Insights from experts shaping secure development

One of the biggest gaps in the software development lifecycle is the lack of time for developers to learn how to secure their code from the beginning. Developers waste countless hours on rework and remediation - resulting in millions of dollars in lost opportunity costs. Learn how secure coding at speed can help close these gaps and accelerate productivity.

New at Secure Code Warrior: Experience new ways to manage courses and explore additional content.

The advent of the digital darling of the moment - the metaverse - adds a vast new attack surface for both code-level vulnerabilities and social engineering. And we’re simply not prepared for battle on this new playing field that thrives on smoke and mirrors.

The cost of addressing insecure code and subsequent technical debt is one of the biggest obstacles facing tech today. Learn how implementing a scalable secure code training program helps to reduce technical debt by addressing poor coding patterns and detecting vulnerabilities early in the software development cycle.

The perception of what constitutes the act of secure coding is up for debate. According to recent research in collaboration with Evans Data, this sentiment was revealed in black and white. The State of Developer-Driven Security 2022 survey delves into the key insights and experiences of 1200 active developers, illuminating their attitudes and challenges in the security realm.

This week, we officially celebrate eight years of Secure Code Warrior. On the one hand, that’s 350 times the length of the Apollo 11 mission, as well as the equivalent of 45,000 games of football, or playing Super Mario Odyssey 5696 times to the end. On the other, it’s just one-thirtieth the lifespan of a Giant Tortoise (250 years, if you’re wondering). In the world of a high-growth startup, it represents a journey of many twists, turns, lessons, and accomplishments, many of which were unimaginable when we were first inking our business plan.

Here at Secure Code Warrior, we’re constantly innovating to help equip developers and organizations with the right skills to tackle today’s ever changing security challenges. We’ve compiled the top features and updates to our platform, as well as the resources and guidelines published this year, to help your organization secure your software through developer-driven security at the start of the software development cycle.

Everyone wants a good return on their investment when it comes to investing in their techstack or additional training programs, but when it comes to security, one needs to be playing a long game that goes beyond calculating simple ROI. Learn how investment in developer-driven security will not only save on the expense of expensive breaches, the loss of productivity, and accumulated tech--debt, but create a proactive and cost-effective strategy to stay ahead of today’s threat landscape.

In response to major security breaches like the SolarWinds campaign, which used a software update process to infect over 18,000 users of the popular Orion management software, including many top corporations and government agencies, there is an increased push for more effective developer-led security efforts. Organizations of all sizes are starting to question their ‘software supply chain’, and demanding that the developers making their software have verified security skills and awareness.

Everyone knows the importance of a robust techstack. When it comes to finding and fixing vulnerabilities in code, reducing mean time to remediation and using trusted, robust solutions is the goal of Secure Code Warrior’s integrations. Integrating micro-learning moments into developer's workflows is the key to better learning and faster remediation.

Almost every developer team these days employs some form of compliance training, whether it’s part of an initial certification process used to ensure that a company is staying within the bounds of industry frameworks or governmental regulations, or as part of an annual requirement or review. It’s an important step, because if an organization can’t meet basic compliance requirements, then its workers can’t realistically perform their duties.

Developers won’t have a positive impact on vulnerability reduction without a foundational understanding of how the vulnerabilities work, why they are dangerous, what patterns cause them, and what design or coding patterns fix them in a context that makes sense in their world. A scaffolded approach allows layers of knowledge to give a full picture of what it means to code securely, defend a codebase, and stand up as a security-aware developer.

The importance of developer security skills is highlighted in the 2022 Gartner Cool Vendors in Software Engineering. Read more and get the full report.

The developers who create the software, applications and programs that drive digital business have become the lifeblood of many organizations. Most modern businesses would not be able to (profitably) function, without competitive applications and programs, or without 24-hour access to their websites and other infrastructure.

Recently, a team of security researchers announced their finding of a fifteen year old bug in Python’s tar file extraction functionality. The vulnerability was first disclosed in 2007 and tracked as CVE-2007-4559. A note was added to the official Python documentation, but the bug itself was left unpatched.

New at Secure Code Warrior: get hands-on with developer training with Coding Labs, integrate your secure code training program with an LMS, and much more.

Learn more about the risks associated with hardcoded credentials and social engineering as we discuss Uber's recent security incident and why it's so important for organizations to shift left and ensure their developers are up-to-date on secure coding best practices.

Software development is no longer an island, and when we account for all aspects of software-powered risk - everything from the cloud, embedded systems in appliances and vehicles, our critical infrastructure, not to mention the APIs that connect it all - the attack surface is borderless and out of control.

The Open Source Software Security Mobilization Plan represents a positive step for developer-driven security. However, we must all take stock and honestly assess if we're mature enough in our organization - and if our development teams have the right level of security awareness and skills - to implement the latest and greatest defensive strategies.

The effort to shift left requires a collective, continuous improvement of security knowledge and skills, within development teams

API security is tough, but with adequate training, planning and a focus on best practices, even the most insidious vulnerabilities can be mitigated.

Easier and more powerful Courses creation flow, early access toggle, and SAP ABAP training content.

Practical and effective secure coding training for ABAP developers.

Psychic Signature vulnerability lies in the crypto for ECDSA signatures, which protects systems for critical tasks like authentication. Hackers can bypass any signature check with this vulnerability. We will explain what it is and how to mitigate it in this post.

Recently, NGINX has disclosed a zero-day vulnerability. Around the same time, Microsoft has disclosed another critical vulnerability - Windows RPC RCE vulnerability. in this post, you can find out who's at risk of these two issues and how we can mitigate the risk.

Zero-day attacks, by definition, give developers zero time to find and patch existing vulnerabilities that could be exploited, because the threat actor got in first. The damage is done and then it’s a mad scramble to fix both the software and reputational damage to the business. Attackers are always at an advantage, and closing that edge as much as possible is crucial.

For the 2nd year, we partnered with Evans Data Corp. to conduct a comprehensive survey of the global developer community related to the skills, perceptions, and behaviors when it comes to secure coding practices, and their perceived impact and relevancy in the software development lifecycle (SDLC). The results were quite surprising in a lot of ways.

Recently, Spring libraries, one of the most popular libraries in the Java community, disclosed 2 vulnerabilities related to Remote Code Execution (RCE). We’ve broken down the known details for “Spring4Shell” and “Spring Cloud Function” to help you understand if you're at risk and what to do if you are.

When it comes to battling against cybercriminals, we need to stay as in step with them as possible, preempting their playgrounds with a preventative mindset. Here’s where I think they might start making waves in the coming year:

Many companies who are kicking goals in their cybersecurity approach have implemented an official security champion program, bestowing key security responsibilities - everything from liaising between teams and general cheerleading, to overseeing best practices - onto individuals who show aptitude and passion for such a role.

Our birthday milestones are a wonderful reminder to reflect on the fruits of our labor, celebrate the team, and tackle the year ahead with confidence. And now, seven years since inception, I’m left wondering: Have we done it? Is this a real company yet? Of course, we have reached maturity, but I sure hope we never lose the sense of curiosity, passion, and geekiness we’ve had since the beginning.

As an industry, we should never expect developers to become security experts, but organizations can adopt new standards for developer enablement so they can produce higher quality software.

In December 2021, a critical security vulnerability Log4Shell was disclosed in the Java library Log4j. In this article, we breakdown the Log4Shell vulnerability into the simplest form for you to grasp the basic and introduce you to a mission - a playground where you can try exploiting a simulated website using the knowledge of this vulnerability.

We’re not getting realistic advice, nor the fastest solutions, to combat the non-stop onslaught that is modern cybersecurity. Of course, each breach is different in its own way, and there are numerous attack vectors that can be exploited in vulnerable software. Feasible generic advice will be limited, but the best practice approach is looking more flawed by the hour.

Placing emphasis on a preventative - as opposed to reactive - approach may not be widely understood outside of the security team, especially if a big, bad, security incident has not taken place.

Leaving API security up to chance is a sure-fire way to introduce problems later on, with potentially devastating consequences at worst, and frustrating rework and low performance at best.

Migrate Joda-Time to java.time in a convenient way

It’s obvious that cybersecurity is important, but what does it actually mean in the context of supply chains?

Developers are in a great position to make a lucrative jump into AppSec.

Effectively learning about secure coding and retaining that knowledge can make it seem like it’s inherently difficult, but with the right tools and culture, it doesn't have to be. However, it’s not always easy to convince stakeholders and superiors to invest in the right kind of training. Here are some handy tips to help you gain their allegiance.

Professional developers want to embrace DevSecOps and write secure code, but their organizations need to support this seachange if they want that effort to grow.

At the beginning of October, Apache released version 2.4.49 to fix a Path Traversal and Remote Code Execution vulnerability and then 2.4.50 to address the fact that the fix was incomplete. We’ve built a mission to demonstrate the risks in a real-life environment. Try it out now.

Micha Martinez is a Cybersecurity Analyst and Cinematographer at Nelnet. When tasked with creating a training program for developers around secure coding, he took on creative ways to engage his team. We were so impressed with how he runs his secure code training program that we sat down with him to learn more.

Injection attacks, the infamous king of vulnerabilities (by category), have lost the top spot to broken access control as the worst of the worst, and developers need to take notice.

Developers are among those who are most up close and personal with code, in addition to security configurations and access control. Their security skills must be nurtured, and to achieve the high standards as outlined by NIST, a hands-on course structure might just be the efficient way to tackle it, especially with large development cohorts.

Much like web-based software, APIs, and mobile devices, vulnerable code in embedded systems can be exploited if it is discovered in the wild by an attacker.

As an application security professional, it’s your job to ensure the cyber safety of your organization’s applications. You’re not, however, responsible for writing the code the application runs on. Engineers within the development team are. So how do you make sure that they’re developing those systems with security in mind?

This article will cover an overview of securing the embedded systems. We will start from basic definition, then move to challenges in embedded security, some typical solutions, and what the missing puzzles are.

In this post, we will compare the MISRA C 2012 standard with C2, and guide you through the journey of switching to the new standard. We will explain why MISRA's compliance is necessary to build secure embedded systems.

In this post, you will get an overview of embedded devices and embedded systems development.

We sat down with Larry Maccherone at Contrast Security to discuss how contextual learning successfully works to train developers in secure coding. Read on to learn how organizations provide key security training to developers without disrupting their daily responsibilities and workflow.

We were recently very excited to see the first Forbes Technology Council post by our chairman and CEO, Pieter Danhieux, go live. The post detailed how upskilling developers to create more secure code is a key to preventing cyberattacks and data breaches.

API security is an issue that isn’t far from the minds of most security experts, and it’s something we need to equip ourselves with the knowledge to fight.

The recent cybersecurity Executive Order from the Biden Administration has certainly got the security industry talking, especially those who are looking to win over developers to the importance of applying secure coding best practices in their day-to-day work.

We recently sat down with Dimitri Vanderhaeghe, Software Engineer at Selligent Marketing Cloud, a highly integrated, AI-powered omnichannel marketing automation platform that enables ambitious B2C marketers to maximize every moment of interaction with today’s connected consumers. For a fast-paced B2C technology company scaling up and meeting the growing demands of their market is vital. Part of being able to meet these demands is an emphasis on cybersecurity and most crucially a developer-led, security skills program.

How’s this for a sobering statistic? 60% of SMBs go out of business within six months of a successful cyber attack. Major corporations haemorrhage millions (or billions!) while brand reputations bleed out. As organizations increasingly embrace secure coding practices, a 'shift left' is taking place. With the rise of DevSecOps, secure code is becoming the focus right from the start of the SDLC.

According to an IBM study, it is thirty times more expensive to fix vulnerabilities post-release compared to finding and fixing them initially. With that in mind, it’s not surprising that forward-looking CIOs are implementing secure coding practices. This means training and equipping developers to write code that is more secure from the beginning– making them their organization’s ‘first line of defense’.

What are the potential impacts of quality secure code training for your organization – and could it be a worthwhile investment?

In our hyper-connected world, almost every organization shares a common Achilles heel. A single vulnerability, just one exploitable chink in their code, can trigger the theft of customer data, reputational damage and significant financial losses. Organizational alignment around secure coding has never been more imperative – but achieving it is easier said than done.

The latest Executive Order from the US Federal Government touches on many aspects of functional cybersecurity, but for the first time, specifically outlines the impact of developers, and the need for them to have verified security skills and awareness.

Right now, only 15% of developers agree that secure code practices should be everyone’s responsibility. In a world of increasing security threats, that simply isn’t good enough. Something has to be done. One key to creating a healthy AppSec culture is understanding the key influences (and influencers!) at play.

We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered.

Insecure code costs companies millions – so what gets in the way of adopting secure coding practices? In a world that relies on software for just about everything, ensuring that code is secure is critical. Brand reputations and financial viability depend on it. That said, there are many concerns around secure coding – and many barriers to its full and effective adoption. More than ever before, a new way of working is required.

In the last few years, many things have been sacrificed on the altar of speed-to-market—things like network security, terabytes of sensitive customer data and priceless brand reputations.

If ever there was something to ruin Christmas in the cybersecurity industry, it’s a devastating data breach that is on track to becoming the largest cyberespionage event affecting the US government on record.

When it comes to secure code training for developers, educational outcomes leave a lot to be desired. Many companies spend big, only to see minimal returns in practice. And little wonder.

As data breaches and their costs continue to rise, the volume of code produced in our world is too big for security experts to handle alone. Companies need developers with secure coding skills – and developers know they need these skills to advance their careers. But current secure code training is letting them down. So what do developers want when it comes to secure code training?

Boring, boring, boring! That’s one of the main responses you’ll hear from developers whenever secure code training is mentioned. At Secure Code Warrior we believe there must be a better way.

There are a few reasons why AppSec tools are not being utilized as we might have come to expect, and it’s less about the tools and their functionality, and more about how they integrate with a security program as a whole.

When it comes to learning about secure coding, what are the primary motivations for developers, and how can they be leveraged to design and implement a successful application security program?

As the number of cyber-threats continues to grow, organizations are making daily trade-offs between security, practicality, and speed – exposing themselves to risks in the process.

In a world where cyber threats continue to multiply, are your coders stepping up? Is the human element of secure coding – the all-important developer – ready to play their part in securing our connected world? To answer this question, let’s look at some insights from a recent study on developers attitudes towards secure coding, secure code practices, and security operations, conducted by Secure Code Warrior with Evans Data Corp.

The same 10 software vulnerabilities have caused more security breaches in the last 20+ years than any others. And yet, many businesses still opt for post-breach, post-event remediation; muddling through the human and business ramifications of it all. But now a new research study points to a new, human-led direction.

It's SQL injection’s 22nd birthday, and despite this vulnerability being old enough to drink, we’re letting it get the better of us instead of squashing it for good.

A relationship that is built on the shaky foundations of mistrust is, well, best approached with low expectations. Sadly, this can be the state of the working relationship between developers and the AppSec team within an organization.

A fun little Java Gotchas quiz and supporting Github repo showing some gotchas and how to fix them

Learn how to run Sensei and IntelliJ Intention Actions in batch mode as Inspections within the IDE, from the Command-Line, and in Continuous Integration.

Code of a certain level of quality is by its definition also secure, but all secure code is not necessarily good quality. Is starting “left of left” the formula to ensure pure secure coding standards?

In this blog post we take a look at a common Java coding mistake (using a bitwise operator instead of a conditional operator), the error it makes our code vulnerable to, and how we can use Sensei to fix and detect the issue.

The playing field between the heroes and villains in cybersecurity is notoriously unfair. Sensitive data is the new gold, and attackers adapt quickly to circumvent defenses, exploiting security bugs large and small for potential paydirt.

Learn about Static Analysis and how can it help you write better code with examples of 5 IDE based approaches and plugins.

It’s that special time of the year (for us, anyway) where I reflect on our most recent lap around the sun, and what has been done in the previous 365 days to position us for a new year of growth, lessons, and inevitable unpredictability.

We’re predicting that 2021 is the year we take a new kind of space race into the mainstream: keeping our galaxy safe from cyber threats.

This vulnerability is more of a human or management problem that allows older APIs to remain in place long after they should have been replaced by newer, more secure versions.

Learn how Sensei can help migration by identifying deprecated patterns and prompting you with the fix to use going forward.

Penetration testing and static analysis scanning tools (better known as SAST) are just part of the overall process to mitigate security risks, operating rather independently from what we do - until the code bounces back to us for hotfixes, of course!

Whether discomfort comes from the unknowns of a new way of working, a little mistrust, or perhaps not believing remote work, I find that companies who are resistant to it tend to fall behind in terms of attracting top talent, maintaining global reach and frankly, moving with the times.

The insufficient logging and monitoring flaw mostly happens as a result of a failed cybersecurity plan in regards to logging all failed authentication attempts, denied access, and input validation errors.

Learn how to share Sensei cookbooks and help everyone in your team improve their code quality and productivity.

We're thrilled to announce a brand new feature release on the Secure Code Warrior platform: Missions. This all-new challenge category is the next phase in developer-ified security training, moving users from the recall of security knowledge, to applying it in a real-world simulation environment.

It's likely a little more prevalent in APIs, but attackers will often attempt to find unpatched flaws and unprotected files or directories anywhere in a network. Coming across an API that has debugging enabled or security features disabled just makes their nefarious work a little easier.

Learn how Sensei can help onboard developers and adopt new libraries.

Learn how to use Sensei to match problematic code patterns and then amend them to agreed implementations with examples of annotation matching.

The mass assignment vulnerability was born as a result of many modern frameworks encouraging developers to use functions that automatically bind input from clients into code variables and internal objects.

It is clear from the Australian Government's push to get serious about cybersecurity that it has been identified as a key risk area on a national level, but is their strategy reaching far enough?

The Sensei plugin provides an easy way to find specific code patterns in your source code, and then apply rewrite rules to amend the matching code. All within the Intellij IDE, and in real-time.

Secure Code Warrior has built a GitHub Action that brings contextual learning to GitHub code scanning. This means developers can use a third-party action like the Snyk Container Action to find vulnerabilities, and then augment the output with CWE-specific, hyper-relevant learning.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

​The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.​

Secure Code Warrior has introduced the SCW AI Adoption Model, a framework designed to help organisations govern AI use in software development as the industry shifts from the traditional software development lifecycle (SDLC) toward what the company calls the Agentic Development Lifecycle (ADLC).

With many software engineering teams moving from AI coding assistants into full agentic AI code generation and increasing the amount of code they produce exponentially, ensuring the security of that code must be a top priority. The study produces practical guidance for organizations that are getting on board the AI-assisted or agentic code development train.

Token use can create unexpected, sizeable costs for organizations.

AI enables faster development cycles and allows developers to focus on higher-value work. For many businesses, these efficiencies are becoming essential to remaining competitive. The challenge, therefore, is not whether to adopt AI, but how to do so responsibly. Businesses that invest in developer education, governance frameworks, AI observability and robust security controls will be better positioned to capture the benefits while limiting the associated risks.

The issue is no longer simply about protecting AI models themselves. Increasingly, attackers are focusing on the software ecosystem surrounding those models, including the development tools, middleware, open-source libraries, and automated deployment pipelines that organisations rely upon every day.

As we will unpack together, there is a lot of movement around the world, with some collaboration between nations, but the path forward is far from uniform or clear, particularly in business environments where AI adoption is often mandated before holistic safeguarding measures are in place.  

According to one expert, AI guardrails are not designed as “security boundaries” but rather to influence behaviour – but what if that behaviour is hacking one of your industry partners?

‍

Cyber security experts have warned that the breach of Hugging Face infrastructure during an OpenAI security evaluation marks a turning point in the risks posed by autonomous AI agents. In the incident, AI models moved beyond a controlled test and carried out a live, multi-stage intrusion against the AI platform.

AI-generated code introduces an average of 15 confirmed vulnerabilities per codebase, research published by Secure Code Warrior indicates.

Frontier AI is facing a PR crisis. After Hugging Face released a blog post on July 16 claiming an autonomous agent had breached its internal environment, OpenAI posted on July 21 that the incident occurred when GPT 5.6 Sol and a “pre-release model” escaped a controlled testing environment.

Secure Code Warrior research reveals AI-generated code introduces an average of 15 vulnerabilities per codebase.

‍

Secure Code Warrior introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development.

The challenges with AI implementation, constant updates, and the race for industry dominance are coming thick and fast, and security professionals are among the most affected by its vast risk profile.

The Australian government has said AI is very much in the country’s future national interest – but where does it stand today? Here’s what the industry’s best and brightest have to say about artificial intelligence and its role in the modern enterprise.

‍

The emergence of agentic AI marks a structural shift in software development, introducing systems that not only accelerate production cycles but also perform autonomous reasoning and action beyond direct human control.

As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.

According to a recent survey, more than seven in ten developers who have used AI coding tools report relying on them on a daily basis. However, many organisations still lack clear visibility into how these tools are influencing production code, creating governance gaps at a time when demand is accelerating and delivery timelines are tightening.

This category has taken on new urgency in 2026 for a reason that’s specific to this moment: AI coding tools and agents are dramatically increasing how much code gets written and how often it needs to be deployed, tested, and provisioned for. Platform engineering is the layer that determines whether that increased velocity translates into shipped value or into chaos.

As enterprises embrace agentic AI and vibe coding, Secure Code Warrior CEO and co-founder Pieter Danhieux warns that code-generating models are still producing critical security flaws.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organisation sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Secure Code Warrior has introduced its new SCW AI Adoption Model, a practical framework that maps the progression of AI use in software development, from minimal AI assistance to fully autonomous agentic orchestration. The framework helps CISOs assess their organization’s level of AI adoption, identify the training developers need at each stage, and determine the governance controls required as autonomy increases, answering the question every security leader is asking: Where do we start?

Secure Code Warrior has launched an AI Adoption Model for software development, aimed at Chief Information Security Officers managing AI use across development teams.

SCW’s framework gives organisations a clear entry point and practical roadmap for every team — at every stage of the AI adoption curve.

Secure Code Warrior introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organization sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Secure Code Warrior introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organization sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Artificial intelligence-powered cyber-attacks are giving new meaning to the phrase, “before they know what hit ’em.”

Agents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But if we're focused on determining whether code is secure, where do we focus our attention on ensuring a secure outcome? Matias Madou talks about the challenges of finding metrics to help answer these questions. We walk through many of the questions we'd like to see answered and our desire to see appsec (finally?) shift out of a find-and-fix mode into a future of secure design.

Organizations need to establish precise security reviews, with human developers anchoring the process to implement effective security controls while also managing the specific coding temperament of each LLM used.

Secure Code Warrior this week extended the capability of its artificial intelligence (AI) agent to make it possible to surface relevant training insights in real time as application developers are writing code.

What happens when AI can turn patches into exploits in hours? The hosts discuss with Ian Amit and Matias Madou why the 90-day disclosure window is breaking, what Mythos Preview changes, and why shipping vulnerable code is becoming more expensive.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

At the Gartner Security & Risk Management Summit 2026, Secure Code Warrior announced a new Adaptive Learning capability designed to help organizations reduce software security risk by connecting developer education directly to AI coding activity and real-world vulnerabilities.

Secure Code Warrior has launched Adaptive Learning for its AI software governance platform. The feature is intended to connect developer training to real-time coding activity.

‍Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

Secure Code Warrior has introduced Adaptive Learning, a capability designed to help organizations support AI software governance through targeted training based on identified risks. The feature delivers contextual microlearning and tracks outcomes at the code commit level.

Traditionally, threat modelling has been the domain of security professionals tasked with anticipating how attackers might infiltrate systems or exploit vulnerabilities. The process has relied heavily on manual analysis, workshops, and an expanding suite of scanning tools. While effective in earlier eras, this approach struggles to keep pace with the complexity of today’s software development. At the same time, AI-driven coding is accelerating the volume of code produced, expanding the potential attack surface and introducing new categories of risk.

Gartner Security & Risk Management Summit, National Harbor, MD. June 1, 2026 – Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

Enterprises are beginning to realise that token metrics alone offer only a partial picture of AI effectiveness. Token volume may measure activity, but it does not measure whether the output is secure or commercially valuable.

To avoid being overrun by agentic AI’s power, organizations need to take a new approach to governance that works at the speed of AI agents, incorporating real-time monitoring, automated guardrails and dynamic policy frameworks that can keep autonomous innovation from outpacing our ability to manage the lifecycle.

Vibe coding has taken software development by storm, with developers and enterprises using AI to generate code and leverage its productivity benefits. However, research has found that AI-generated code has significant security gaps. LLMs are not sufficiently security-savvy and struggle to identify critical vulnerabilities, especially when they fall under vague or subjective categories. At such a time, when human oversight is more important than ever, it is vital for the industry to address the gap in developers’ security proficiency. In a conversation with the Talk Dev Bureau, Matias Madou discusses the urgency for enterprises to identify vulnerabilities, train their developers in security proficiency, and set up appropriate enterprise-relevant governance protocols.

As enterprises scale AI deployments across chatbots, copilots and agents, token-based pricing is becoming a primary cost driver — and board members and executives are starting to ask warranted questions about the real value of AI and its return on investment (ROI). But what is driving the pressure to maximize token spend, and what does this mean for modern developer environments?

​Artificial intelligence (AI)-driven coding is no longer experimental; it’s embedded in the majority of daily workflows. In fact, more than seven out of 10 developers who have tried using AI now use AI coding tools every day.​ Yet, most organizations lack visibility into how these tools affect production code, creating governance blind spots as demand spikes and deadlines accelerate.