Insights from experts shaping secure development

ゼロデイ攻撃は、当然のことながら、攻撃者が最初に侵入するため、開発者が悪用される可能性のある既存の脆弱性を発見してパッチを適用する時間がまったくありません。被害が発生したら、ビジネスに対するソフトウェアと評判の低下の両方を修正しようとすると、狂ったような争いが繰り広げられます。攻撃者は常に有利な立場にあり、そのエッジをできる限り塞ぐことが重要です。

2年目となる今回は、Evans Data Corp. と提携して、セキュアコーディング手法に関するスキル、認識、行動、およびそれらがソフトウェア開発ライフサイクル（SDLC）に与える影響と関連性について、世界の開発者コミュニティを対象に包括的な調査を実施しました。結果は多くの点で非常に驚くべきものでした。

最近、Java コミュニティで最も人気のあるライブラリの 1 つである Spring ライブラリが、リモートコード実行 (RCE) に関連する 2 つの脆弱性を公開しました。「Spring4Shell」と「Spring Cloud Function」の既知の詳細を分類して、リスクにさらされているかどうか、またリスクにさらされている場合の対処方法を理解しやすくしました。

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

Software is the foundation of virtually every modern enterprise, yet our reliance on potentially vulnerable open-source components in critical systems represents an extreme risk in the software supply chain. It’s an ailment for which we must find an appropriate cure.

One of the most challenging aspects of integrating AI tools into business operations is determining which outputs are trustworthy, which tools you can trust to become part of your tech stack, the strengths and weaknesses of each tool, and how you can ensure consistent results if different tools or processes are being used.

AI coding tools can assist the defence capabilities of developers, enabling an easier pathway to a ‘security-first’ mindset. However, like any new and potentially impactful innovation, they also raise potential questions that teams and organisations need to explore.

AI risk doesn't stop at engineering. Get the one-pager on Citizen AI — build AI literacy and safe habits across your whole workforce.

From AI autocomplete to autonomous agents—explore how software development is evolving and what it means for security, governance, and your team.

Gartner named SCW twice in the 2026 Hype Cycle for Secure Software Engineering. Here's why it matters for AI-driven development.