Insights from experts shaping secure development

OS 명령 공격은 초급 수준의 숙련도가 낮은 해커도 할 수 있습니다.

세션은 웹을 사용할 때 좋은 사용자 경험의 핵심입니다.하지만 세션을 잘못 관리하면 공격자가 악용할 수 있는 보안 허점이 생길 수 있습니다.

이제 보안을 개선할 때가 되었다고 생각하지 않으세요?대화를 바꾸고 모든 것을 좀 더 긍정적으로 만드는 것만큼이나 간단합니다 (재미는 말할 것도 없고요!).양쪽 모두에게, 특히 개발팀 모두에게 말이죠.

Padding Oracle은 얼터너티브 록 밴드의 이름으로는 정말 좋지 않은 것처럼 들리지만, 실제로는 공격자가 암호화 키를 몰라도 정보를 해독하는 데 사용할 수 있는 취약점입니다.

악의적인 사용자가 LDAP 쿼리를 조작할 수 있는 경우 문제가 발생할 수 있습니다.이렇게 하면 수신 서버가 평소에는 허용되지 않는 잘못된 쿼리를 실행하도록 속일 수 있으며, 유효하지 않거나 보안 수준이 낮은 사용자에게 암호 없이 상위 수준 또는 관리자 액세스 권한을 부여할 수도 있습니다.

우리가 직면한 진짜 싸움은 스크립트 꼬마나 위험한 조직적 사이버 범죄 조직과의 싸움이 아닙니다... 더 많은 사람들이 데이터 침해가 일어나고 있다는 사실을 전혀 신경 쓰도록 하는 것이 관건입니다.

사이버 보안에서 공격자는 무제한 파일 업로드를 지원하도록 허용된 애플리케이션이나 프로그램을 빠르게 악용할 수 있습니다.그리고 그 결과는 치명적일 수 있습니다.

NoSQL 데이터베이스가 점점 인기를 얻고 있습니다.비정형 데이터를 처리하는 속도와 용이성은 부정하기 어렵지만, 사용이 널리 보급됨에 따라 필연적으로 더 많은 취약성이 드러날 수밖에 없습니다.

CSRF 공격은 상당히 복잡하며 성공하려면 여러 계층이 필요합니다.다시 말해 공격자가 제대로 작동하려면 많은 것들이 공격자에게 유리하게 작용해야 합니다.그럼에도 불구하고 이들은 매우 인기 있고 수익성이 높은 공격 벡터입니다.

공격자들은 SQL 인젝션을 사용하고 있습니다. SQL 인젝션은 1998년 이후 가장 오래된 것 중 하나입니다.그리고 가장 성가신 데이터 취약점은 전 세계 수백만 데이터베이스에 있는 민감한 정보를 도용하고 변경하는 것입니다.

온라인 프라이버시가 없이 존재하려고 할 때 혼란이 지배합니다.로스 울브리히트에게 물어보세요.

관찰: 보안 코딩에 대한 개발자 기술 향상에서 금융 기관의 혁신과 리더십이 증가하고 있습니다.

바퀴벌레는 핵폭발을 포함한 모든 것에서 살아남을 수 있다는 잘 알려진 이론이 있습니다.

코드에서 취약점을 찾아내는 많은 솔루션이 있지만 보안은 개발자들이 애초에 이러한 실수를 저지르지 않도록 하는 보안 지침을 따르도록 가르치는 데 더 중점을 두어야 합니다.

우리는 대화를 바꾸고 보안을 모든 개발자의 업무 생활에서 없어서는 안 될 부분으로 만들기 위해 노력해야 합니다.이를 위한 가장 좋은 방법 중 하나는 예를 들어 게임화를 통해 개발자들의 보안 역량을 강화하고 참여를 이끌어내는 것이라고 생각합니다.

보안을 회사 혁신의 길에서 짜증나는 장애물로 생각하는 것을 멈춰야 합니다.

결국 인프라 또는 서비스 지원 분야에서 경력을 쌓고 대학원 프로그램에서 개발 기회를 얻게 될 것이라고 생각했습니다.알고 보니 제가 있어야 할 곳이 바로 그곳이었어요.

개발자들이 처음부터 보안 코드를 작성할 수 있도록 하는 것은 CISO가 보안 문제로부터 사전 예방적 통제권을 확보할 수 있는 기회이며, 보안 팀과 개발 팀 모두에게 빠르고 쉽고 측정 가능한 개선을 제공할 수 있는 기회입니다.

폭발을 막은 유일한 방법은 공격자의 컴퓨터 코드 실수라고 수사관들은 말했다.

우리의 비전은 보안의 가시성을 높이고 처음부터 보안 코드를 작성할 수 있는 기술과 도구를 제공함으로써 개발자가 조직의 첫 번째 방어선이 될 수 있도록 하는 것입니다.

아무도 보안 코드가 왜 중요한지, 안전하지 않은 코드의 결과, 그리고 가장 중요한 것은 애초에 해당 프로그래밍 프레임워크에서 이러한 취약점이 작성되지 않도록 방지하는 방법에 대해 아무도 가르쳐주지 않는다면 개발자는 어떻게 보안 코드를 작성해야 할까요?

XML 및 XML 스키마 사양에는 여러 보안 기능이 포함됩니다.이와 동시에 이러한 사양은 XML 응용 프로그램을 보호하는 데 필요한 도구를 제공합니다.XML 스키마를 사용하여 XML 보안을 유지하며 이러한 스키마를 사용하여 공격을 수행할 수 있습니다.

이름에 접두사가 붙은 zip에 파일을 삽입할 수 있습니다.

항공 전자 장비의 코드 한 줄을 변경하는 데 드는 비용은 백만 달러이며 구현하는 데 1년이 걸립니다.보잉 737을 기반으로 운항하는 사우스웨스트 항공의 경우 이 항공사는 “파산”할 수 있습니다.

쇼 139: Matias Madou가 보안 개발 교육 및 소프트웨어 보안 테스트 연구에 대해 이야기합니다.

Android 전체 기기 암호화는 모든 데이터를 안전하게 보관하고 저장소에 기록하며, 기기 잠금이 해제된 후에만 볼 수 있습니다.시큐어 코드 워리어로부터 배워보세요.

때로는 애플리케이션이 사용자의 충분한 지식과 동의를 얻어 작업이 수행되고 있는지 확인할 수 있어야 하는 경우가 있습니다.

앱은 사용자 지정 권한을 정의하여 리소스와 기능을 다른 앱과 공유할 수 있습니다.

약 95,000개의 애플리케이션에서 약 30만 명의 개발자가 소프트웨어 보안 이니셔티브 (SSI) 계획, 실행 및 측정을 돕기 위해 BSIMM8 을 사용합니다.

사용자 이름: ######################################################################

효과적인 개발자 보안 교육을 실시하는 방법에 관한 5가지 중요한 교훈

이 연구의 의의는 이전에 보고되지 않은 상당수의 놀라운 보안 코딩 문제에 대한 경험적 증거를 제공했다는 것입니다.

버그는 아직 존재합니다.바로 고칠 수 있는 문제가 아닙니다.지난 몇 개월 동안 버그 바운티 프로그램의 일환으로 수십 개의 회사와 해당 공급업체에 연락해 설정을 수정했습니다.

CIO가 엔터프라이즈 애자일 역량을 적극적으로 구축함에 따라 보안 코딩 기술은 혁신의 무기가 될 것이며 이러한 기술을 갖추지 못하면 파괴의 도구가 될 것입니다.

최고 경영진에게 사이버 보안 교육을 하든, JAVA 또는 C# 보안 코딩 기술로 개발자를 돕든 상관 없습니다. 창의성, 게임화 및 재미를 위한 곳이 있습니다.

개발자가 JavaScript로 코딩하면서 크로스 사이트 스크립팅 오류를 작성하고 해당 결함을 만든 후 몇 분 내에 이를 감지할 수 있는 경우

졸업생이든 베테랑이든 모든 개발자가 질문해야 할 질문이 있습니다.그리고 답이 중요합니다.

지난 주에 필자는 보안 코딩 지침을 최신 상태로 유지하기 위해 Java Spring의 취약점을 조사했습니다.

2016년으로 건너뛰면 x0rz라는 이름의 연구원의 트윗에 따르면 한 보안 연구원이 주요 Equifax 웹 사이트에서 크로스 사이트 스크립팅 (XSS) 이라는 일반적인 취약점을 발견했습니다.

이 취약점은 Struts가 이러한 종류의 데이터를 파싱하여 Java 프로그래밍 언어가 해석할 수 있는 정보로 변환하는 방법과 관련이 있습니다.

데이터 잔여성은 어떤 식으로든 지워진 데이터의 잔여 물리적 표현입니다.

다시 한 번 말씀드리지만, Equifax 해킹의 근본 원인은 웹 앱 취약점입니다.이러한 유형의 취약점은 10년 넘게 존재해 왔지만 오늘날에도 여전히 관련성이 높습니다.

Post-quantum cryptography (PQC) is critical for protecting data from quantum computing threats. Learn how “harvest now, decrypt later” exposes risk and how developers can prepare for quantum-safe security.

Recently we interviewed some of the future leaders in the secure development or “DevSec” world and found their individual career paths into cybersecurity fascinating. For those of you out there wishing to become a security champion, jump into the elusive AppSec realm, or even just learn more about secure coding, here are the stories from three security professionals with a background in development, about how they got interested in security and the security lessons they wish every organization would follow.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

Learn how Blue Prism, the global leader in intelligent automation for the enterprise, used Secure Code Warrior's agile learning platform to create a security-first culture with their developers, achieve their business goals, and ship secure code at speed

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

​The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.​

Secure Code Warrior has introduced the SCW AI Adoption Model, a framework designed to help organisations govern AI use in software development as the industry shifts from the traditional software development lifecycle (SDLC) toward what the company calls the Agentic Development Lifecycle (ADLC).

With many software engineering teams moving from AI coding assistants into full agentic AI code generation and increasing the amount of code they produce exponentially, ensuring the security of that code must be a top priority. The study produces practical guidance for organizations that are getting on board the AI-assisted or agentic code development train.

Token use can create unexpected, sizeable costs for organizations.

AI enables faster development cycles and allows developers to focus on higher-value work. For many businesses, these efficiencies are becoming essential to remaining competitive. The challenge, therefore, is not whether to adopt AI, but how to do so responsibly. Businesses that invest in developer education, governance frameworks, AI observability and robust security controls will be better positioned to capture the benefits while limiting the associated risks.

The issue is no longer simply about protecting AI models themselves. Increasingly, attackers are focusing on the software ecosystem surrounding those models, including the development tools, middleware, open-source libraries, and automated deployment pipelines that organisations rely upon every day.

As we will unpack together, there is a lot of movement around the world, with some collaboration between nations, but the path forward is far from uniform or clear, particularly in business environments where AI adoption is often mandated before holistic safeguarding measures are in place.  

According to one expert, AI guardrails are not designed as “security boundaries” but rather to influence behaviour – but what if that behaviour is hacking one of your industry partners?

‍

Cyber security experts have warned that the breach of Hugging Face infrastructure during an OpenAI security evaluation marks a turning point in the risks posed by autonomous AI agents. In the incident, AI models moved beyond a controlled test and carried out a live, multi-stage intrusion against the AI platform.

AI-generated code introduces an average of 15 confirmed vulnerabilities per codebase, research published by Secure Code Warrior indicates.

Frontier AI is facing a PR crisis. After Hugging Face released a blog post on July 16 claiming an autonomous agent had breached its internal environment, OpenAI posted on July 21 that the incident occurred when GPT 5.6 Sol and a “pre-release model” escaped a controlled testing environment.

Secure Code Warrior research reveals AI-generated code introduces an average of 15 vulnerabilities per codebase.

‍

Secure Code Warrior introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development.

The challenges with AI implementation, constant updates, and the race for industry dominance are coming thick and fast, and security professionals are among the most affected by its vast risk profile.

The Australian government has said AI is very much in the country’s future national interest – but where does it stand today? Here’s what the industry’s best and brightest have to say about artificial intelligence and its role in the modern enterprise.

‍

The emergence of agentic AI marks a structural shift in software development, introducing systems that not only accelerate production cycles but also perform autonomous reasoning and action beyond direct human control.

As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.

This category has taken on new urgency in 2026 for a reason that’s specific to this moment: AI coding tools and agents are dramatically increasing how much code gets written and how often it needs to be deployed, tested, and provisioned for. Platform engineering is the layer that determines whether that increased velocity translates into shipped value or into chaos.

According to a recent report from Gartner, the rampant use of shadow AI and rogue automation is further fueling the proliferation of AI vulnerabilities. Gartner notes that 32% of IT workers using generative AI tools at work say they keep them hidden from cybersecurity teams. Combined with low-code/no-code platforms and vibe coding practices, the AI copilots are greatly expanding the enterprise attack surface.

For this article, we asked a central question for security and risk leaders: "What differentiates a policy that genuinely mitigates enterprise risk from one that exists primarily to demonstrate that the organization has acknowledged AI risk?"

Secure Code Warrior's Pieter Danhieux on Managing AI-Driven Development Risks

As generative AI cements its place in enterprise software development, a familiar discipline is taking on new urgency: risk management.

Secure Code Warrior have today announced SCW Trust Agent: AI, the industry’s first governance solution designed to make Artificial Intelligence (AI) influence in software development visible, attributable, and enforceable at the point of commit — enabling enterprises to scale AI coding tools with measurable control over software risk.

Even as we restructure the SDLC around the most impactful elements of the Agile methodology with careful, DevSecOps-centric security considerations, is this the end of the road for AppSec as we know it?

Global InfoSec Awards 2026 Secure Code Warrior Wins Outstanding Achievement in Cybersecurity Risk Management and Compliance Excellence

New AI Software Governance solution makes AI-generated code visible at commit, enforces policy before production, and connects real development behavior to measurable risk reduction.

Secure Code Warrior (SCW) this week added an artificial intelligence (AI) agent that both identifies code generated by an AI coding tool and automatically applies the appropriate governance policies.

Secure Code Warrior has launched SCW Trust Agent: AI, a software governance product that tracks the use of AI coding tools in development and links that usage to software risk when developers commit code.

2026 Globee® Awards for Cybersecurity: Secure Code Warrior Wins Gold Globee for Software Development Cybersecurity Solutions (Best Of)

Secure Code Warrior announced SCW Trust Agent: AI, a governance solution designed to make AI influence in software development visible, attributable, and enforceable at the point of commit — enabling enterprises to scale AI coding tools with measurable control over software risk.

Secure Code Warrior today announced SCW Trust Agent: AI, the industry’s first governance solution designed to make AI influence in software development visible, attributable, and enforceable at the point of commit — enabling enterprises to scale AI coding tools with measurable control over software risk. For the first time, organizations can trace which AI models influenced specific commits, correlate that influence to vulnerability exposure, and take corrective action before insecure code reaches production.

Secure Code Warrior has announced SCW Trust Agent: AI, a governance solution designed to make AI influence in software development visible, attributable, and enforceable at the point of commit, enabling enterprises to scale AI coding tools with measurable control over software risk. Organizations can trace which AI models influenced specific commits, correlate that influence with vulnerability exposure, and take corrective action before insecure code reaches production.

New AI Software Governance solution makes AI-generated code visible at commit, enforces policy before production, and connects real development behavior to measurable risk reduction.

Developers have long struggled to truly claim a seat at the table in traditional threat modeling programs, but with the right skills, they have the opportunity to wield AI responsibly to seriously cut risk and rework in their codebase.

AI-generated code may be “made by machine”, but taking a cookie-cutter approach to securing that code would fall well short of mitigating the vulnerabilities LLMs can introduce. Organizations need to establish precise security reviews, with human developers anchoring the process to implement effective security controls while also managing the specific coding temperament of each LLM used. AI-generated code must undergo the same personalized risk assessments as code written by human developers.

s artificial intelligence (AI) tools become more widely used in the software development process, their impact on security is becoming clearer. According to recent research, nearly 70% of organisations have discovered vulnerabilities caused by AI tools while one in five have experienced a serious incident as a result of those vulnerabilities.

According to research company Forrester[1], the tech debt for 75% of organisations will increase to a moderate or high level during this year, due to the rapid expansion of AI usage across a range of areas including software development.

While it’s early into 2026, we’re seeing new research that reveals the extent of cyber risks caused by artificial intelligence (AI)-assisted software development: Nearly 7 in 10 organizations have discovered vulnerabilities introduced by AI-generated code, and 1 in 5 have suffered a serious incident tied directly to the vulnerabilities.

Artificial intelligence (AI) has rapidly become indispensable to modern software development. From large language models that generate code on demand to agentic systems that automate entire workflows, AI tools promise dramatic gains in productivity and efficiency.

Developers must view AI as a collaborator to be closely monitored, rather than an autonomous entity to be unleashed. Without such a mindset, crippling tech debt is inevitable.

From technical compromise to AI-driven attacks, cyber criminals increasingly see software developers as prime targets, creating systemic risks CISOs must address.

It’s Online Privacy Week, a time of year where individuals and organisations are all reminded to check their digital footprint(s). Some might say that’s a futile gesture at a time where major social media and marketing players know absolutely everything about you and are cheerfully selling all that data to anyone who’ll buy it; when Microsoft is performing every trick in the book to get Windows users to put all their data in the cloud where it’s available for government agencies to snoop upon without letting you know; when a personal computer crisis means many people will be moved on to dumb-client computing landscape where everything from data storage to major processing tasks will be taking place in the cloud; and when people think that clicking ‘Accept’ on website pop-ups does something that meaningfully protects them. But, what do the experts say?

Technology and data specialists have warned that artificial intelligence and weak data governance are sharpening privacy risks for organisations, as businesses mark World Data Privacy Day.

“Data Privacy Week" presents a great reminder for organisations to reassess their customer privacy policies and prioritise transparent data collection in their marketing strategies.

Five leading cybersecurity experts warn AI is being integrated faster than security policies can manage the risk, creating urgent privacy gaps for SMEs ahead of Data Protection Day on 28 January.

The OWASP Foundation has been a guiding light for security professionals and enthusiasts alike, providing critical, practical advice on the most insidious software vulnerabilities across a plethora of categories and platforms. It has been the first major update since 2021 to the flagship OWASP Top 10 Web Vulnerabilities, and in that time, the industry has been rocked by a stampede of AI technology, tools, and code, each creating a dichotomy of security efficiency and risk for both cybersecurity and software engineering professionals.

The bottom line: AI tools are not safe for enterprise use unless the code output is reviewed and implemented by a security-proficient human. 30% of security experts admit that they don't trust(link is external) the accuracy of code generated by AI itself. That's why security leaders must prioritize the education and upskilling of developer teams, to ensure they have the necessary skills and capabilities to mitigate AI-assisted code vulnerabilities as early as possible. This will lead to the cultivation of a "security first" team culture and safer AI use.

Here's the lowdown on all the tech from 2025 that you, dear Zoomer, should know about.

CISOs hoping for the EU Artificial Intelligence Act to offer a solid framework for AI governance may be a little confused or disappointed by recent updates surrounding the implementation of AI restrictions.

An alleged nation-state attacker used Claude Code and a range of tools in the developer ecosystem to almost autonomously target specific companies with benign open-source hacking tools at scale. Of the more than thirty attacks, several were successful, and proved that AI agents could indeed execute large-scale, malicious tasks with little to no human intervention.

DEVOPSdigest's Prediction Series continues with 2026 DevSecOps Predictions — Industry experts offer predictions on how DevSecOps will evolve and impact the industry in 2026.

The Open Worldwide Application Security Project (OWASP) has unveiled its latest top 10 vulnerabilities list, and it contains some surprising insights into important vulnerability classes.

Cybersecurity experts outline 2026 predictions, from AI-driven attacks and quantum risk to nation-state threats, OT security gaps, and automation pressures.

Pieter Danhieux, Co-founder and CEO of Secure Code Warrior warns that while AI coding tools promise speed and efficiency, they also introduce new risks.

2026 is shaping up to be the year AI evolves from instrument to partner, transforming how we work, create and solve problems.

While a breach of the tools hasn’t so far caused a wide-scale attack, there have been a few exploits and near-misses, and cyberthreat researchers have discovered critical vulnerabilities in several popular tools that make clear what could go horribly wrong.

It’s that time of year where the technology industry predictions start rolling-in. Here’s what you can (apparently) expect in 2026.

The concern is straightforward: development teams may place undue confidence in AI tools that are not equipped to interpret the nuanced context in which many security vulnerabilities arise. Large language models, for instance, can struggle to understand an application’s authentication or authorisation architecture, increasing the likelihood of missing critical safeguards.

Industry guidance on managing the risks of AI-generated code increasingly points to the same conclusion: effective safeguards rely on close collaboration between humans and machines, with developers remaining firmly in the loop.

Agentic artificial intelligence (AI) is set to reshape the enterprise landscape in the Asia-Pacific and Japan (APJ) region in 2026, according to industry executives. Organisations are expected to embrace increasingly autonomous software agents, raising both productivity and new categories of risk across business domains.

How big a threat does agentic AI pose to businesses currently? And what should security leaders be doing to address the risk?

My co-founder and CTO, Matias Madou, Ph.D., and I consulted our crystal ball (or should that be our NVIDIA GPUs?), and this is what we believe 2026 has in store for us from an AI security perspective.

An alleged nation-state attacker used Claude Code and a range of tools in the developer ecosystem, namely Model Context Protocol (MCP) systems, to almost autonomously target specific companies with benign open-source hacking tools at scale. Of the over thirty attacks, several were successful, and proved that AI agents could indeed execute large-scale, malicious tasks with little to no human intervention. Maybe it’s time we went a little slower, stopped to reflect on what is at stake here, and how best to defend ourselves.

AI is now a key piece of modern software development. More than four out of five developers use AI coding tools daily or weekly – with many relying on multiple tools in parallel. Teams must understand where automation ends, and where accountability begins.

Secure code should be grounded more in concepts like secure by default and secure by design than by “spot the vuln” thinking. Matias Madou shares his experience in secure coding training and the importance of teaching critical thinking. He also discusses why critical thinking is so closely related to threat modeling and how LLMs can be a tool for helping developers get beyond the superficial advice of, “Think like an attacker.”

Organizations are at an inflection point driven by the explosive adoption of AI, which promises significant changes in how businesses operate. That leaves CISOs on unsteady ground. As the gatekeepers of their organization’s data and access, they must ensure the security of the enterprise. However, the prospects of a headlong charge into wide-ranging, and possibly unchecked, use of AI could create a flood of security issues that many CISOs, under their current organizational structures, aren’t equipped to handle.

Security leaders and developers alike are already acutely aware that AI coding assistants and agentic agents can introduce vulnerabilities into the code they generate. A recent study unveiled another critical concern to keep them up at night — LLMs used for making iterative code improvements may introduce new vulnerabilities over time, even when explicitly asked to make code more secure.

Government bodies are trying to develop rules and regulations for safe AI use, but enterprises can't afford to wait. They need to address the risks now.

In the sphere of cybersecurity in general and application security in particular, human oversight remains an absolute 'must' to harness the benefits of AI productivity.

Like the meteoric rise of ChatGPT, vibe coding is all anybody can talk about this year. In fact, it just became a word in the dictionary. But beware the boom: These new AI coding tools offer speed, savings—and astounding vulnerabilities.

Ryan is joined by Secure Code Warrior’s co-founder and CTO Matias Madou to discuss the implications of LLMs’ variability on code security, the future of developer training as AI coding assistants become more popular, and the importance of critical thinking—especially for junior developers—in the age of AI.

Software developers reap a host of benefits from making use of artificial intelligence assistants, whether in the form of Large Language Model (LLM) code creators or agentic AI agents. But recent reports, highlighted by a new study at MIT, warn that heavy use of AI can result in a loss of critical thinking skills among users.

To deploy AI tools securely and ethically, teams must balance innovation with accountability—establishing strong governance, upskilling developers, and enforcing rigorous code reviews.

To write secure code with LLMs developers must have the skills to use AI as a collaborative assistant rather than an autonomous tool, Madou argues.

Secure Code Warrior’s Chief Executive Officer, Chairman, and Co-Founder Pieter Danhieux explains his transition from offensive cybersecurity to promoting secure software development. Founded in 2015, Secure Code Warrior aims to help developers build secure code from the start, a practice Danhieux and host Alan Shimel agree is more effective than fixing vulnerabilities later. The two also discuss the impact of AI on software development, noting that while AI increases coding speed and accessibility for more people, the security of AI-generated code still lags. They emphasize the growing need for developers to master secure coding practices amidst these technological advancements.

October is Australia’s Cybersecurity Awareness Month, the annual reminder for Aussies to stay vigilant online. This year’s theme, ‘Building our cyber safe culture’ once again highlights the importance of taking personal responsibility for staying secure in an increasingly digital world.

Cybersecurity Awareness Month has brought renewed attention to the increasing risks faced by organisations of all sizes, with a particular focus on the growing threat to small and medium-sized enterprises (SMEs) in Australia and the UK.

In the world of cybersecurity, we face creative and unconventional threats every day. But our greatest vulnerability isn't a flaw in our software, but a flaw in our collective thinking.

Development teams face relentless pressure to deliver, yet they must continue to prioritise building secure, high-quality software. Leaders play a crucial role in reinforcing how a Secure by Design approach, supported by observability, benchmarking, and ongoing education, directly enhances code quality. By embedding these practices, organisations can close governance gaps and fully capture the benefits of AI-driven productivity and efficiency, while reducing the risk of security flaws or costly rework during the SDLC.

While agentic AI holds the promise of delivering significant business benefits, it also comes with significant caveats. The technology’s capabilities and autonomy present a potent enterprise threat vector beyond the realm of existing security concerns.

Secure Code Warrior has launched a beta program to expand the AI capabilities of its Trust Agent product. The new offering provides CISOs with security traceability, visibility, and governance over developers’ use of AI coding tools.

Secure Code Warrior have released a beta program for a major expansion of AI capabilities within its Trust Agent product. The upgrade, collectively referred to as Trust Agent: AI, leverages a combination of key signals, including AI coding tool usage, vulnerability data, code commit data and developer secure coding skills, to provide visibility into how AI development tools are impacting risk within the software development lifecycle (SDLC).

Although capable of reducing trivial mistakes, AI coding copilots leave enterprises at risk of increased insecure coding patterns, exposed secrets, and cloud misconfigurations, research reveals.

New capabilities in SCW Trust Agent provide visibility and control over LLM usage for security leaders and CISOs.

Secure Code Warrior is trying to provide organizations with greater visibility and control over developers’ use of AI coding tools with the launch of its new solution, Trust Agent: AI.

Secure Code Warrior announced the launch of a beta program for a major expansion of AI capabilities within its Trust Agent product.

Vibe coding is currently all the rage, with more than 97 percent of respondents to a survey earlier this year reporting having used AI coding tools at work. The adoption of these tools only continues to grow but it comes with a catch, attackers are also employing the same techniques. We spoke to Pieter Danhieux, co-founder and CEO of Secure Code Warrior, to discuss how vibe coding is redefining the software development landscape, how malicious actors are also leveraging this technology and the need for organizations to implement secure by design strategies from the outset.

If the tech stack lacks tools that oversee not only developer security proficiency, but also the trustworthiness of approved AI coding companions each developer uses, then it is likely that efforts to uplift the overall security program and the developers working within it will be short of the appropriate data insights to effect change.

The process of software development is undergoing a period of expedited change. Thanks to massive advances in artificial intelligence (AI) technology, projects can be completed more rapidly and by people with little or no prior experience.

Is the tech industry capable of the change needed to curb ethical and environmental concerns?

Launch of new 12-week video series on AI/LLM security empowers developers to safely adopt AI coding and mitigate emerging security risks.

As developers lean on Copilot and GhostWriter, experts warn of insecure defaults, hallucinated dependencies, and attacks that slip past traditional defenses.

Change is afoot in cybersecurity governance, and it couldn’t come at a more transformative time for security leaders worldwide. The White House issued a recent Executive Order (EO) designed to “reprioritize cybersecurity efforts to protect America”, and with it, reduce friction related to overzealous government oversight to focus on protecting critical digital assets and enhanced secure technology practices. Coupled with significant cuts to CISA, one could be forgiven for being apprehensive of the right approach going forward, especially in the wake of rapid AI technology progression and Secure by Design initiatives.

Widespread adoption of AI coding tools accelerates development—but also introduces critical vulnerabilities that demand stronger governance and oversight.

Pieter Danhieux at Secure Code Warrior explains why “Secure by Design” has emerged as mission critical for software development

GenAI tools are building insecure apps faster than ever.

Today’s customers are an exacting lot with little tolerance for suppliers that fail to meet their ever-increasing expectations. Almost 94 per cent of Australian consumers stopped purchasing from at least one company after a negative experience, according to CPM’s 2025 The State of Customer Experience in Australia Report.

See how 16 leading AI models actually code, scored across 11 real-world frameworks and 1,760 codebases — the framework matters as much as the model.

AI risk doesn't stop at engineering. Get the one-pager on Citizen AI — build AI literacy and safe habits across your whole workforce.