Insights from experts shaping secure development

Recientemente, NGINX ha revelado una vulnerabilidad de día cero. Casi al mismo tiempo, Microsoft ha revelado otra vulnerabilidad crítica: la vulnerabilidad RPC RCE de Windows. En esta publicación, puede averiguar quién corre el riesgo de sufrir estos dos problemas y cómo podemos mitigar el riesgo.

Los ataques de día cero, por definición, no dan tiempo a los desarrolladores para encontrar y corregir las vulnerabilidades existentes que podrían explotarse, porque el actor de la amenaza fue el primero en entrar. El daño ya está hecho y, a continuación, se pone manos a la obra para arreglar el daño causado tanto al software como a la reputación de la empresa. Los atacantes siempre tienen una ventaja, y cerrar esa ventaja en la medida de lo posible es crucial.

Por segundo año, nos asociamos con Evans Data Corp. para llevar a cabo una encuesta exhaustiva de la comunidad mundial de desarrolladores en relación con las habilidades, las percepciones y los comportamientos en lo que respecta a las prácticas de codificación seguras, y su impacto y relevancia percibidos en el ciclo de vida del desarrollo de software (SDLC). Los resultados fueron bastante sorprendentes en muchos sentidos.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

Developer security advocate Secure Code Warrior has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams.

We’ve established that developers are an integral—yet frequently underutilised—part of reaching a state of software security excellence. This is especially relevant to more than just PCI DSS compliance. It is crucial that developers understand the broader picture of PCI DSS 4.0 - even if they are not subject to it - in terms of what they can control and integrate as part of their default approach to a software build.

Teams that implement agile learning in secure code, along with safe deployment of AI assistive tooling enjoy the benefit of hands-on experience with the tools while achieving security at speed. This has been notoriously difficult to achieve, especially if developers have little experience with security awareness and training. The “just-in-time” approach directly ties into what developers are doing on a day-to-day basis, with context that allows them to anticipate and solve relevant vulnerability problems that have been created by AI.

See how 16 leading AI models actually code, scored across 11 real-world frameworks and 1,760 codebases — the framework matters as much as the model.

AI risk doesn't stop at engineering. Get the one-pager on Citizen AI — build AI literacy and safe habits across your whole workforce.

From AI autocomplete to autonomous agents—explore how software development is evolving and what it means for security, governance, and your team.