Insights from experts shaping secure development

The missing function level access control vulnerability allows users to perform functions that should be restricted, or lets them access resources that should be protected.

Every organization can utilize Cybersecurity Awareness Month to refresh their security awareness, and this year, were also launching a new, free app for the coding community!

This vulnerability occurs when too many requests come in at the same time, and the API does not have enough computing resources to handle those requests. The API can then become unavailable or unresponsive to new requests.

Shifting security fixes back towards the development process isn't easy, but is necessary in today's world where even seemingly simple devices like presentation tools are both surprisingly complex, and also networked into everything else.

The actual mechanics behind this vulnerability are similar to others, but excessive data exposure, in this case, is defined as involving legally protected or highly sensitive data.

Authentication often acts as a gateway to both an application and potentially to the rest of a network, so they are tempting targets for attackers. If an authentication process is broken or vulnerable, there is a good chance that attackers will discover that weakness and exploit it.

We'd like to shine the spotlight on one of our experts, Oscar Quintas. He's part of our Product Content team, working as a Senior Security Researcher. He's also our resident sorcerer on all things Infrastructure as Code (IaC).

In general, object level authorization checks should be included for every function that accesses a data source using an input from the user, and failure to do so comes at a great risk.

Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud.

With your organization in mind, think about these questions in the context of your role. How would it fare when put to the DevSec test?

A curated course containing the exact modules in which your developers would need to show proficiency will have a potent impact, and allow them to hit the ground running when it comes to security best practices in their day-to-day work.

We already know there is too much going on in a workday, so what incentive do developers have to schlep off to a classroom, or context-switch to go through five steps to access static theory-based training?

The idea behind contact tracing apps is sound. This technology, when functioning well, would ensure hotspots are quickly revealed and comprehensive testing can occur - both essential components of fighting the spread of a contagious virus.

We started to think about what we could do to reduce the barrier to getting training when you need it, and how micro-learning could be implemented into your workflow in a more seamless way.

June 23rd is a special entry in the geek calendar, marking International Women in Engineering Day. This is our chance to cast light on the contribution of women to software development.

This vulnerability can occur when coders fail to properly implement business logic rules, which could leave their applications vulnerable to different kinds of attacks should a malicious user choose to exploit them.

Rust incorporates known and functional elements from commonly used languages, working to a different philosophy that disposes of complexity, while introducing performance and safety.

The vulnerability-inducing behavior that we are going to focus on here is using code from untrusted sources, a seemingly benign practice that is causing big problems.

Healthcare could be the next 'great' cybersecurity battleground, with criminals attacking the very machines that diagnose medical problems, provide treatments and sustain life.

Security misconfigurations, especially those of the improper permissions variety, most often happen whenever a developer creates a new user or grants permission for an application as a tool in order to accomplish a task.

At times, applications will also share data with other programs as part of an overall workload. Unless the transport layer is protected, it makes it vulnerable to both outside snooping and unauthorized internal viewing.

These days, having critical data like passwords, personal information and financial records hashed while at rest is a cornerstone of any cybersecurity defense.

Legacy COBOL, although an older computer language, is still effective to this day. Learn more about COBOL secure application development from Secure Code Warrior.

The key to most computer security these days involves passwords. Even if other security methods are employed, like two-factor authentication or biometrics, most organizations still employ password-based security as one element of their protection.

We must get to a stage where security is seen as a shared responsibility across the entire organization, and throughout the SDLC. This is certainly possible when you commit to a fully-fledged, highly supportive DevSecOps environment.

Without infrastructure-level access control in perfect order, it opens up an entire enterprise to attackers, who can use that vulnerability as their gateway for either unauthorized snooping or a full attack.

Attackers will always attempt to find easily exploitable vulnerabilities first and may even use a script to run through common weaknesses. It's not unlike a thief checking all the cars on a street to see if any doors are unlocked, which is a lot easier than smashing a window.

This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers.

This is part 1 of a two-part series on successful PCI-DSS compliance within an organization. In this chapter, we detail how AppSec specialists can work closely with development managers to empower developers, strengthen the SSDLC and get specific outcomes from general legislation.

In our industry, many security experts have started predicting the hot-button issues for the year, but with more than five billion sensitive data records stolen in 2019, we figured it would be more accurate to predict what won't be happening in cybersecurity in the foreseeable future.

Much of the initiative around "shifting left", that is, introducing security much earlier in the development process, simply doesnt move the needle far enough.

With the advent of GDPR, as well as a revised strategy following a multi-stage attack that exposed the sensitive data of many public figures - as well as servers in the German federal government - it is clear that cybersecurity awareness and action are front-of-mind for leaders in the DACH region.

The world is starting to move on past Waterfall, Agile, and now DevOps, so what is the next solution? And as a developer, what is your role in keeping pace with these changes in approach?

Towards the end of last year, the amazing community at MITRE published their list of the CWE Top 25 Most Dangerous Software Errors that affected the world in 2019. And most of it was no surprise.

I could have started this article with all the facts and figures indicating a thriving, hyper-growth startup; they are undeniably impressive and our ongoing company trajectory is strong. However, for me, these numbers don't reflect what I am most proud of in 2019.

Few companies are truly successful in their DevOps implementation. However, the right support, nurturing and understanding across the business can transform your process.

The National Institute of Standards & Technology (NIST) released an updated white paper, detailing several action plans for reducing software vulnerabilities and cyber risk.

These developer-focused events are among my favorite on the calendar; they provide a humbling reminder of the community that works tirelessly to educate and empower software engineers and specialists to champion security in their work.

While regulatory initiatives will undoubtedly improve and grow over time, if organizations are already hitting the panic button and leaping into training now, they might just find themselves ill-equipped for the future.

There are developers of all types, from all walks of life, and there has always been a sense of community in everything we do.

While secure coding needs to become a mandatory component of software engineering at the tertiary level, some universities are leading the charge in providing top-notch training and prioritizing security as part of the development process from the very beginning.p

Our VP of Customer Success, Fatemah Beydoun, recently presented her talk, "Mentoring for the future: How we can all do better in fostering female cybersecurity talent" to a very receptive audience. She has been an integral part of driving positive change within the cybersecurity industry.

Insecure deserialization can happen whenever an application treats data being deserialized as trusted. If a user is able to modify the newly reconstructed data, they can perform all kinds of malicious activities such as code injections, denial of service attacks or elevating their privileges.

It truly boggles the mind that many places still rely on classrooms, dry textbooks and mind-numbing video training to get their best and brightest on-board with new initiatives, especially when there's a far better, more engaging and more valuable way to learn: contextual training.

The software security industry isn't exactly known for its warm and fuzzy feelings, whimsical observations and life commentary, but, perhaps as I get older, I find myself reflecting on the impact we can all have in the world.

Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state.

Teen security researcher, Bill Demirkapi, exposing major vulnerabilities in software used by his school certainly brought back some memories. I remember being the curious kid, lifting the hood on software to take a peek underneath and see how it all worked... and if I could break it.

While VxWorks isn't a household name to the average consumer, this software product benefits many people just like you and me, each and every day. And now, we are faced with the possibility that hundreds of millions of VxWorks-powered devices are now compromised.

The XML External Entity Injection attack, sometimes simply abbreviated as XXE injection, is relatively new, but it's extremely popular among hacking communities right now, and growing even more so as it racks up successes.

If an attacker can insert a CR or LF code into an existing application, they can sometimes change its behavior. The effects are less easy to predict compared with most attacks, but can be no less dangerous to the target organization.

Creative, inspiring CISOs and CIOs have the power to innovate and shape our digital world, but they can also be instrumental in transforming an organizations security culture.

In many ways, the remote file inclusion vulnerability is much more dangerous, and also easier to exploit, than its local file counterpart. As such, it should be found and remedied as soon as possible.

This year, the PCI Security Standards Council released an all-new set of software security guidelines as part of their PCI Software Security Framework. This update aims to bring software security best practice in-line with modern software development.

Unlike many vulnerabilities, exploiting local file inclusion and path traversal processes for nefarious purposes requires a sufficiently skilled attacker, a fair amount of time, and perhaps a bit of luck.

Even if you have completely secured an application server and the backend systems it uses, communications might still be vulnerable to snooping if you have insufficient transport layer protection.

XML injection attacks are nasty little exploits invented by hackers to help them compromise systems hosting XML databases. This includes the kinds of things that come to mind when one thinks about traditional databases - detailed stores of information about anything from medicines to movies.

A recent report from the UK's Huawei Cyber Security Evaluation Centre identified major security issues within Huawei's software engineering processes. But it's a problem that can be fixed.

Addressing hot-button issues like how to make the most of an organization's AppSec budget, as well as several curly questions from the audience, the Leaders in AppSec panel delivered some real morning magic that will help security specialists build out viable programs within their organizations.

Insufficient logging and monitoring is one of the most dangerous conditions that can exist within an application's defensive structure. If this vulnerability or condition exists, then almost any advanced attack made against it will eventually be successful.

Coding a website or application with the ability to process unvalidated redirects and forwards can be extremely dangerous for both your users and your organization.

It's official: we are joining forces with Bugcrowd in the fight to educate, empower and enlighten developers on secure coding.

Code injection attacks are among the most common, and also the most dangerous, that many websites and applications will encounter. They run the gamut both in terms of sophistication and in the danger that they pose, but nearly any site or app that accepts user input could be vulnerable.

The recent attack on GitHub repositories highlights a well-known issue within the security industry: most developers are simply not sufficiently security-aware, and valuable data could be at risk at any time.

When you build a business application, whether for internal use or external use by your customers, you probably don't let every user perform every single function. If you do, you may be vulnerable to broken access control.

With cyberattacks on the rise - affecting every type of organisation in every vertical - the threat of expensive, embarrassing and bottom-line-affecting data breaches is very real. The problem is not getting smaller, it's growing like a tumour.

When your web app reveals too much information, it can make it easier for attackers to break into it. jIn this post, we'll cover what information exposure is, why it's dangerous, and how to prevent it.

Since all applications use components, most of which you haven't written, vulnerabilities within the components you use can become liabilities. Let's discuss what using components with known vulnerabilities means, how dangerous it is, and how to resolve it.

Having been on both sides of the fence, I know all too well the tension that can arise between the development team and AppSec specialists when it comes to upholding security best practice. However, there is a better approach.

Were going to cover one of the most common problems faced by organizations that either run websites, or which allow employees to remotely access computer resources - which is pretty much everyone. And yes, you probably guessed that we are going to be talking about authentication.

If an application has insufficient anti-automation checks in place, attackers can simply keep guessing at passwords until they find a match. Heres how to stop them.

Although coding issues may be part of the problem, business logic errors are most frequently a result of design flaws or incorrect logical assumptions when an app is first created.

In cybersecurity, we are often like hunters. Our eyes are firmly glued to the horizon, scanning for the next breakout vulnerability. However, this forward-looking focus can have the surprising effect of dampening our overall security awareness.

It's common for websites and applications to allow users to send feedback and various other bits of information through an application using email. And most people don't even think about it in terms of a potential security risk.

A direct object reference is when a specific record (the 'object'), is referenced within an application. It usually takes the form of a unique identifier and may appear in a URL.

Software security is always front-of-mind for me, as is the very real danger posed by our increasingly digital, personal information-sharing lifestyles. After all, we are in a largely unregulated, unsupervised and blissfully ignored territory. We're in the Wild West.

In this digital society, developers are responsible for keeping info & businesses safe from insecure cryptographic storage. Learn from Secure Code Warrior.

A huge majority of websites use XML databases to perform critical functions such as holding user login credentials, customer information, personal identity information and confidential or sensitive data, leaving XQuery attacks with a rather large attack footprint.

What is security misconfiguration? Find the most popular security misconfigurations & how to prevent vulnerabilities. Learn from Secure Code Warrior.

The older my daughter and the company gets, the more I realise there are so many similarities between a startup journey and the ���first-time�۝ parent journey. I am in my fourth year for both now.pi

Let's take a look now at how clickjacking works, why it's dangerous, and what developers like you can do to prevent it.

OS command injection attacks can be performed by entry-level and less skilled hackers, which makes them one of the most common weaknesses that security teams experience. Thankfully, there are quite a few very effective ways to prevent them from being successful.

Sessions are key to a good user experience when using the web. However, managing sessions incorrectly can lead to security holes that attackers can exploit.

Don't you think it's time we gave security a makeover? It's as simple as changing the conversation and making everything a little more positive (not to mention fun!) for both sides, especially the development team.

While Padding Oracle sounds like a really bad name for an alternative rock band, it's actually a vulnerability that can be used by attackers to decrypt information without knowing the encryption key.

Problems can occur when malicious users can manipulate an LDAP query. Doing this can trick the receiving server into executing invalid queries that would normally not be allowed, or even granting high level or administrator access to invalid or low-security users without a password.

The real battle we face isn't against script kiddies, or dangerous organized cybercrime syndicates... its in getting more people to care that data breaches are happening at all.

In cybersecurity, attackers can be quick to exploit any application or program that has been allowed to support unrestricted file uploads. And the results can be devastating.

NoSQL databases are becoming increasingly popular. It's hard to deny their speed and ease of dealing with unstructured data, but as use becomes widespread, more vulnerabilities inevitably bubble to the surface.

CSRF attacks are fairly complex and rely on multiple layers to be successful. In other words, lots of things have to break in favor of the attacker for it to work. Despite this, they are an extremely popular, lucrative attack vector.

Attackers are using SQL injection - one of the oldest (since 1998!) and peskiest data vulnerabilities out there - to steal and change the sensitive information available in millions of databases all over the world.

When online privacy attempts to exist without security, chaos reigns. Just ask Ross Ulbricht.

Observing: the rising innovation and leadership of financial institutions in upskilling their developers on secure coding.

There's a well-known theory that cockroaches can survive basically anything - even a nuclear explosion.

There are many solutions that find vulnerabilities in code, but security needs to place more emphasis on teaching developers to follow security guidelines that will prevent them from making these mistakes in the first place.

We must work to change the conversation, to make security an integral part of every developer's working life. And I think one of the best ways to do this is by empowering and engaging with developers on security through, for example, gamification.

We must stop thinking of security as an irritating obstacle on the path of company innovation.

I thought I would end up in an infrastructure or service support sort of career, and then got a development opportunity in a graduate program. Turns out thats exactly where I needed to be.

Empowering developers to write secure code from the start is an opportunity for CISOs to seize some proactive control from the security predicament, and where there is the chance for fast, easy and measurable improvements for both security and development teams.

The only thing that prevented an explosion was a mistake in the attackers computer code, the investigators said.

Our vision is to empower developers to be the first line of defence in their organisation by making security highly visible and providing them with the skills and tools to write secure code from the beginning.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

​The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.​

Secure Code Warrior has introduced the SCW AI Adoption Model, a framework designed to help organisations govern AI use in software development as the industry shifts from the traditional software development lifecycle (SDLC) toward what the company calls the Agentic Development Lifecycle (ADLC).

With many software engineering teams moving from AI coding assistants into full agentic AI code generation and increasing the amount of code they produce exponentially, ensuring the security of that code must be a top priority. The study produces practical guidance for organizations that are getting on board the AI-assisted or agentic code development train.

Token use can create unexpected, sizeable costs for organizations.

AI enables faster development cycles and allows developers to focus on higher-value work. For many businesses, these efficiencies are becoming essential to remaining competitive. The challenge, therefore, is not whether to adopt AI, but how to do so responsibly. Businesses that invest in developer education, governance frameworks, AI observability and robust security controls will be better positioned to capture the benefits while limiting the associated risks.

The issue is no longer simply about protecting AI models themselves. Increasingly, attackers are focusing on the software ecosystem surrounding those models, including the development tools, middleware, open-source libraries, and automated deployment pipelines that organisations rely upon every day.

As we will unpack together, there is a lot of movement around the world, with some collaboration between nations, but the path forward is far from uniform or clear, particularly in business environments where AI adoption is often mandated before holistic safeguarding measures are in place.  

According to one expert, AI guardrails are not designed as “security boundaries” but rather to influence behaviour – but what if that behaviour is hacking one of your industry partners?

‍

Cyber security experts have warned that the breach of Hugging Face infrastructure during an OpenAI security evaluation marks a turning point in the risks posed by autonomous AI agents. In the incident, AI models moved beyond a controlled test and carried out a live, multi-stage intrusion against the AI platform.

AI-generated code introduces an average of 15 confirmed vulnerabilities per codebase, research published by Secure Code Warrior indicates.

Frontier AI is facing a PR crisis. After Hugging Face released a blog post on July 16 claiming an autonomous agent had breached its internal environment, OpenAI posted on July 21 that the incident occurred when GPT 5.6 Sol and a “pre-release model” escaped a controlled testing environment.

Secure Code Warrior research reveals AI-generated code introduces an average of 15 vulnerabilities per codebase.

‍

Secure Code Warrior introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development.

The challenges with AI implementation, constant updates, and the race for industry dominance are coming thick and fast, and security professionals are among the most affected by its vast risk profile.

The Australian government has said AI is very much in the country’s future national interest – but where does it stand today? Here’s what the industry’s best and brightest have to say about artificial intelligence and its role in the modern enterprise.

‍

The emergence of agentic AI marks a structural shift in software development, introducing systems that not only accelerate production cycles but also perform autonomous reasoning and action beyond direct human control.

As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.

According to a recent survey, more than seven in ten developers who have used AI coding tools report relying on them on a daily basis. However, many organisations still lack clear visibility into how these tools are influencing production code, creating governance gaps at a time when demand is accelerating and delivery timelines are tightening.

This category has taken on new urgency in 2026 for a reason that’s specific to this moment: AI coding tools and agents are dramatically increasing how much code gets written and how often it needs to be deployed, tested, and provisioned for. Platform engineering is the layer that determines whether that increased velocity translates into shipped value or into chaos.

As enterprises embrace agentic AI and vibe coding, Secure Code Warrior CEO and co-founder Pieter Danhieux warns that code-generating models are still producing critical security flaws.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organisation sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Secure Code Warrior has introduced its new SCW AI Adoption Model, a practical framework that maps the progression of AI use in software development, from minimal AI assistance to fully autonomous agentic orchestration. The framework helps CISOs assess their organization’s level of AI adoption, identify the training developers need at each stage, and determine the governance controls required as autonomy increases, answering the question every security leader is asking: Where do we start?

Secure Code Warrior has launched an AI Adoption Model for software development, aimed at Chief Information Security Officers managing AI use across development teams.

SCW’s framework gives organisations a clear entry point and practical roadmap for every team — at every stage of the AI adoption curve.

Secure Code Warrior introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organization sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Secure Code Warrior introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organization sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Artificial intelligence-powered cyber-attacks are giving new meaning to the phrase, “before they know what hit ’em.”

Agents and LLMs are creating and reviewing code. They're a new tool to help developers write software and they're a new abstraction layer for expressing what code should do. But if we're focused on determining whether code is secure, where do we focus our attention on ensuring a secure outcome? Matias Madou talks about the challenges of finding metrics to help answer these questions. We walk through many of the questions we'd like to see answered and our desire to see appsec (finally?) shift out of a find-and-fix mode into a future of secure design.

Organizations need to establish precise security reviews, with human developers anchoring the process to implement effective security controls while also managing the specific coding temperament of each LLM used.

Secure Code Warrior this week extended the capability of its artificial intelligence (AI) agent to make it possible to surface relevant training insights in real time as application developers are writing code.

What happens when AI can turn patches into exploits in hours? The hosts discuss with Ian Amit and Matias Madou why the 90-day disclosure window is breaking, what Mythos Preview changes, and why shipping vulnerable code is becoming more expensive.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

At the Gartner Security & Risk Management Summit 2026, Secure Code Warrior announced a new Adaptive Learning capability designed to help organizations reduce software security risk by connecting developer education directly to AI coding activity and real-world vulnerabilities.

Secure Code Warrior has launched Adaptive Learning for its AI software governance platform. The feature is intended to connect developer training to real-time coding activity.

‍Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

Secure Code Warrior has introduced Adaptive Learning, a capability designed to help organizations support AI software governance through targeted training based on identified risks. The feature delivers contextual microlearning and tracks outcomes at the code commit level.

Traditionally, threat modelling has been the domain of security professionals tasked with anticipating how attackers might infiltrate systems or exploit vulnerabilities. The process has relied heavily on manual analysis, workshops, and an expanding suite of scanning tools. While effective in earlier eras, this approach struggles to keep pace with the complexity of today’s software development. At the same time, AI-driven coding is accelerating the volume of code produced, expanding the potential attack surface and introducing new categories of risk.

Gartner Security & Risk Management Summit, National Harbor, MD. June 1, 2026 – Secure Code Warrior, a leader in AI software governance and developer security upskilling, today unveiled its new Adaptive Learning capability from the Gartner Security & Risk Management Summit 2026. Adaptive Learning helps enterprises move AI software governance from visibility to measurable action — delivering targeted, risk-aligned microlearning at the moment of risk, and proving the result at the commit level.

Enterprises are beginning to realise that token metrics alone offer only a partial picture of AI effectiveness. Token volume may measure activity, but it does not measure whether the output is secure or commercially valuable.

To avoid being overrun by agentic AI’s power, organizations need to take a new approach to governance that works at the speed of AI agents, incorporating real-time monitoring, automated guardrails and dynamic policy frameworks that can keep autonomous innovation from outpacing our ability to manage the lifecycle.

Vibe coding has taken software development by storm, with developers and enterprises using AI to generate code and leverage its productivity benefits. However, research has found that AI-generated code has significant security gaps. LLMs are not sufficiently security-savvy and struggle to identify critical vulnerabilities, especially when they fall under vague or subjective categories. At such a time, when human oversight is more important than ever, it is vital for the industry to address the gap in developers’ security proficiency. In a conversation with the Talk Dev Bureau, Matias Madou discusses the urgency for enterprises to identify vulnerabilities, train their developers in security proficiency, and set up appropriate enterprise-relevant governance protocols.

As enterprises scale AI deployments across chatbots, copilots and agents, token-based pricing is becoming a primary cost driver — and board members and executives are starting to ask warranted questions about the real value of AI and its return on investment (ROI). But what is driving the pressure to maximize token spend, and what does this mean for modern developer environments?

​Artificial intelligence (AI)-driven coding is no longer experimental; it’s embedded in the majority of daily workflows. In fact, more than seven out of 10 developers who have tried using AI now use AI coding tools every day.​ Yet, most organizations lack visibility into how these tools affect production code, creating governance blind spots as demand spikes and deadlines accelerate.