not to move too quickly with agentic engineering, thereby exposing your organization to uncontrolled and unknown risks? The message “Move fast but not too fast” seems to be the only sensible thing a CISO can do these days.

When traceability and observability of AI tools are in use, the security efficacy of both the tool and user, and the security of the commits they are permitted to make, are the key data points to consider when updating a security program for the AI era. 

We must get comfortable with honestly assessing the adoption stage of the company, and we have some exciting direction to share with you on that front.

Today, Secure Code Warrior issued an all-new white paper covering a prescriptive, directional AI adoption model that security leaders can use to identify their adoption stage and make real progress in bringing the AI security risks within their organization under control.

What is an AI adoption model, and why would we need it?

Developers can no longer operate simply as code writers; they must step into the roles of creators and orchestrators. We are watching the traditional Software Development Lifecycle (SDLC) transition to the Agentic Development Lifecycle (ADLC), and few are prepared to handle it safely and efficiently. 

AI adoption is no longer strictly confined to traditional engineering. Today, even non-developer employees are building applications using no-code and vibe coding tools, which significantly contributes to an organization's overall risk profile. Faced with an attack surface that expands faster than traditional controls can keep pace, Chief Information Security Officers (CISOs) are constantly asking me a critical question: where do we start? 

CISOs desperately need an approach to ADLC governance that is as modern as the methodology itself: an approach designed specifically for agentic AI’s evolving, adaptive nature. This is exactly why we rolled out this AI adoption model, and it represents a critical piece of the defense puzzle for CISOs at a time when they are craving high visibility and adaptive plans that suit their stage of adoption. We designed this framework to help organizations transform secure AI adoption and governance from a reactive exercise into a measurable, scalable discipline.

What can security leaders take away from this right now?

The model serves as a practical roadmap that organizes AI development into three distinct phases: AI-Assisted, AI Native, and Agentic. For a CISO, the framework's primary advantage is its ability to seamlessly connect AI usage, developer capability, and software risk signals. Because not all AI use carries the same risk, this model gives organizations a clear map to identify exactly where they sit today, informing data-driven insights for safe, cost-effective AI decision-making.

By defining the specific governance controls required as AI autonomy increases, this AI adoption model empowers CISOs to deliver targeted training that meets developers exactly where they are. Analysts predict that by 2027, more than 40% of agentic AI projects will be abandoned due to uncontrolled costs and poor risk controls. The answer to this threat isn't simply using more AI to catch AI-generated mistakes. The real win for CISOs is having a framework that trains developers to use AI correctly from the start, avoiding repeated vulnerabilities while demonstrating tangible, measurable governance ROI.

‍

EXPLORE THE FRAMEWORK

READ MORE: SCW Trust Agent: AI

A fundamental indicator of a mature and sustainable secure coding program is the implementation of Enabler 5: Certification Programs. Moving beyond introductory training, a successful program offers a structured path that helps developers continuously build their skills. Not only do certifications help ensure developers' continued engagement, but they also reinforce that developers’ achievements are valuable and important to the company overall. 

Progression, Not Just Participation

The primary goal of a multi-level certification program is to establish what developer progress looks like and give them something meaningful to achieve.

It is essential that secure coding education is not a 'one-and-done' approach. To drive developers to regularly return to your chosen training platform and achieve higher levels of secure coding knowledge & skill, the program must have clear progression and differentiated levels. They can be playful and fun as well as provide highly visible structured progression. Examples include: 

• Medals - Bronze, Silver, Gold, and Platinum
• Martial Arts Belts - White, Yellow, Green, Black, etc.
• Military Rankings - Private, Corporal, Lieutenant, Colonel, etc.
• Video Game Examples - Initiate, Cadet, Sentinel, and Champion

Other ideas include simple numbered lists or elements related to your own organization or program branding (see Enabler 8: Branding Your Program). Remember that continuity in program branding helps ensure a seamless experience that can add some fun for your developers.

How Certification Drives Lasting Skills

The structure of your certification program utilizes specific activities to ensure skills are not just learned, but retained and validated:

To maximize impact, organizations must articulate the impact and benefit of moving through the different levels. This might include incentives like rewards or recognition for reaching certain levels (Enabler 7: Developer Recognition) or even requiring secure code training for career advancement (Enabler 10: Training Linked to Career Progression). 

Embedding Value with Executive Support 

For the certification achievement to hold weight, it must be officially recognized by your organization. Ideally, the C-Suite (related to Enabler 2) should add their names to the certificates. This simple act signals to the entire development community that achieving secure coding skills is valuable and important to the company overall.

Other opportunities for executives to highlight their achievements in professional spaces include team meetings, internal newsletters, company awards nights, and professional platforms like LinkedIn.

Certification and Program Maturity

Certification programs are a critical element for elevating your secure coding program’s maturity. They transform secure code training from a static requirement into a dynamic career pathway, giving developers tangible and progressive professional achievements to strive for.

With 4–6 enablers implemented, including certifications, a program has reached the Adopting stage, meaning the developers have begun to engage with and adopt the program and the organization as a whole has begun to incorporate secure coding as the foundation of its SDLC. Our next post will discuss Enabler 6: Regular Reporting to Leadership, which provides regular, relevant updates to help ensure continued executive buy-in.

You can also check out last month's blog on Enabler 4: Low Barrier to User Access here.

Have additional questions? 

Customers can contact the account team or support@securecodewarrior.com. Prospective customers can speak with a member of our sales team by contacting us here.

‍

The National Security Agency's Artificial Intelligence Security Center (AISC) recently published its first formal cybersecurity guidance for the Model Context Protocol (MCP): Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation. It covers access control, prompt handling, tool execution, agent permissions, auditability, and governance of third-party integrations. These are the core implementation concerns that come with building MCP servers and tools as production services.

As software development shifts from human-written code to AI-assisted workflows and fully agentic systems, the security of agent communication protocols is becoming a critical concern. These are areas Secure Code Warrior has been investing in for some time. In November 2025, Secure Code Warrior introduced one of the industry's first dedicated MCP security learning pathways, helping organizations prepare developers for the emerging risks associated with agent communication protocols, AI agents, and MCP-enabled workflows.

At the time, there was no publicly available OWASP MCP Top 10 and no formal government guidance focused specifically on MCP security. Our content team conducted extensive research into the emerging security challenges around MCP implementations and developed a curriculum to help developers build and use MCP securely in real-world production environments.

We’ve kept pace since. New NSA guidance, evolving OWASP MCP research, and real-world exploitation examples all feed into the curriculum as the threat landscape shifts. 

The publication of formal NSA guidance reinforces the importance of this work, and validates it. Of the 23 discrete security issues the NSA raises, Secure Code Warrior's curriculum provides direct coverage of 18. As organizations move from experimenting with agentic systems to actually running them, the gap between governance policy and implementation reality becomes a risk. Closing it requires developer capability. Frameworks alone won’t do it. 

The Role of Developer Capability

Read past the technical specifics of the NSA guidance and a consistent theme emerges: the security of MCP-enabled systems comes down to how they’re built. Access controls, trust boundaries, output validation, audit logging. None of these securely configures itself.

Validating inputs, constraining permissions, establishing trust boundaries, monitoring activity. The NSA’s recommendations are implementation-level. You can’t policy your way to them. They require developers who understand what they’re building, how it could be misused, and why it matters.

As organizations continue adopting AI-assisted and agentic development workflows, developer capability is one of the three things organizations need to get right in the agentic era. The other two: visibility into what AI is doing in your codebase, and governance guardrails on what it can touch. Secure Code Warrior addresses all three: Developer training, Trust Agent’s commit-level risk correlation, and the guardrails and traceability compliance teams actually need.

Secure Code Warrior Coverage for MCP Security

Secure Code Warrior's MCP and AI security curriculum was built for exactly this. Here’s how it maps.

The following content is available today and directly covers 18 of the 23 discrete security issues the NSA raises — across concerns, real-world examples, and recommendations. It helps organizations build developer capability across key areas of MCP security agent communication protocols, prompt handling, secure implementation practices, and AI-enabled development workflows.

NSA focus area	SCW coverage
Agent communication security	Vulnerabilities in agents and their communication protocols Agent communication protocols Best practices for agent and communication protocol security
Prompt & output security	Direct prompt injection Indirect prompt injection Improper output handling
Agent behavior & control	Excessive agency Unbounded consumption Insecure plugin design
MCP secure coding	OS command injection Code injection Missing authentication Credential expiration Function level access control Security misconfiguration SSRF Insufficient logging
Secure design & governance	LLM security design patterns Supply chain vulnerabilities Vulnerable components from untrusted source (MCP variant) Improper assets management (MCP variant)

This isn’t coverage built to match the NSA document after the fact. Questions around agent communication security, prompt handling, access control, governance, and secure implementation are no longer theoretical concerns — and neither is our coverage of them. Our AI Agents curriculum addresses the same real-world attacks documented by the NSA, drawing on the same research sources, including the Invariantlabs WhatsApp MCP exploit and tool-poisoning studies. They are practical considerations for teams deploying AI-enabled systems today.

A note on gaps: The analysis reflects direct coverage across the majority of what the NSA raises. A small number of items (including MCP message-level cryptographic signing and cross-implementation behavioral divergence) represent areas where our content addresses the underlying principle but not the full depth the NSA recommends. These are on our curriculum roadmap.

Organizations that invest in developer education alongside governance and visibility initiatives are often better positioned to adopt emerging technologies securely and at scale. Developer capability is one part of the picture. Secure Code Warrior also helps organizations govern what AI agents can and can’t touch in their repositories, and provides the traceability compliance and incident response demand across the full development lifecycle.

Where Teams Can Start

Organizations looking to align developer education with the implementation practices highlighted throughout the NSA guidance can begin with Secure Code Warrior's Python-MCP Quest and TypeScript-MCP Quest pathways.

These learning pathways cover the majority of the developer-focused concepts reflected throughout the guidance and provide hands-on experience with MCP-specific security considerations, agent communication protocols, secure implementation practices, and AI-enabled development workflows.

For security leaders evaluating how to operationalize AI Software Governance, developer capability remains one of the most practical and measurable controls available. Governance policies establish expectations. Visibility helps identify risk. Developer capability helps reduce risk at its source.

Final Thoughts

The NSA doesn’t publish cybersecurity guidance for emerging protocols lightly. The fact that MCP warranted a dedicated document reflects where agentic development is heading and the real-world risk that comes with it.

Secure Code Warrior's MCP and AI security curriculum already covers many of the implementation practices and security considerations highlighted throughout the guidance. The guidance reinforces the importance of secure implementation, governance, and developer capability as foundational elements of responsible AI adoption.

MCP adoption is accelerating, and the security challenges that come with it are not theoretical. As MCP-enabled systems move into production, secure implementation, visibility, governance, and traceability become critical. Secure Code Warrior sits at the center of that — training developers as the tooling evolves, governing what AI agents touch in your repositories, and delivering the traceability compliance and incident response demands.

‍

Named in two categories in the same report

Secure Code Warrior is recognized in two categories — Agentic Coding Security and Secure Coding Training. We feel Together they tell a single story: as AI agents take over more of the development
process, the skills your developers need and the governance your organization demands have never mattered more. SCW delivers both.
‍

Why this matters to us

‍

What Gartner Says

‍

How SCW addresses the challenge

‍

The development transition — where are you today?

SCW Learning

Enable developers with targeted security upskilling tailored for their role in AI-assisted workflows — at every stage of the transition.

SCW Trust Agent

Ensure every code change and commit is governed by policy — with full visibility and accountability into what AI did, where, and for whom.

‍

Ready to govern AI-driven development?

See how Secure Code Warrior gives your engineering teams the visibility, guardrails, and capability to securely adopt AI development — at every stage of the transition.
‍
Talk to us → securecodewarrior.com

‍_{Gartner, Hype Cycle for Secure Software Engineering, Aaron Harrison, June 2026. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research and advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally.}

Having trouble keeping up with the hypersonic movement of the AI industry? You’re not alone. If you ask me, we’re currently in the first stages of the “pain period” if you’re on the security side of things; after all, it’s not every day that something like Claude Mythos is released to give security leaders the migraine of a lifetime. 

However, this is not the time to panic, get caught up in headline hype, or, most importantly, fail to prepare for one of the most significant evolutions in software development we will see in our lifetimes. 

This transformation might be driving “unprecedented” (there’s that word again) innovation, but it is also introducing code churn at an alarming rate, with the ratio of deleted to added lines in merged code increasing by 861% each quarter amid high AI adoption, according to Faros’ 2026 AI Engineering Report. Additionally, source code has now become the most common data type submitted to unauthorized external AI models, posing a serious risk of intellectual property exposure.

The downstream consequences are measurable and severe. Exploitation of vulnerabilities has overtaken credential abuse as the leading breach method, accounting for 31% of initial access vectors (this stat, along with other concerning data points, can be found in the 2026 Verizon Data Breach Investigations Report). To protect the AI roadmaps that enterprises are betting their futures on, risk reduction must move further upstream. That is exactly why Secure Code Warrior unveiled our new Adaptive Learning capability at the 2026 Gartner® Security & Risk Management Summit.

As I noted during our launch, enterprises today are trying to achieve three primary objectives at every stage of development. First, developers and agents must learn to build securely. Second, businesses must govern what AI can and can’t touch in the codebase. Third, security teams must be able to trace which AI did what, where, and for whom. With SCW’s Adaptive Learning, organizations and developers can swiftly move from merely understanding risk to actively reducing it at scale, with measurable proof at the commit level. This is absolutely imperative as developers transition from traditional workflows into environments where they act as orchestrators of autonomous agents.

Adaptive Learning bridges SCW Trust Agent with our entire learning platform, ensuring training stays perfectly aligned with real-time developer activity. 

By utilizing AI Signals, we detect the specific AI tools developers use, down to the lines of code they commit, automatically triggering personalized training tailored to their exact actions. Simultaneously, Vulnerability Signals connect your existing security tools directly to developer learning, identifying real vulnerabilities in active repositories and building the secure coding habits necessary to keep flaws out of production. Ultimately, this generates auditable, per-developer evidence of AI security training that supports compliance with the EU AI Act, ISO/IEC 42001, and the NIST AI Risk Management Framework.

As we look toward the immediate future, the impending integration of highly advanced, hyper-autonomous models like Claude Mythos presents a paradigm-shifting capability that could easily spiral into a disaster if an enterprise's security leaders are unprepared. Unleashing an agent as powerful as Mythos in a corporate environment without strict guardrails - whether deliberate or via the hands of a bad actor - risks the widespread proliferation of vulnerabilities and unauthorized manipulation of the codebase at machine speed. This is where SCW’s suite of AI software governance tools can serve as a vital safety net. 

By combining deep visibility into AI actions, strict policy enforcement on what AI can access, and Adaptive Learning to immediately upskill developers when a high-end agent generates risky code, SCW can walk beside you and prevent a potential crisis.

Secure coding learning aligned to real AI usage, developer workflows, and modern software development practices.

AI-assisted development is already becoming part of everyday engineering work.

A developer may manually write core application logic in the morning, use AI to generate test coverage in the afternoon, then review AI-assisted pull requests before the end of the day. The workflows are fluid. The tooling changes quickly. Usage patterns evolve week to week, sometimes team to team.

Historically, secure coding learning operated on relatively fixed cycles — onboarding pathways, annual assignments, broad role-based training, or periodic awareness campaigns. Those models made sense when development tooling evolved more gradually and learning requirements stayed relatively stable over time.

AI-assisted development moves differently. Security teams now need a more responsive way to keep secure coding guidance connected to how developers are actually working in the moment.

Adaptive Learning is designed to help organizations align secure coding learning to real software development activity and software risk signals across the SDLC.

‍That includes AI-assisted development activity, vulnerability findings, and evolving developer behavior tied to how software is actually being built.

In this post, we’re focusing specifically on Adaptive Learning with AI Signals powered by Trust Agent: AI — using AI-assisted development detections to help organizations dynamically align secure coding guidance to developers actively using AI coding tools in day-to-day development work.

Learning That Reflects Real AI Usage

Secure coding learning has always been most effective when it reflects the way developers actually work. Organizations already align learning by role, coding language, technology stack, and vulnerability focus areas to make training more relevant across engineering teams.

AI-assisted development introduces an additional layer of context.

An engineer experimenting with AI-generated Python code today may spend next month reviewing infrastructure-as-code in Terraform or using AI to accelerate frontend testing workflows. Some developers rely heavily on AI coding assistants. Others barely touch them.

Adaptive Learning helps organizations turn AI visibility into targeted secure coding guidance. When Trust Agent: AI identifies AI-assisted development activity, organizations can automatically assign learning aligned to those workflows.

That means developers actively using AI coding assistants can receive targeted learning tied to the work already happening inside their environment — without security teams manually identifying individual developers and repeatedly reassigning learning as AI usage expands across engineering teams.

Adaptive Learning in Practice

Adaptive Learning powered by Trust Agent: AI is designed to fit naturally into existing software development workflows.

Security teams can create targeted learning aligned to secure AI-assisted development practices, then use Trust Agent: AI detections to dynamically assign that learning to developers actively using AI coding tools in their day-to-day workflows. As developers begin interacting with AI-assisted development environments, relevant secure coding guidance is automatically assigned based on that activity.

The walkthrough above demonstrates how Adaptive Learning with AI Signals works in practice, including configuring Trust Agent Detection, creating adaptive Quests, dynamically assigning learning, and tracking participation and completion.

For step-by-step setup instructions and configuration details, explore the adaptive Learning with Trust Agent: AI knowledge base article.

Secure Coding Guidance Should Reflect How Developers Actually Work

AI-assisted development is already part of everyday engineering workflows. Developers are moving quickly between AI-generated suggestions, manually written code, automated testing, and pull request review throughout the day.

As those workflows continue evolving, secure coding guidance needs to stay connected to the way software is actually being built.

Adaptive Learning powered by Trust Agent: AI helps organizations do exactly that — aligning learning to real AI-assisted development activity so guidance reaches developers when it is most relevant and actionable. 

The result is secure coding guidance that stays relevant as AI tooling evolves — without adding overhead to the security teams responsible for running the program.

Adaptive Learning helps reduce recurring vulnerabilities through hyper-targeted training aligned to actual software risk.

Development teams are shipping code faster than ever, but many organizations still struggle to prevent  the same vulnerabilities from being introduced repeatedly over time.

Most security training programs remain disconnected from the risks developers actually create day to day. Learning is assigned broadly, vulnerabilities continue recurring, and organizations are often left addressing the same issues downstream after insecure code has already moved further through development workflows.

Adaptive Learning helps organizations align secure coding learning to real software development activity and risk signals, including AI-assisted development activity, vulnerability findings, and evolving developer behavior.

In this post, we’re focusing specifically on Adaptive Learning with Vulnerability Signals — automatically assigning targeted vulnerability training to the developers introducing those risks.

Adaptive Learning in practice

Adaptive Learning with Vulnerability Signals connects vulnerability findings with Trust Agent: Commits activity to identify which developers are actively contributing to repositories associated with elevated software risk. Targeted training is then automatically assigned based on the vulnerability patterns developers are actually introducing, helping align learning to the languages they use, the repositories they contribute to, and the real software risks tied to their day-to-day work.

Because learning is aligned to the specific risks developers are actively contributing to, training becomes more relevant, timely, and easier to apply within day-to-day engineering workflows.

From completion metrics to real risk visibility

Adaptive Learning creates a stronger connection between secure coding learning and real engineering activity.

Once developers are assigned learning, commits to covered repositories can be scored against whether assigned vulnerability training has been completed at the time of the commit. This gives security leaders visibility into something traditional training metrics often cannot show: whether the developers actively writing code are equipped to handle the specific risks present in their environment.

That shifts the conversation from:

“Did developers complete their training?”

to:

“Are the developers contributing to high-risk repositories prepared to identify and prevent the vulnerabilities most relevant to the code they are shipping?”

Instead of relying only on generic completion reporting, organizations can begin measuring developer capability alongside real software risk and commit activity over time.

This helps move secure coding programs closer to preventative capability building at the source — reinforcing secure development practices before vulnerabilities reach production rather than relying entirely on downstream remediation workflows.

Building more preventative secure development practices

Adaptive Learning with Vulnerability Signals helps connect vulnerability findings, commit activity, developer attribution, secure coding learning, and commit scoring within a single workflow.

By aligning targeted learning to real software risk, organizations can reduce recurring vulnerabilities, strengthen developer capability, and reinforce more preventative secure development practices across engineering teams.

Building a successful secure coding program hinges not just on having great content and executive support, but also on making that content effortlessly accessible to the people who need it: the developers. This is the core principle behind Enabler 4: Low Barrier to User Access.

By implementing Enabler 4, organizations ensure easy developer access to their organization's chosen learning platform so learners can start engaging with training content immediately.

The Essence of Low Barrier to Entry

Ensuring ease of access and low 'barrier to entry' to your training platform of choice is essential to the success of your program. It helps reduce friction between developers and the desired learning activities they'll engage with. It also allows your Developer Communications Plan (Enabler 3) to have the maximum possible impact because authentication and access to training have already been established.

Whether you are using Secure Code Warrior for developer training or not, ideally, your developers will find it very quick and easy to get onto your chosen training platform. The ultimate goal is to access assigned learning activities with a single click.

The Critical Role of Seamless Access

If onboarding for your secure coding program is perceived as too difficult or awkward, the program simply will not scale. Organizations risk losing a percentage of developers if they have to "jump through hoops" to get onto the platform.

Communications asking developers to click more than once to access training often see a loss of engagement, with 30–40% of recipients never clicking a second time.

Imagine having successfully implemented the first three enablers (establishing clear value drivers, securing full C-suite support, and launching high-impact communications) only to discover that developers face unnecessary hurdles upon entry. In this scenario, developers will likely abandon the effort and turn to something else with their valuable time.

Implementing Low Barrier to User Access

Achieving a low barrier to entry relies on key technologies and smart implementation strategies:

1. Single Sign-On (SSO): Utilizing SSO auto-provisioning (a single sign-on configuration option) can significantly help enable quick and easy developer access to relevant platforms. However, this introduces a trade-off between the ease of access and administrative overhead. Depending on your chosen security training platform, this will likely require a discussion with tech-enabled stakeholders such as your IT team.
2. Front-Loaded Onboarding: To overcome the "two-click barrier," consider using APIs to fully onboard and enable all users up front. This ensures the first click in the communications email is a direct link straight to the learning activity, providing immediate value without the need to jump through hoops.
3. Relay State Functionality: A RelayState parameter supports redirection from SSO to a specific resource. This is often used for IDP-initiated SSO to target a specific screen, like training curriculum, ensuring the user lands exactly where they need to be.

Whatever strategy you plan to utilize for easy developer access to your training platform, ensure the right technical stakeholders are there to support your rollout. Key team members include your training platform CSM and internal IT team.

Program Maturity and Value

Low barrier to user access is an essential step in progressing your secure coding program's maturity, as you reach past the Defining Stage (1–3 enablers implemented), into the Adoption stage (4–6 enablers implemented). If developers' paths are clear, seamless, and lead directly to training, engagement will soar, delivering maximum impact.

With easy developer access secured, our next post will discuss Enabler 5: Certification Programs. This enabler focuses on implementing multi-level programs to manage developer progression and provide meaningful achievements.

You can also check out last month's blog on Enabler 3: Developer Communications Plan here.

Have additional questions?  Customers can reach out to account team members or to support@securecodewarrior.com. Prospective customers can speak to someone on our sales team by contacting us here.

The wall-to-wall coverage of seismic changes to our industry and beyond is clear evidence that software development is being augmented by generative and agentic AI technology on an unprecedented scale. While the speed and productivity gains of the latest generation of AI coding assistants are undeniable, a worrying trend has emerged. These powerful autonomous tools are being rapidly deployed in enterprise environments, yet many organizations are simply not equipped to address the inherent security issues associated with their use.

As enterprises race to adopt generative AI applications, an inherent level of risk is inevitably introduced into the software development life cycle. However, this risk dramatically increases when developers are not properly trained on the new tools and platforms they use. We have reached a point where human governance is paramount, and security leaders must prioritize modernizing their programs to adequately shield against AI-generated vulnerabilities.

This is why I am proud to announce that Secure Code Warrior has signed a strategic collaboration agreement with Amazon Web Services (AWS). Given the rapid evolution of the threat landscape, this strategic collaboration could not come at a more mission-critical moment for both security leaders and future-focused developers.

Through this agreement, we have launched new interactive, hands-on training modules within the Secure Code Warrior platform designed specifically for Amazon Bedrock, a fully managed service that makes it easy to build and scale generative AI applications. These Bedrock-specific secure coding modules focus on securing infrastructure-as-code with Terraform, guiding developers in mitigating risks unique to AI- and LLM-based applications.

In my view, developers need much more than theoretical guidance to navigate this new landscape safely; they require practical experience in identifying and mitigating real-world threats. Relying on flat training exercises or anecdotal data does little to uplift a security program or build true developer proficiency. Instead, developers need controlled, direct exposure to emerging vulnerabilities such as prompt injection, excessive agency, insufficient logging, and information exposure. By delivering new content that includes 4 Coding Labs, 4 AI Challenges, and 1 Walkthrough Mission, we are providing exactly this type of rigorous, practical experience.

Agentic models have increasing autonomy, and they must be treated with the same careful management and security oversight as the humans operating them. If an enterprise tech stack lacks tools that oversee developer security proficiency and the trustworthiness of AI coding companions, security initiatives will fall short. Our strategic collaboration with AWS directly addresses this gap by helping enterprise teams learn to confidently spot and address AI red flags.

Ultimately, our overarching goal is to empower teams to build AI applications that are secure by default. By fostering Secure by Design habits and continuous risk awareness, we can safely harness the power of agentic AI. If you don’t know where your code is coming from or the security proficiency of the developer guiding the AI, it stands to reason that this code should not be going into any repository (especially one containing sensitive data). With these new Amazon Bedrock modules, we are honored to illuminate a secure path forward for AI-assisted development.
‍
To learn more about Secure Code Warrior’s new Bedrock modules, please visit the SCW learning content guide.