Insights from experts shaping secure development

Recognition fuels participation. Enabler 7 celebrates developer achievement loudly, with rewards and exclusive swag that mark real, earned secure coding wins.

Secure Code Warrior is named in the Gartner® Hype Cycle™ for Application Security, 2026 for Agentic Coding Security and Secure Coding Training. Here's why.

Review the SCW AI Trust Index, our proprietary LLM benchmarking data, before going all-in on an AI model.

Executive buy-in doesn't sustain itself. Enabler 6 shows how regular reporting keeps leadership engaged, informed, and invested in program success.

Discover why Secure Code Warrior is becoming a channel-first company and how trusted partners help organizations adopt AI Software Governance securely and at scale.

Secure Code Warrior's AI literacy program for non-developer employees.

Today, Secure Code Warrior issued an all-new white paper covering a prescriptive, directional AI adoption model that security leaders can use to identify their adoption stage and make real progress in bringing the AI security risks within their organization under control.

Move beyond one-and-done training. Enabler 5 builds multi-level certification programs that give developers meaningful progression and validated skills.

NSA published its first MCP security guidance. SCW's curriculum already covers 18 of 23 issues raised — here's how it maps.

Gartner names SCW twice. As AI agents take over more development, SCW gives you the capability and governance to adopt AI-driven development securely.

Adaptive Learning bridges SCW Trust Agent with our entire learning platform, ensuring training stays perfectly aligned with real-time developer activity.

Align secure coding training to real AI development activity — automatically assigning guidance to developers using AI tools, without manual intervention.Align secure coding training to real AI development activity — automatically assigning guidance to developers using AI tools, without manual intervention.

Adaptive Learning auto-assigns targeted secure coding training to the developers introducing real vulnerabilities, reducing recurring risks at the source.Secure Code Warrior blog banner with a blue overlay over a developer working at a multi-monitor desk displaying code, alongside the headline 'Train developers on the real risks in their code.'l

Remove friction from your secure coding program with Enabler 4: Low Barrier to User Access. Explore SSO, front-loaded onboarding, and relay state strategies to get developers training with a single click.

I am proud to announce that Secure Code Warrior has signed a strategic collaboration agreement with Amazon Web Services (AWS). Given the rapid evolution of the threat landscape, this strategic collaboration could not come at a more mission-critical moment for both security leaders and future-focused developers.

I am thrilled to announce today an upcoming strategic partnership between Secure Code Warrior and KnowBe4. KnowBe4 is a world-renowned leader in comprehensively managing human and agentic AI risk, making them the perfect partner to help us distribute foundational security awareness to organizations across the globe.

Post-quantum cryptography (PQC) is critical for protecting data from quantum computing threats. Learn how “harvest now, decrypt later” exposes risk and how developers can prepare for quantum-safe security.

Keep developers engaged in your secure coding program with a strong communications plan. Learn to highlight benefits, set the right tone, and celebrate wins.

Anthropic's Claude Mythos represents a permanent, fundamental shift in how every security leader must approach their security program, especially with patch management of legacy systems.

Explore Enabler 2: Senior Leadership Sponsorship. Learn why active buy-in from the CIO, CTO, and CISO is vital to drive developer adoption and program credibility.

While development teams look to make the most of GenAI’s undeniable benefits, we’d like to propose a four-point foundational framework that will allow security leaders to deploy AI coding tools and agents with a higher, more relevant standard of security best practices. It details exactly what enterprises can do to ensure safe, secure code development right now, and as agentic AI becomes an even bigger factor in the future.

Cybermon 2025 Beat the Boss is now available year-round in SCW. Deploy advanced AI/LLM security challenges to strengthen secure AI development at scale.

Anthropic’s launch of Claude Code Security marks a defining collision point between AI-assisted software development, and the rapid augmentation of how we approach modern cybersecurity.

Learn what the EU Cyber Resilience Act (CRA) requires, who it applies to, and how engineering teams can prepare with secure by design practices, vulnerability prevention, and developer capability building.

Enabler 1 kicks off our 10-part Enablers of Success series by showing how to link secure coding to business outcomes like risk reduction and velocity for long-term program maturity.

2025 was a big year for AI, for cybersecurity, and for SCW. I’m approaching 2026 with quiet confidence, and the optimism that only hard work paying off can bring.

Secure Code Warrior’s 10 Enablers guide organizations in building lasting secure coding programs by focusing on people, process, and program maturity stages.

OWASP Top 10 2025 lists Software Supply Chain Failures at #3. Mitigate this high-impact risk via strict SBOMs, dependency tracking, and CI/CD pipeline hardening.

OWASP Top 10 2025 adds Mishandling of Exceptional Conditions at #10. Mitigate risks via "fail closed" logic, global error handlers, and strict input validation.

Discover what changed in the OWASP Top 10: 2025 and how Secure Code Warrior makes the transition easy with updated Quests, Courses, and developer insights.

Is the cybersecurity world moving too fast on agentic AI? The future of AI security is here, and it's time for experts to move from reflection to reality.

Trust Agent by Secure Code Warrior solves the secure coding crisis, validating dev proficiency on every commit. It discovers all contributors & automates governance in your dev workflow.

The AI debate isn't about use, but application. Discover how to balance the need for AI productivity gains with robust security by relying on developers who deeply understand their code.

Address cybersecurity risks at your organization with this actionable guide to carrying out effective cybersecurity risk assessments.

CISOs can’t rely on the same old awareness playbook. In the Age of AI, they must embrace modern approaches to safeguard code, teams, and organizations.

Learn how Trust Agent: AI provides deep visibility and governance over AI-generated code, empowering organizations to innovate faster and more securely.

AI-assisted coding is changing development. Try our new Copilot-style AI Challenges to review, analyze, and fix code securely in realistic workflows.

Introducing our free 12-week AI/LLM security video series! Learn the foundational risks of AI-assisted coding and how to build safer applications.

Your all-in-one guide to our 12-week AI/LLM security video series. Catch every episode, learn key AI security concepts, and follow along weekly.

Learn what secure coding really means and how secure coding practices can reduce both vulnerabilities and security-related costs at your company.

Celebrating 10,000+ secure code learning activities and a decade of empowering developers to reduce risk, improve code quality, and confidently tackle AI-assisted development.

AI-assisted development is no longer on the horizon — it’s here, and it’s rapidly reshaping how software is written. Tools like GitHub Copilot, Cline, Roo, Cursor, Aider, and Windsurf are transforming developers into co-pilots of their own, enabling faster iteration and accelerating everything from prototyping to major refactoring projects.

Secure Code Warrior is excited to announce our new integration with HackerOne, a leader in offensive security solutions. Together, we're building a powerful, integrated ecosystem. HackerOne pinpoints where vulnerabilities are actually happening in real-world environments, exposing the "what" and "where" of security issues.

In our latest white paper, our Co-Founders, Pieter Danhieux and Dr. Matias Madou, Ph.D., sat down with over twenty enterprise security leaders, including CISOs, AppSec leaders and security professionals, to figure out the key pieces of this puzzle and uncover the reality behind the Secure by Design movement. It’s a shared ambition across the security teams, but no shared playbook.

Vibe coding is like a college frat party, and AI is the centerpiece of all the festivities, the keg. It’s a lot of fun to let loose, get creative, and see where your imagination can take you, but after a few keg stands, drinking (or, using AI) in moderation is undoubtedly the safer long-term solution.

How a coding agent was tricked into writing SQL injection-prone code, installing shell tools, and maybe even stalking its user

Quests empower developers to master secure coding through interactive learning, reducing risk and optimizing development

Secure Code Warrior's founding team has stayed together, steering the ship through every lesson, triumph, and setback for an entire decade. We’re scaling up and ready to face our next chapter, SCW 2.0, as the leaders in developer risk management.

Organizations are facing tough decisions on AI usage to support long-term productivity, sustainability, and security ROI. It’s become clear to us over the last few years that AI will never fully replace the role of the developer. From AI + developer partnerships to the increasing pressures (and confusion) around Secure-by-Design expectations, let’s take a closer look at what we can expect over the next year.

Stay ahead in securing LLM applications with the latest OWASP Top 10 updates. Discover what's new, what’s changed, and how Secure Code Warrior equips you with up-to-date learning resources to mitigate risks in Generative AI.

Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.

The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.

Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.

Discover the latest security challenges facing Linux users as we explore recent high-severity vulnerabilities in the Common UNIX Printing System (CUPS). Learn how these issues may lead to potential Remote Code Execution (RCE) and what you can do to protect your systems.

Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.

Learn about our new Engagement Insight Report that provides in-depth analysis to help you measure your secure code learning efforts.

Secure Code Warrior helped DigitalOcean build and release quality code from the start, driving digital innovation and modernization with security-aware developers.

Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.

SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.

The Cybersecurity Strategic Plan pushes major changes to the way most organizations approach cybersecurity, and developers are in a unique position to help achieve those new goals.

Learn all about our agile learning methods, Microsoft teams integration, and our reports for development engagement.

Empower your developers with Secure Code Warrior. Our platform enables and empowers developers with learning content on demand.

Discover SCW Trust Score, providing deep insights into organizational security and developer competency.

Regulations governing the financial services industry, such as PCI DSS, emphasize the importance of secure code and the need for training developers in security best practices.

A critical vulnerability, CVE-2024-3094, was discovered in the XZ Utils data compression library used by major Linux distributions, introduced through a backdoor by a threat actor. This high-severity issue allows for potential remote code execution, posing significant risks to software build processes. The flaw affects early versions (5.6.0 and 5.6.1) of XZ Utils in Fedora Rawhide, with an urgent call for organizations to implement patches. The incident underscores the critical role of community volunteers in maintaining open-source software and highlights the need for enhanced security practices and access control within the software development lifecycle.

Generative AI offers financial services companies a lot of advantages, but also a lot of potential risk. Training developers in security best practices and pairing them with AI models can help create secure code from the start.

Secure Code Warrior and Mend.io discuss impacts of AI on security, proactive security approaches, and effective management of vulnerability alerts.

Learn about Secure Code Warrior's latest integration with Apiiro.

Learn about the most recent improvements to the Secure Code Warrior platform and what will be coming soon.

By following secure coding practices, developers can help to protect their applications from vulnerabilities that can be exploited by attackers. Just as a well-built house is less likely to collapse, a well-coded application is less likely to be hacked.

Agile learning accelerates issue resolution and boost developer efficiency with continuous learning.

While it is looking inevitable that LLM-style AI technology will change the way we approach many aspects of work - not just software development - we must take a step back and consider the risks beyond the headlines. And as a coding companion, its flaws are perhaps its most “human” attribute.

Today is our ninth birthday, and I remain immensely proud and grateful for our achievements and enduring place in cybersecurity land as the scene continues to change rapidly.

A deluge of complex security tools is making cybersecurity even more challenging for CISOs.

Secure Code Warrior top 10 predictions for the cybersecurity industry in 2024 and beyond.

SCW case study blog that highlights the agile learning environment that Netskope has deployed.

Explore the security risks of AI in software development and learn how to navigate these challenges effectively with Secure Code Warrior.

Empower developers with a tiered approach to cut vulnerabilities, fostering relationships and prioritizing recurring issues.

With a persistent skills shortage at odds with the deluge of code being written to satisfy the world’s software needs, many businesses are falling behind in their cybersecurity strategy and existing infrastructure. It’s time we took an honest look at our overall cybersecurity maturity, and assessed the viable quick wins that are right in front of us.

Security leaders need to rethink the value developers are getting from the secure code learning experience, and how to make the program more engaging and, most importantly, more impactful. In this blog, we’ll explore how to get developers excited about the secure code education through more hands-on learning and integrations with their tools to drive a big results and reduce vulnerabilities introduced up to 53%.

Learn how you can reduce vulnerabilities and security breaches with Secure Code Warrior’s hands-on agile security training.

Affected versions of the curl library are susceptible to a Heap-based buffer overflow vulnerability, related to a legacy issue with the SOCKS5 proxy protocol. Learn how to find and fix this vulnerability type with a playable mission.

CISOs are finding themselves in an increasingly fraught position: Protect more assets, ship more code, reduce a bigger attack surface, and do it with rapidly diminishing financial resources. It’s an inescapable fact that cybersecurity is viewed as a cost center, and despite an organization’s security program being what stands in the way of a threat actor making them tomorrow’s disastrous headline, security leaders must do more to sell in and prove the overall business value of the department, in language that makes sense to the executive body.

The MOVEit scenario is a little different from what many developers and AppSec professionals may have previously experienced, and you can test your SQLi-slaying skills in a live simulation right here.

New at Secure Code Warrior: set up tournaments for multiple companies, new coding guidelines, SCIM provisioning for users, and more!

It’s safe to say that the past couple of years have been transformational for cybersecurity standards, and while not mandatory, it should be a goal for all organizations to follow suit, and scrutinize vendor security practices as though they are part of their own internal security program.

Fresh off the back of our Series C funding announcement, I am thrilled to announce another step in our company’s journey. Security industry leader, Synopsys, has welcomed an exciting new addition to its product suite: Synopsys Developer Security Training, powered by Secure Code Warrior.

It seems baffling that most developers who work on code that powers critical infrastructure, automobiles, medical tech, and everything in between, do so without first verifying their security prowess. On the other hand, why do security-skilled developers, who have repeatedly proven that they understand how to build things securely, need to queue with everyone else in the ever-slowing development pipelines because of all the security gates?

The cost of addressing code vulnerabilities and technical debt is high and continues to suppress software development teams’ productivity. Learn how implementing an agile learning platform for secure code can more effectively train developers on secure coding techniques to fix vulnerabilities faster as well as earlier in the SDLC and prevent them in the first place to drive significant cost avoidance. This blog outlines how to think about the financial impact and ROI of an agile learning platform.

We announced the closing of our Series-C funding round, having raised USD $50 million towards the next phase of our mission: helping more pioneering organizations harness the power of their development cohort in thwarting common vulnerabilities.

Learn how an agile learning platform for secure code can be embedded into developer workflows and tools, and start to build a culture of secure code learning.

Earlier this year, the PCI Security Standards Council revealed version 4.0 of their Payment Card Industry Data Security Standard (PCI DSS). While organizations won’t need to be fully compliant with 4.0 until March 2025, this update is their most transformative to date, and will require most businesses to assess (and likely upgrade) complex security processes, and elements of their tech stack. This is in addition to implementing role-based security awareness training and regular secure coding education for developers.

Learn how an agile learning platform for secure code upskills developers, reduces risk, and lowers technical debt over time by starting left in the SDLC.

By helping define the responsibilities of our apps and software within a tight hierarchy, and enforcing those policies with least privilege, we can make sure that our apps and software also survive and thrive despite the threat landscape arrayed against them.

CISA's National Cybersecurity Strategy represents the best chance we have at raising software standards across the board and, finally, ushering in a new era of security-skilled developers.

On March 20th 2023, Spring Security Advisories published a blog post referencing an internally discovered vulnerability, CVE-2023-20860. No detailed information was disclosed, except that it was an access control issue concerning the use of `mvcMatchers`. Spring developers have remediated the issue, and a version update is advised. Since security is our main focus at Secure Code Warrior, we decided to take a deeper dive into this mvcRequestMatchers vulnerability and figure out where the core issue lies.

CyberNews Q&A with Pieter Danhieux, CEO & Co-Founder, Secure Code Warrior.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

Secure Code Warrior announced that Netskope launched its developer training program through Secure Code Warrior’s agile learning platform.

Industry experts offer thoughtful, insightful, and often controversial predictions on how DevOps and related technologies will evolve and impact business in 2024. Part 6 covers AI's impact on DevOps and development.

As developer education and training become more tailored to individual preferences, here's what the future of developer training will look like over the next year, and how AI will play a role in its evolution.

Australia’s Home Affairs Minister, Clare O’Neil, revealed in September that the 2023 update to the Australian Cybersecurity Strategy would focus on “six cyber shields” to protect citizens and businesses from cyber criminals, including safer technology, supporting Australia’s cyber ecosystem, and threat intelligence sharing.

Pitched as a global gamechanger, the 2023-2030 Australian Cyber Security Strategy sees Australia as the world’s most cyber secure nation. What’s the view from the frontline?

Cybercriminals tend to follow the path of least risk and resistance with Application Programming Interface (API) security creating a window of opportunity for a cyber attack with a low barrier to entry. It’s a problem that has existed for years and is currently spiralling out of control.

Zombies have been a mainstay of the horror movie genre for many years, both delighting and terrifying loyal fans. However, while they might be appreciated on the big screen, they’re much less welcome when it comes to the security of application programming interfaces (APIs).

If security has not been made a priority from the very beginning of a product or software build, then chances are good that the product in question will not have security baked in.

Of all the challenges currently facing Chief Information Security Officers (CISOs), one of the most significant is attracting and retaining new talent. This is because demand is far outstripping supply.

After a week of rampant speculation about the nature of the security issues in curl, the latest version of the command line transfer tool was finally released today. Described by curl project founder and lead developer Daniel Stenberg as "probably the worst curl security flaw in a long time," the patches address two separate vulnerabilities: CVE-2023-38545 and CVE-2023-38546.

Enterprises run an average of 15,564 APIs within their organization. That’s far too many to track without a plan, and the general lack of ownership surrounding API security has created the ultimate white elephant.

Secure Code Warrior, the global, developer-driven security leader, today announced that it will host its third annual Devlympics secure coding competition on October 17-18, 2023.

Instead of feeling apprehensive at the prospect of more potential regulations, organizations should instead embrace the opportunity to use CISA's plan to strive for better, higher-quality software.

Demand for new software continues to surge, increasing pressures to generate more products, more rapidly. Given the challenging environment, it should come as no surprise that the vast majority of developers now use artificial intelligence (AI) to better position themselves to cross the finish line with time to spare.

The State of API Security Q1 2023 report from Salt Labs paints a grim picture of the climate surrounding API security in most enterprises, with “zombie APIs” a key factor in API-related cyberattacks surging by 400% compared to the previous six-month period.

In security media, the Software Bill of Materials (SBOM) is having renewed time in the sun. It stands as one of a handful of dominant trending topics, thanks in no small part to recent guidance from the US government.

Recognising that the popularity of AI tooling – along with its potential benefits – won’t go away anytime soon, it is imperative that we consider the underlying security implications of utilising the technology in development workflows.

Pieter Danhieux of Secure Code Warrior discusses how filling the cybersecurity talent gap starts with getting everyone on board with security familiarity.

Synopsys has partnered with NowSecure and Secure Code Warrior to enable organizations to better identify where they can improve DevSecOps best practices.

Security industry leader, Synopsys, has welcomed an exciting new addition to its product suite: Synopsys Developer Security Training, powered by Secure Code Warrior. You can read the full press release here.

What is a CISO today? We don’t have to go too far back to a time when they were part of the IT team, directing IT staff and planning cybersecurity defenses. Though vital work, CISOs previously were not part of upper management and left little impact on the core business. The ever-increasing risk of a cybersecurity breach, and the spiraling cost of cleaning up afterwards, has changed this.

From ransomware attacks to phishing scams, cybercriminals are using increasingly sophisticated methods to steal data and disrupt operations. Australia’s leading cybercrime experts share advice for boards determined to keep their organisations a step ahead of the threat.

What separates superstar CISOs from the rest of the pack is that they are keenly aware of the burgeoning threat landscape and the cybersecurity skills shortage, but they don’t give in to despair. Instead, they use their existing assets to great effect, including tapping into a hidden source of strength that is critically overlooked as a security resource: their development teams.

In software development, the importance of secure coding practices cannot be overstated. Fostering a security culture within development teams has become crucial to ensure the integrity and protection of digital systems.

Secure Code Warrior today closed a $50 million Series C funding round led by Paladin Capital Group. It brings the company’s total raised to over $100 million.

Secure Code Warrior, the leading agile learning platform for developer-driven security leaders, today announced it closedits Series C funding round amounting to $50M USD, marking the largest investment since the company’s inception.

Secure Code Warrior, the Australian cybersecurity start-up which helps software developers make their products less vulnerable to hacking, has secured $US50 million ($73 million) in one of the biggest raising of the year.

By investing time and resources in key areas—building loyalty, tackling legacy systems, and creating a culture focused on security—CISOs can both protect their organisations and lower their stress levels.

In this episode, Pieter Danhieux joins us in learning the balance between speed and security and the potential impact of AI in various industries, acknowledging that AI is not a magical solution but a tool for assisting with heavy work.

Recognizing that the popularity of AI tooling—along with its potential benefits—won’t go away anytime soon, we must understand the underlying security implications of utilizing the technology in programming workflows.

Nearly thirty years after the first CISO role was established at Citicorp, the role finds itself in a difficult position. The demands have never been higher—more assets to protect, a larger attack surface, more incidents than ever before.

As adoption of banking apps grows, so does pressure to increase the range of capabilities the apps support, which has security ramifications.

Developers want bug-free code -- it frees up their time and is easier to maintain. They want secure code for the same reasons. We'll talk about how the definition of secure coding varies among developers and appsec teams, why it's important to understand those perspectives, and how training is just one step towards building a security culture.

We're still unprepared to fight the security bugs we already encounter, let alone new AI-borne issues.

Key insights from AppSec Decoded to improve the ‘Sec’ in DevSecOps—what to know today.

We spoke to Matias Madou, Co-Founder and CTO of Secure Code Warrior, about his journey in business.

The recently released National Cybersecurity Strategy signals the need for a seismic cultural shift for most companies and their developers and DevOps teams.

Australia is spending more than A$2bn to strengthen cyber resilience, improve digital government services and fuel AI adoption, among other areas, in its latest budget.

The federal Labor government handed down its first budget in over a decade last night, and while many pundits are trying to figure out the winners and losers, cyber security does seem to be getting a boost.

Transform your culture to place a high priority on security as an indicator of software quality and brand integrity.

Matias Madou of Secure Code Warrior, writes that CISOs have to push hard to find budget dollars for developers who are focused on keeping code secure.