OpenText Application Security and Secure Code Warrior combine industry-leading vulnerability detection with AI Software Governance and developer capability.

Together, they enable organizations to gain visibility into AI-assisted development, correlate software risk at the commit level, and strengthen secure coding behavior through targeted, hands-on learning.

This integrated approach helps teams reduce vulnerabilities at the source, govern AI-driven development, and confidently scale modern software delivery.

Read more about the partnership in our One Pager.

Secure Code Warrior is an AI Software Governance platform designed to enable organizations to safely adopt AI-driven development by bridging the gap between development velocity and enterprise security. The platform addresses the "Visibility Gap," where security teams often lack insights into shadow AI coding tools and the origins of production code.

Secure Code Warrior provides one of the industry’s most comprehensive secure coding and AI security training catalogs, designed to help developers build safer software across modern development environments.

The SCW Learning Content Guide outlines the breadth and depth of training available across the Secure Code Warrior platform, including secure coding vulnerabilities, AI security topics, programming languages, frameworks, and role-based learning paths.

Inside the guide, you’ll find detailed coverage of training content mapped across common vulnerabilities, developer roles, and the technologies used in modern software development.

Download the guide to explore the full secure coding training catalog and discover how Secure Code Warrior helps organizations build lasting secure coding capability across engineering teams.

Want to dominate the OWASP Top 10? Download the No-BS Guide to Defending Your Applications Against the OWASP Top 10:2025

The ten most common security vulnerabilities don’t stand a chance against security-skilled, quality developers like you. This free eBook is your ultimate field guide to understanding each infamous entry in the OWASP Top 10 2025 and how each bug operates. 

You’ll see why they’re so dangerous and, most importantly, how you can banish every one of them from your software forever. As an added bonus, this guide features links to guided video learning modules to assist your skill development.

You'll:

• Learn how to identify and defeat common bugs, like injection flaws and the number one, Broken Access Control
• Gain new insights and hands-on learning into brand-new entries like Software Supply Chain Failures and Mishandling of Exceptional Conditions
• Understand why secure coding and focus on code quality are robust defences in reducing the risk of vulnerabilities and cyberattacks.

Are you ready for your next secure coding conquest?

Defining an agile secure coding learning plan is not an easy task, especially when there are compliance requirements and release deadlines to meet. But it is a worthwhile endeavor that will yield benefits such as improved productivity and reduced risk. 

Security maturity in development teams is assessed based on their collective ability to shift left and embed security through all stages of the software development lifecyle, enabling security-skilled developers to be the first line of defense in identifying and fixing vulnerabilities. 

In this guide, we explore the lessons learned from three real-life Secure Code Warrior customers. By learning from their experience, you can begin to assemble an agile secure code learning blueprint for your organization.

Discover:

• What challenges did organizations face at different stages of developer security maturity?
• What were the key lessons learned along the way?
• What results can you expect with each phase of the security maturity journey?

Situation

Before Workday implemented agile learning with Secure Code Warrior, they were utilizing in-house courses that comprised of recordings of PowerPoint presentations that covered OWASP top 10 vulnerabilities with some pseudocode examples. Alex Uda, Program Manager for security developer training, realized this wasn’t helping his team and the security team at large to achieve their goals of improving Workday’s overall security posture. Because developers were quickly becoming unengaged in their training, they decided to begin soliciting their feedback and noted that there were two items that continued to come up:

1. The need for more hands-on type of training 
2. The need for more language-specific content
   

Action 

In working with developers, Alex and his team identified two main priorities in winning developer buy-in to create an engaging, successful secure code learning program.

Clarity and simplicity 

Most developers do not arrive at their jobs with knowledge of security. Anything that is frustrating or time-consuming will lead developers to stray towards workarounds and hacks. What Workday noted about SCW is that it allowed developers to have a clear sense of the process, own it, and integrate it into their workflows.

Actionability and value 

Developers, first and foremost, want to be able to action something that is affecting the codebase/lifecycle, and action it fast. To do so, developers need to be educated on how to do so. If you want a developer to be interested in something like security, highlighting the value of these topics.

In terms of structuring the program, Alex and his team first gathered feedback on the platform from a pilot group of security champions and worked with their customer success manager to implement their suggestions. Alex and the team then looked at their SAST tools and different metrics on the number of incidents and security events to assess what the highest risks are in their current environment, and what is happening across the industry. They initially focused on the OWASP top 10 and the most common, high-risk vulnerabilities at Workday
‍

“By giving developers that learning and that agency, SCW made it so that we were able to make active improvements to our software security. It’s not all about writing code, it’s also about growth opportunities and career opportunities. Workday’s support for the security program exists because it’s an area where the entire company is aligned, so developers were allowed that time for learning and development. Taking two hours a week to do some learning over a period of time helps to build that muscle memory with consistency.”
‍

Results

Traditionally, it’s easy to think of security at the end stage of the development process. Working with the security team, developers at Workday now see security as an important component of the development cycle. They can action security items quickly and earlier in the SDLC, which has been the biggest impact of that program. For one team based in Dublin, their developers went from 4662 security issues - which averaged almost 31.08 issues a day - down to 0 in a period of around 18 months.

Alex described the growth of the program as, “a snowball effect after we began with top-of-mind security champions. As we socialized the program and its benefits to leadership and continued to increase our membership we saw almost a natural growth due to word of mouth. From a training perspective, our goal is to give our developers the necessary skills to develop code securely. This is especially critical as Workday continues to grow."

Key takeaways

According to Alex, “In order to successfully scale security it’s imperative that our developers have a security mindset to help identify security risks during the design phase of their software development. This fits in our shift left initiative to empower our developers to help save time, money, and some heartache. The better job we do in secure code learning, the fewer vulnerabilities we see from our scans and pentest results.”

For developers, it’s important to have fun when learning about security 
SCW is great at showing how exciting it can be. If you are getting involved in security learning, embrace it fully. Consider it as a part of your development process and a part of your career growth.

‍Encourage developers to reach out to the team if they are curious about security
Have a conversation, and start that collaboration.‍

Security as a black box or as a bolt-on to your project is archaic and ultimately does a disservice to your software
Embracing security as part of the development process - the same way we embrace TDD, agile, and linting - will improve the flow and increase the quality of software being delivered to customers.

‍

The Cyber Resilience Act 2024 (CRA) is an EU regulation that introduces mandatory cybersecurity requirements for most products with a digital component sold in theEU. The CRA enhances cybersecurity standards of such products, which in turn requires manufacturers, importers, distributors, and retailers to ensure cybersecurity throughout the lifecycle of these products. Secure Code Warrior supports CRA readiness with CRA-aligned Quests and conceptual learning collections that help development teams build the Secure by Design, SDLC, and secure coding skills aligned with the CRA’s secure development principles.

Developer Risk Management is a holistic and proactive approach to application security, focused on code contributors rather than within the bits and bytes of the application layer itself.

Proactively measure, manage and mitigate developer security risk across the SDLC to improve security posture, release software faster and cut vulnerabilities by 53% or more.

The philosophy behind Developer Risk Management is that, through upskilling code contributors and applying governance to secure coding skills programmatically, the benefits and impact of developer-driven secure code initiatives increase exponentially.