Insights from experts shaping secure development

It is clear from the Australian Government's push to get serious about cybersecurity that it has been identified as a key risk area on a national level, but is their strategy reaching far enough?

The Sensei plugin provides an easy way to find specific code patterns in your source code, and then apply rewrite rules to amend the matching code. All within the Intellij IDE, and in real-time.

Secure Code Warrior has built a GitHub Action that brings contextual learning to GitHub code scanning. This means developers can use a third-party action like the Snyk Container Action to find vulnerabilities, and then augment the output with CWE-specific, hyper-relevant learning.

The missing function level access control vulnerability allows users to perform functions that should be restricted, or lets them access resources that should be protected.

Every organization can utilize Cybersecurity Awareness Month to refresh their security awareness, and this year, were also launching a new, free app for the coding community!

This vulnerability occurs when too many requests come in at the same time, and the API does not have enough computing resources to handle those requests. The API can then become unavailable or unresponsive to new requests.

Shifting security fixes back towards the development process isn't easy, but is necessary in today's world where even seemingly simple devices like presentation tools are both surprisingly complex, and also networked into everything else.

The actual mechanics behind this vulnerability are similar to others, but excessive data exposure, in this case, is defined as involving legally protected or highly sensitive data.

Authentication often acts as a gateway to both an application and potentially to the rest of a network, so they are tempting targets for attackers. If an authentication process is broken or vulnerable, there is a good chance that attackers will discover that weakness and exploit it.

We'd like to shine the spotlight on one of our experts, Oscar Quintas. He's part of our Product Content team, working as a Senior Security Researcher. He's also our resident sorcerer on all things Infrastructure as Code (IaC).

In general, object level authorization checks should be included for every function that accesses a data source using an input from the user, and failure to do so comes at a great risk.

Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud.

With your organization in mind, think about these questions in the context of your role. How would it fare when put to the DevSec test?

A curated course containing the exact modules in which your developers would need to show proficiency will have a potent impact, and allow them to hit the ground running when it comes to security best practices in their day-to-day work.

We already know there is too much going on in a workday, so what incentive do developers have to schlep off to a classroom, or context-switch to go through five steps to access static theory-based training?

The idea behind contact tracing apps is sound. This technology, when functioning well, would ensure hotspots are quickly revealed and comprehensive testing can occur - both essential components of fighting the spread of a contagious virus.

We started to think about what we could do to reduce the barrier to getting training when you need it, and how micro-learning could be implemented into your workflow in a more seamless way.

June 23rd is a special entry in the geek calendar, marking International Women in Engineering Day. This is our chance to cast light on the contribution of women to software development.

This vulnerability can occur when coders fail to properly implement business logic rules, which could leave their applications vulnerable to different kinds of attacks should a malicious user choose to exploit them.

Rust incorporates known and functional elements from commonly used languages, working to a different philosophy that disposes of complexity, while introducing performance and safety.

The vulnerability-inducing behavior that we are going to focus on here is using code from untrusted sources, a seemingly benign practice that is causing big problems.

Healthcare could be the next 'great' cybersecurity battleground, with criminals attacking the very machines that diagnose medical problems, provide treatments and sustain life.

Security misconfigurations, especially those of the improper permissions variety, most often happen whenever a developer creates a new user or grants permission for an application as a tool in order to accomplish a task.

At times, applications will also share data with other programs as part of an overall workload. Unless the transport layer is protected, it makes it vulnerable to both outside snooping and unauthorized internal viewing.

These days, having critical data like passwords, personal information and financial records hashed while at rest is a cornerstone of any cybersecurity defense.

Legacy COBOL, although an older computer language, is still effective to this day. Learn more about COBOL secure application development from Secure Code Warrior.

The key to most computer security these days involves passwords. Even if other security methods are employed, like two-factor authentication or biometrics, most organizations still employ password-based security as one element of their protection.

We must get to a stage where security is seen as a shared responsibility across the entire organization, and throughout the SDLC. This is certainly possible when you commit to a fully-fledged, highly supportive DevSecOps environment.

Without infrastructure-level access control in perfect order, it opens up an entire enterprise to attackers, who can use that vulnerability as their gateway for either unauthorized snooping or a full attack.

Attackers will always attempt to find easily exploitable vulnerabilities first and may even use a script to run through common weaknesses. It's not unlike a thief checking all the cars on a street to see if any doors are unlocked, which is a lot easier than smashing a window.

This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers.

This is part 1 of a two-part series on successful PCI-DSS compliance within an organization. In this chapter, we detail how AppSec specialists can work closely with development managers to empower developers, strengthen the SSDLC and get specific outcomes from general legislation.

In our industry, many security experts have started predicting the hot-button issues for the year, but with more than five billion sensitive data records stolen in 2019, we figured it would be more accurate to predict what won't be happening in cybersecurity in the foreseeable future.

Much of the initiative around "shifting left", that is, introducing security much earlier in the development process, simply doesnt move the needle far enough.

With the advent of GDPR, as well as a revised strategy following a multi-stage attack that exposed the sensitive data of many public figures - as well as servers in the German federal government - it is clear that cybersecurity awareness and action are front-of-mind for leaders in the DACH region.

The world is starting to move on past Waterfall, Agile, and now DevOps, so what is the next solution? And as a developer, what is your role in keeping pace with these changes in approach?

Towards the end of last year, the amazing community at MITRE published their list of the CWE Top 25 Most Dangerous Software Errors that affected the world in 2019. And most of it was no surprise.

I could have started this article with all the facts and figures indicating a thriving, hyper-growth startup; they are undeniably impressive and our ongoing company trajectory is strong. However, for me, these numbers don't reflect what I am most proud of in 2019.

Few companies are truly successful in their DevOps implementation. However, the right support, nurturing and understanding across the business can transform your process.

The National Institute of Standards & Technology (NIST) released an updated white paper, detailing several action plans for reducing software vulnerabilities and cyber risk.

These developer-focused events are among my favorite on the calendar; they provide a humbling reminder of the community that works tirelessly to educate and empower software engineers and specialists to champion security in their work.

While regulatory initiatives will undoubtedly improve and grow over time, if organizations are already hitting the panic button and leaping into training now, they might just find themselves ill-equipped for the future.

There are developers of all types, from all walks of life, and there has always been a sense of community in everything we do.

While secure coding needs to become a mandatory component of software engineering at the tertiary level, some universities are leading the charge in providing top-notch training and prioritizing security as part of the development process from the very beginning.p

Our VP of Customer Success, Fatemah Beydoun, recently presented her talk, "Mentoring for the future: How we can all do better in fostering female cybersecurity talent" to a very receptive audience. She has been an integral part of driving positive change within the cybersecurity industry.

Insecure deserialization can happen whenever an application treats data being deserialized as trusted. If a user is able to modify the newly reconstructed data, they can perform all kinds of malicious activities such as code injections, denial of service attacks or elevating their privileges.

It truly boggles the mind that many places still rely on classrooms, dry textbooks and mind-numbing video training to get their best and brightest on-board with new initiatives, especially when there's a far better, more engaging and more valuable way to learn: contextual training.

The software security industry isn't exactly known for its warm and fuzzy feelings, whimsical observations and life commentary, but, perhaps as I get older, I find myself reflecting on the impact we can all have in the world.

Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state.

Teen security researcher, Bill Demirkapi, exposing major vulnerabilities in software used by his school certainly brought back some memories. I remember being the curious kid, lifting the hood on software to take a peek underneath and see how it all worked... and if I could break it.

While VxWorks isn't a household name to the average consumer, this software product benefits many people just like you and me, each and every day. And now, we are faced with the possibility that hundreds of millions of VxWorks-powered devices are now compromised.

The XML External Entity Injection attack, sometimes simply abbreviated as XXE injection, is relatively new, but it's extremely popular among hacking communities right now, and growing even more so as it racks up successes.

If an attacker can insert a CR or LF code into an existing application, they can sometimes change its behavior. The effects are less easy to predict compared with most attacks, but can be no less dangerous to the target organization.

Creative, inspiring CISOs and CIOs have the power to innovate and shape our digital world, but they can also be instrumental in transforming an organizations security culture.

In many ways, the remote file inclusion vulnerability is much more dangerous, and also easier to exploit, than its local file counterpart. As such, it should be found and remedied as soon as possible.

This year, the PCI Security Standards Council released an all-new set of software security guidelines as part of their PCI Software Security Framework. This update aims to bring software security best practice in-line with modern software development.

Unlike many vulnerabilities, exploiting local file inclusion and path traversal processes for nefarious purposes requires a sufficiently skilled attacker, a fair amount of time, and perhaps a bit of luck.

Even if you have completely secured an application server and the backend systems it uses, communications might still be vulnerable to snooping if you have insufficient transport layer protection.

XML injection attacks are nasty little exploits invented by hackers to help them compromise systems hosting XML databases. This includes the kinds of things that come to mind when one thinks about traditional databases - detailed stores of information about anything from medicines to movies.

A recent report from the UK's Huawei Cyber Security Evaluation Centre identified major security issues within Huawei's software engineering processes. But it's a problem that can be fixed.

Addressing hot-button issues like how to make the most of an organization's AppSec budget, as well as several curly questions from the audience, the Leaders in AppSec panel delivered some real morning magic that will help security specialists build out viable programs within their organizations.

Insufficient logging and monitoring is one of the most dangerous conditions that can exist within an application's defensive structure. If this vulnerability or condition exists, then almost any advanced attack made against it will eventually be successful.

Coding a website or application with the ability to process unvalidated redirects and forwards can be extremely dangerous for both your users and your organization.

It's official: we are joining forces with Bugcrowd in the fight to educate, empower and enlighten developers on secure coding.

Code injection attacks are among the most common, and also the most dangerous, that many websites and applications will encounter. They run the gamut both in terms of sophistication and in the danger that they pose, but nearly any site or app that accepts user input could be vulnerable.

The recent attack on GitHub repositories highlights a well-known issue within the security industry: most developers are simply not sufficiently security-aware, and valuable data could be at risk at any time.

When you build a business application, whether for internal use or external use by your customers, you probably don't let every user perform every single function. If you do, you may be vulnerable to broken access control.

With cyberattacks on the rise - affecting every type of organisation in every vertical - the threat of expensive, embarrassing and bottom-line-affecting data breaches is very real. The problem is not getting smaller, it's growing like a tumour.

When your web app reveals too much information, it can make it easier for attackers to break into it. jIn this post, we'll cover what information exposure is, why it's dangerous, and how to prevent it.

Since all applications use components, most of which you haven't written, vulnerabilities within the components you use can become liabilities. Let's discuss what using components with known vulnerabilities means, how dangerous it is, and how to resolve it.

Having been on both sides of the fence, I know all too well the tension that can arise between the development team and AppSec specialists when it comes to upholding security best practice. However, there is a better approach.

Were going to cover one of the most common problems faced by organizations that either run websites, or which allow employees to remotely access computer resources - which is pretty much everyone. And yes, you probably guessed that we are going to be talking about authentication.

If an application has insufficient anti-automation checks in place, attackers can simply keep guessing at passwords until they find a match. Heres how to stop them.

Although coding issues may be part of the problem, business logic errors are most frequently a result of design flaws or incorrect logical assumptions when an app is first created.

In cybersecurity, we are often like hunters. Our eyes are firmly glued to the horizon, scanning for the next breakout vulnerability. However, this forward-looking focus can have the surprising effect of dampening our overall security awareness.

It's common for websites and applications to allow users to send feedback and various other bits of information through an application using email. And most people don't even think about it in terms of a potential security risk.

A direct object reference is when a specific record (the 'object'), is referenced within an application. It usually takes the form of a unique identifier and may appear in a URL.

Software security is always front-of-mind for me, as is the very real danger posed by our increasingly digital, personal information-sharing lifestyles. After all, we are in a largely unregulated, unsupervised and blissfully ignored territory. We're in the Wild West.

In this digital society, developers are responsible for keeping info & businesses safe from insecure cryptographic storage. Learn from Secure Code Warrior.

A huge majority of websites use XML databases to perform critical functions such as holding user login credentials, customer information, personal identity information and confidential or sensitive data, leaving XQuery attacks with a rather large attack footprint.

What is security misconfiguration? Find the most popular security misconfigurations & how to prevent vulnerabilities. Learn from Secure Code Warrior.

The older my daughter and the company gets, the more I realise there are so many similarities between a startup journey and the ���first-time�۝ parent journey. I am in my fourth year for both now.pi

Let's take a look now at how clickjacking works, why it's dangerous, and what developers like you can do to prevent it.

OS command injection attacks can be performed by entry-level and less skilled hackers, which makes them one of the most common weaknesses that security teams experience. Thankfully, there are quite a few very effective ways to prevent them from being successful.

Sessions are key to a good user experience when using the web. However, managing sessions incorrectly can lead to security holes that attackers can exploit.

Don't you think it's time we gave security a makeover? It's as simple as changing the conversation and making everything a little more positive (not to mention fun!) for both sides, especially the development team.

While Padding Oracle sounds like a really bad name for an alternative rock band, it's actually a vulnerability that can be used by attackers to decrypt information without knowing the encryption key.

Problems can occur when malicious users can manipulate an LDAP query. Doing this can trick the receiving server into executing invalid queries that would normally not be allowed, or even granting high level or administrator access to invalid or low-security users without a password.

The real battle we face isn't against script kiddies, or dangerous organized cybercrime syndicates... its in getting more people to care that data breaches are happening at all.

In cybersecurity, attackers can be quick to exploit any application or program that has been allowed to support unrestricted file uploads. And the results can be devastating.

NoSQL databases are becoming increasingly popular. It's hard to deny their speed and ease of dealing with unstructured data, but as use becomes widespread, more vulnerabilities inevitably bubble to the surface.

CSRF attacks are fairly complex and rely on multiple layers to be successful. In other words, lots of things have to break in favor of the attacker for it to work. Despite this, they are an extremely popular, lucrative attack vector.

Attackers are using SQL injection - one of the oldest (since 1998!) and peskiest data vulnerabilities out there - to steal and change the sensitive information available in millions of databases all over the world.

When online privacy attempts to exist without security, chaos reigns. Just ask Ross Ulbricht.

Observing: the rising innovation and leadership of financial institutions in upskilling their developers on secure coding.

There's a well-known theory that cockroaches can survive basically anything - even a nuclear explosion.

There are many solutions that find vulnerabilities in code, but security needs to place more emphasis on teaching developers to follow security guidelines that will prevent them from making these mistakes in the first place.

We must work to change the conversation, to make security an integral part of every developer's working life. And I think one of the best ways to do this is by empowering and engaging with developers on security through, for example, gamification.

We must stop thinking of security as an irritating obstacle on the path of company innovation.

I thought I would end up in an infrastructure or service support sort of career, and then got a development opportunity in a graduate program. Turns out thats exactly where I needed to be.

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.

Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.

Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.

In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.

Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.

IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.

Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.

Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.

Hitachi Vantara and Secure Code Warrior warned that the spread of AI is reshaping cyber risk for organisations during Cybersecurity Awareness Month.

Both said attackers are using AI to move faster and scale up attacks. They also warned that companies are under pressure to strengthen data governance and recovery planning as regulators sharpen their focus on operational resilience and data handling.

Cyber Security Action Month (known as Cyber Security Awareness Month globally) is an annual Australian awareness campaign held in October to encourage people and businesses to improve their online security through simple everyday habits.

Governments can no longer treat machine-speed cyber-attacks as a future scenario because – as the recent Medicare breach showed – the future is here.

‍

‍

October is Cybersecurity Awareness Month, and if the last twelve months have proven anything, it’s that the threat landscape isn’t slowing down to observe it. From AI-powered phishing campaigns and deepfake-driven social engineering to the steady drumbeat of ransomware attacks hitting hospitals, schools, and municipalities, security teams have had precious little downtime in 2026. This annual observance, now in its third decade, remains one of the industry’s best excuses to pause, take stock, and ask: are we actually getting safer, or just busier?

OpenAI has abandoned an update of Astra planned for release in October after internal testing found safety and alignment problems - an increasing source of concern at the company.

OpenAI agents “infiltrated” the Government websites in Australia when tasked with relatively mundane research, in what is being noted as one of the first incidents of its kind.

This event, following other AI agent breaches, highlights critical issues: the dangers of unaligned AI, developer accountability, and inadequate incident disclosure protocols. Experts emphasize the urgent need for technical boundaries, robust monitoring, and mandatory, timely reporting to prevent future, potentially catastrophic, incidents.

Medicare and at least three other government systems were compromised by an AI agent in June – and we’re only finding out now, to the alarm of many in the industry.

Keeping pace with global AI regulation is becoming almost as difficult as keeping pace with the technology itself. For security leaders, each week brings a new development, regulatory proposal, or policy shift, each adding to an already complex risk landscape.

Threat modelling is hardly new for organisations with a mature, defence-in-depth approach to cybersecurity. It has long been a cornerstone of preventative security, helping businesses identify and address weaknesses before they can be exploited.

Secure Code Warrior has launched Citizen AI, an AI literacy training programme for non-developer employees intended to support responsible AI adoption across business functions.

New AI literacy program equips non-developer employees with the judgment, risk awareness and responsible-use habits needed to safely adopt AI-powered workflows.

Secure Code Warrior announced Citizen AI by Secure Code Warrior, a new AI literacy program designed specifically for non-developer employees to help organizations build a workforce ready for responsible AI adoption. Citizen AI helps organizationsreduce AI-related human risk, support broader enterprise AI governance initiatives, increase employee confidence when using AI and accelerate the safe adoption of AI-powered workflows.

‍

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today announced Citizen AI by Secure Code Warrior, a new AI literacy program designed specifically for non-developer employees to help organizations build a workforce ready for responsible AI adoption.

New AI literacy program equips non-developer employees with the judgment, risk awareness and responsible-use habits needed to safely adopt AI-powered workflows.

Organizations are missing a big target when developing governance and developer training programs for AI-assisted software development.

AI software development continues to evolve at a rapid pace for developers and their teams. , CEO & Co-Founder at Secure Code Warrior, posits that as the norm shifts from human-written code to AI-assisted coding and agentic workflows, many security teams now face a critical challenge: managing the new risks that autonomous systems introduce.

‍

‍

The question facing software development shops isn’t whether Generative AI should be used to create software code, or whether the percentage of code generated by GenAI will increase in the near future. That horse bolted in the last 24 months. The question is how to maintain security and compliance while GenAI and artificial intelligence agents are putting software code in play.

Every September, National Insider Threat Awareness Month serves as a timely reminder that some of the most damaging security incidents don’t originate from external attackers breaching the perimeter — they come from within. Whether through malicious intent, negligence, or simple human error, insiders with legitimate access to systems, data, and facilities remain one of the most persistent and difficult-to-detect risks facing organizations today. As hybrid work, AI-powered tools, and increasingly complex IT environments reshape the workplace, the insider threat landscape continues to evolve in ways that demand fresh attention from security professionals.

With agentic AI further boosting productivity, human code review becomes a serious bottleneck. Developers need to move upstream, establishing the ground rules to ensure that AI plays by the rules.

​The cybersecurity industry, which has been advocating for “security by design” principles for more than a decade, stands in wide-eyed amazement at the risks posed by artificial intelligence (AI). As organizations rush to embrace AI enablement, a CISO’s most pressing priority is to avoid becoming a roadblock. However, without effective AI usage and governance, observability and traceability, organizations may be blindsided by their AI risk.​

Secure Code Warrior has introduced the SCW AI Adoption Model, a framework designed to help organisations govern AI use in software development as the industry shifts from the traditional software development lifecycle (SDLC) toward what the company calls the Agentic Development Lifecycle (ADLC).

With many software engineering teams moving from AI coding assistants into full agentic AI code generation and increasing the amount of code they produce exponentially, ensuring the security of that code must be a top priority. The study produces practical guidance for organizations that are getting on board the AI-assisted or agentic code development train.

Token use can create unexpected, sizeable costs for organizations.

AI enables faster development cycles and allows developers to focus on higher-value work. For many businesses, these efficiencies are becoming essential to remaining competitive. The challenge, therefore, is not whether to adopt AI, but how to do so responsibly. Businesses that invest in developer education, governance frameworks, AI observability and robust security controls will be better positioned to capture the benefits while limiting the associated risks.

The issue is no longer simply about protecting AI models themselves. Increasingly, attackers are focusing on the software ecosystem surrounding those models, including the development tools, middleware, open-source libraries, and automated deployment pipelines that organisations rely upon every day.

As we will unpack together, there is a lot of movement around the world, with some collaboration between nations, but the path forward is far from uniform or clear, particularly in business environments where AI adoption is often mandated before holistic safeguarding measures are in place.  

According to one expert, AI guardrails are not designed as “security boundaries” but rather to influence behaviour – but what if that behaviour is hacking one of your industry partners?

‍

Cyber security experts have warned that the breach of Hugging Face infrastructure during an OpenAI security evaluation marks a turning point in the risks posed by autonomous AI agents. In the incident, AI models moved beyond a controlled test and carried out a live, multi-stage intrusion against the AI platform.

AI-generated code introduces an average of 15 confirmed vulnerabilities per codebase, research published by Secure Code Warrior indicates.

Frontier AI is facing a PR crisis. After Hugging Face released a blog post on July 16 claiming an autonomous agent had breached its internal environment, OpenAI posted on July 21 that the incident occurred when GPT 5.6 Sol and a “pre-release model” escaped a controlled testing environment.

Secure Code Warrior research reveals AI-generated code introduces an average of 15 vulnerabilities per codebase.

‍

Secure Code Warrior introduced the SCW AI Trust Index, a living benchmark for AI coding security that grows with every new model, helping organizations understand and govern the security risks introduced by AI-generated code. Built on a methodology created with RMIT University, Australia, then extended by Secure Code Warrior, the research presents comprehensive benchmarks on how often leading LLMs produce insecure code, with material implications for every enterprise scaling AI-assisted development.

AI-generated code introduces 15 vulnerabilities on average per codebase, but the actual risk depends on framework pairing more than the model used.

New SCW AI Trust Index shows AI-generated coding risk is not random, it's predictable by model and framework, giving security leaders the data to safely scale AI-assisted development.

The challenges with AI implementation, constant updates, and the race for industry dominance are coming thick and fast, and security professionals are among the most affected by its vast risk profile.

The Australian government has said AI is very much in the country’s future national interest – but where does it stand today? Here’s what the industry’s best and brightest have to say about artificial intelligence and its role in the modern enterprise.

‍

The emergence of agentic AI marks a structural shift in software development, introducing systems that not only accelerate production cycles but also perform autonomous reasoning and action beyond direct human control.

As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.

According to a recent survey, more than seven in ten developers who have used AI coding tools report relying on them on a daily basis. However, many organisations still lack clear visibility into how these tools are influencing production code, creating governance gaps at a time when demand is accelerating and delivery timelines are tightening.

This category has taken on new urgency in 2026 for a reason that’s specific to this moment: AI coding tools and agents are dramatically increasing how much code gets written and how often it needs to be deployed, tested, and provisioned for. Platform engineering is the layer that determines whether that increased velocity translates into shipped value or into chaos.

As enterprises embrace agentic AI and vibe coding, Secure Code Warrior CEO and co-founder Pieter Danhieux warns that code-generating models are still producing critical security flaws.

Secure Code Warrior, a leader in AI software governance and developer security upskilling, today introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organisation sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?

Secure Code Warrior has introduced its new SCW AI Adoption Model, a practical framework that maps the progression of AI use in software development, from minimal AI assistance to fully autonomous agentic orchestration. The framework helps CISOs assess their organization’s level of AI adoption, identify the training developers need at each stage, and determine the governance controls required as autonomy increases, answering the question every security leader is asking: Where do we start?

Secure Code Warrior has launched an AI Adoption Model for software development, aimed at Chief Information Security Officers managing AI use across development teams.

SCW’s framework gives organisations a clear entry point and practical roadmap for every team — at every stage of the AI adoption curve.

Secure Code Warrior introduced its new SCW AI Adoption Model, a practical framework that maps the full progression of AI use in software development, from minimal AI assistance or fully autonomous agentic orchestration. The framework gives CISOs a roadmap to identify where their organization sits today from an AI adoption perspective, the training developers need at each stage, and which governance controls are required as autonomy increases — answering the question every security leader is asking: where do we start?