Insights from experts shaping secure development
Access expert content on secure coding, AI governance, and software risk management.
AI in the SDLC: Separating the Hype from the Security Reality
AI in the SDLC, presented in partnership with KnowBe4: Kawin Boonyapredee (CISO Advisor, KnowBe4) and Pieter Danhieux (CEO, SCW) unpack AI code security risks.
German OWASP Day 2026
Secure Code Warrior is sponsoring German OWASP Day 2026, bringing together AppSec practitioners to explore best practices in secure development, operations, and testing. SCW will share how to build security into every stage of the development lifecycle.
AdelaideSEC
Secure Code Warrior is hosting a secure coding tournament at AdelaideSEC. Developers and security professionals compete hands-on to identify and fix real-world vulnerabilities, sharpening skills and connecting with the local tech community.
Black Hat USA 26
Secure Code Warrior is exhibiting at Black Hat USA 2026 in Las Vegas. CEO Pieter Danhieux, Chief Customer Officer Fatemah Beydoun, and Chief Product and Technology Officer Alex Bullen will be on-site — reach out to book a meeting.
FS-ISAC APAC Summit
Can't wait to sponsor the FS-ISAC APAC Summit on July 14–15, 2026, in Singapore! Stop by Booth #8 to connect with our team, and don't miss Pieter Danhieux on July 14 at 1:15 PM in Heliconia 3401, revealing groundbreaking research on how AI coding models stack up against 10,000 human developers and what it means for security in AI-assisted development. See you there!
Gartner Security & Risk Management Summit 2026
Excited to sponsor the Gartner Security & Risk Management Summit in London, September 22–24, 2026! Come connect with our team to see how Secure Code Warrior is helping organizations govern AI-generated code and build lasting security skills across the SDLC. See you there!
%252520(1).avif)
OWASP Global AppSec USA
Proud to be a Silver Sponsor of OWASP Global AppSec USA 2026, celebrating its 25th anniversary on November 5–6, 2026, at the Hyatt Regency in San Francisco! Join us and 800+ application security professionals for sessions on AI security, threat modeling, a Capture the Flag competition, the OWASP Projects Demo Room, and exclusive networking receptions. Come find us there and let's connect!
Customer Showcase Webinar: Danske Bank
Danske Bank shares how they built a thriving secure coding culture — key strategies, real results, and lessons you can replicate. Watch on demand.
Gartner Security & Risk Management Summit
Join us at Gartner Security & Risk Management Summit, from June 1-3, 2026, in National Harbor, Maryland. We’re excited to join CISOs and cybersecurity leaders to gain expert insights on AI, risk resilience, and evolving threat landscapes to strengthen their organization's security posture. Don’t forget to connect and stop by our booth!
From Shadow AI to AI Software Governance: Regaining Visibility Across Your Codebase
Join Secure Code Warrior’s Matias Madou, CTO, and Tamim Noorzad, Director of Product, to learn how AI Software Governance provides the visibility and insight needed to manage AI-assisted development at scale.
OWASP Global AppSec EU
Can’t wait to sponsor OWASP Global AppSec EU Conference, marking its 25th anniversary from June 22–26, 2026, at the Austria Center in Vienna. Join us and over 800 other experts to explore the vibrant exhibitor hall, participate in the Meet the Mentor program, and earn CPE credits, all while enjoying exclusive networking receptions. Don’t forget to connect and stop by our booth!
OWASP BASC
We are excited to sponsor OWASP BASC on April 11 in Boston, MA. This is the premier application security conference that brings together security professionals, developers, and researchers to advance the field of application security in Boston.
OT Summit Madrid
Join us at the OpenText Summit Madrid 2026, an in‑person event designed to show how AI, cloud, and secure information management are powering a new generation of intelligent enterprises.
Cyber Security Summit
The Cyber Security Summit takes place on April 28th and 29th and is a premier conference that assembles top-tier experts, innovators, and exhibitors to showcase the latest trends, resilient IT strategies, and industry best practices. Don’t miss this opportunity to stop by our booth and connect with us!
Developer Security Proficiency: Accelerating Vulnerability Remediation with Integrated AST and Secure Developer Upskilling
Stop just finding vulnerabilities and start fixing them for good. Detecting a bug is only half the battle. To achieve true Secure by Design, security insights must translate into fast, effective remediation. Join experts Eric Johnson from Secure Code Warrior and Steven Zimmerman from Black Duck on March 18 to learn how to bridge the gap between detection and developer upskilling.
Tech Council Parliamentary Innovation Showcase
A flagship event of the Tech Council of Australia (TCA), the Parliamentary Innovation Showcase 2026 offers a fantastic opportunity for decision-makers, industry leaders, academics, and tech enthusiasts to explore cutting-edge technologies, exchange ideas, and gain insight into the future of research, investment, and innovation.
Product Security Virtual Summit
Secure Code Warrior is proud to partner with Cycode for this year’s Product Security Virtual Summit on January 28th. We’re diving into the future of secure software in the AI era and showing how to turn security alerts into developer superpowers.
Phishapalooza
SCW is honored to attend the 18th annual Phishapalooza to support the American Cancer Society. We look forward to connecting with the local cybersecurity community for a day of ice fishing and fundraising in the Twin Cities. Join us as we partner with GuidePoint Security to help drive impactful donations for this great cause.
OWASP LASCON
We are proud to be a Gold Sponsor for OWASP LASCON 2026 in Austin, TX! Join us at the Norris Conference Center as we gather with over 400 web developers and security professionals to share cutting-edge ideas in application security.
New York Secure Code Showdown
SCW, OWASP and AWS invite you to improve your skills at the New York Secure Code Showdown on Thursday, February 19, 2026, from 11 am to 4 pm EST. This tournament challenges you to identify and fix vulnerabilities across your choice of major software languages. It’s a great way to master secure coding foundations while competing against your peers!
Gold Coast BSides
We are excited to host a secure coding tournament at BSides Goldie! Join us on the Gold Coast Australia for a hands-on competition where you can test your ability to identify and fix real-world vulnerabilities. Whether you are a seasoned developer or a security newcomer, this is a fantastic opportunity to collaborate, sharpen your skills, and help build a more secure local tech community.
BSides Frankfurt
We are excited to host a secure coding tournament at BSides Frankfurt! Join us on the Goethe-Universität Frankfurt campus for a hands-on competition where you can test your ability to identify and fix real-world vulnerabilities. Whether you are a seasoned developer or a security newcomer, this is a fantastic opportunity to collaborate, sharpen your skills, and help build a more secure local tech community.
RSA Conference
We’re heading San Francisco to the RSA Conference 2026 to discuss. We help organizations empower developers with the skills to write secure code from the start. Join us at booth #250 in the South Expo Hall to see how we can build a community of security-driven developers in your organization.
FS-ISAC FinCyber Today Canada
We are ready to discuss developer risk management at FS-ISAC FinCyber Today Canada. We help financial institutions mitigate application risk by empowering their developers with secure code learning. Join us at our booth in the Solutions Hall to see how we can strengthen your security posture.
Finding Your Developers
Curriculum and Onboarding Manager Katelynd Trinidad walks through different methods for locating code contributors at your organization to help ensure they receive secure code training.
.avif)
The Power of Brand in AppSec DevSec DevSecOps (What's in an Acronym!?)
In AppSec, lasting program impact demands more than just tech—it needs a strong brand. A powerful identity ensures your initiatives resonate and drive sustained engagement within your developer community.
The Power Of Brand in AppSec, DevSec, DevSecOps (what is an acronym?!)
In the world of AppSec, a strong brand is essential for lasting program impact. Jim Loughran, Principal Consultant at Secure Code Warrior, highlights how a powerful program identity can bridge the gap between security and engineering, fostering developer buy-in and sustained engagement. Join him to learn how to create and leverage a brand to ensure your secure coding initiatives truly shine, turning a great program into a great success story.
.avif)
Vibe Coding: Practical Guide to Updating Your AppSec Strategy for AI
Watch on-demand to learn how to empower AppSec managers to become AI enablers, rather than blockers, through a practical, training-first approach. We'll show you how to leverage Secure Code Warrior (SCW) to strategically update your AppSec strategy for the age of AI coding assistants.
The Future of Cyber Security Virtual Conference
The Future Of Cyber Security Conference series aims to help businesses to stay one step ahead of attackers through a number of insightful sessions not available at any other security conference. Can’t wait to virtually meet with you!
.avif)
SecTor
Come visit our booth #336 at SecTor 2025 in Toronto at the Metro Toronto Convention Centre! Us along with other security professionals will be sharing our latest research and techniques on underground threats and corporate defenses.
OWASP New Zealand Day
We are excited to attend OWASP New Zealand Day on the University of Auckland's campus! This conference is all about web and application security, with a mission to help Kiwi developers build more secure applications by focusing on robust architecture and development techniques. Be sure to visit our booth and connect with us to discuss our Developer Management Platform!
OWASP Global AppSec 2025 USA
Come visit us at our Expo Space at The Marriott Marquis in downtown Washington, DC! You'll have the chance to connect with us and over 800 security experts who share a passion for all things security.
OWASP BeNeLux Days
Visit our booth at OWASP BeNeLux Days happening in Mechelen, Belgium! This event brings you technical talks from experts in security, DevOps, and cloud, alongside hands-on training in top security areas. You'll also hear from industry leaders through keynote speeches, explore the latest security technology at vendor booths, and dive into activities like Capture The Flag and security tool training.
Melbourne AppSec & DevSecOps Summit
Get ready for an exciting day of insights and networking at the Melbourne AppSec & DevSecOps Summit! We can't wait to connect with security and development leaders like you, share ideas, and explore the latest trends in application security and DevSecOps. While you're there, let's schedule a brief meeting to discuss how our solutions can enhance your developer management strategies.
FS-ISAC Fall Summit
Visit us at FS-ISAC Fall Americas Summit for our Breakfast on Tuesday October 7, 8:00am - at the Catering Sponsor Table to explore how secure by design strategies and developer-focused risk management are transforming cybersecurity.
CISO Inspired Summit US
Join us at the CISO Inspired Summit New York 2025! This is your chance to connect with cybersecurity leaders, dive into proactive defense strategies, and build resilient security frameworks to confidently navigate today's evolving digital landscape.
CISO Inspired Summit UK
This November, join us at the CISO Inspired Summit UK 2025! Connect with fellow cybersecurity leaders to tackle rising threats, strengthen your digital defenses, and build robust strategies for business resilience in today's rapidly evolving cyber landscape.
BSides Bournemouth
BSides Bournemouth is a community-driven cybersecurity conference set to take place on August 16, at the Royal Bath Hotel in Bournemouth, UK. Come join us and other great sponsors like JP Morgan Chase for a day of insightful talks, networking and hands-on activities.
Black Hat USA
Join our executives at Black Hat USA at the Mandalay Bay in Las Vegas, NV! They are very excited to talk about AI/LLM secure code risk & ROI of skilled developers!
OWASP Global AppSec EU 2025
Visit us at Booth #G08 at OWASP Global AppSec EU to discover how secure by design principles and effective developer risk management are shaping the next generation of cybersecurity.
FS-ISAC EMEA Summit
Visit us at FS-ISAC EMEA Summit for our Breakfast on May 21, 8:00am - at the Catering Sponsor Table to explore how secure by design strategies and developer-focused risk management are transforming cybersecurity.
Cybersecurity Summit, Hamburg
We’re excited to connect with decision-makers, and innovators at the Cybersecurity Summit to discuss how proactive secure coding can accelerate software development while improving security posture.
OpenText Summit Madrid
Secure Code Warrior is proud to sponsor OpenText Summit Madrid 2025 on April 10! This exclusive event brings together leaders to explore how cloud, security, and AI are transforming information management. With tailored sessions across Explore, Transform, and Imagine, attendees will gain insights, best practices, and real-world success stories.
Australian Cyber Exchange
On April 3rd, our CEO, Pieter Danhieux, will speak at ACE25, the inaugural Australian Cyber Exchange, uniting government, private sector, and academia to strengthen Australia’s cyber capabilities. With a focus on innovation, sovereignty, and growth, ACE25 will feature panels, showcases, and pitch sessions tackling key cybersecurity challenges.
The Future Of Cyber Security London
Secure Code Warrior will be attending this full-day conference that brings together top cybersecurity experts to tackle the evolving threats in our digital world—from ransomware and botnets to crypto-hacking and cybercrime-as-a-service. Looking forward to insightful discussions and cutting-edge strategies!
OWASP SnowFROC
Join us at SnowFROC '25, Denver’s premier application security conference! This one-day event, drawing around 400 attendees, features hands-on training, top-notch food, and exceptional networking. Happening Friday, March 14, 2025, with expert-led presentations and workshops covering diverse cybersecurity topics.
BSides Limburg
Secure Code Warrior will be hosting a tournament at BSides Limburg this year on March 14! BSides is a community-driven cybersecurity event that goes beyond traditional conferences—fostering deep discussions, hands-on demos, and collaboration in an intimate setting. It’s where the next big ideas in security take shape!
2nd Annual 2025 OWASP Maine Secure Coding Tournament
OWASP Maine partnered with Secure Code Warrior will be hosting the 2nd annual OWASP Maine Secure Coding Tournament! This will be an in-person meetup where we welcome all software developers and appsec professionals from entry-level to principal. Bring your laptop and your secure coding wits and compete against your peers to be crowned the most secure coder in the state of Maine for 2025!
NDC Security 2025
Dive into cutting-edge topics, hands-on workshops, and networking with peers in the heart of Oslo. Don’t miss this chance to elevate your knowledge and shape the future of security. Visit us at spot H to learn how Secure Code Warriors empowers developers to improve productivity and code security!
RSAConference 2025
Visit us at Booth #2353 at RSAC 2025 to explore innovative solutions and join the conversation shaping the future of cybersecurity.
DevSecOps360 London
Join us Wednesday 22nd January 2025 at the IBM Innovation Studio London for an insightful event showcasing our latest integration vision for DevSecOps within the partner ecosystem.
.avif)
Black Hat Europe
Join us at Black Hat Europe at the ExCeL in London
.avif)
OWASP Benelux
SCW is proud to sponsor this year’s conference. Stop by our booth and learn about how SCW is helping companies master the OWASP Top 10 and reduce security risk for organizations all over Europe.
German OWASP Day 2024
Join Secure Code Warrior in Liepzig, Germany for great insights from OWASP, insights into the direction of software security in 2025 and fun networking.
DevSecOps 360 Toronto
Join SCW, IBM, Black Duck, Iruis Risk and Contrast to learn how your organization can accelerate development while minimizing vulnerabilities, delivering clear benefits to both business and security teams.
.avif)
Cloud & Cyber Security Expo, Paris
Secure Code Warrior is thrilled to be a silver sponsor for the premiere Cybersecurity event in France. Looking forward to seeing you there.
OpenText World 2024
Join Secure Code Warrior and OpenText to learn how companies around the world are leveraging SAST findings to create an agile learning experience for secure coding.
DevSecOps 360 London
Join SCW, IBM, BlackDuck and IruisRisk for an insightful event showcasing our latest integrations and learn how companies have realized real business and productivity gains for their organisations.
AppSecDay Stockholm
Join Secure Code Warrior, OpenText and Sonatype for a discussion on navigating Open Source, compliance with NIS2, AI & DevSecOps
.avif)
DevSecOps 360 Milan
Join us as we showcase how automation can drive faster, more secure development. A long with our partners IBM Cyber Security Services, Synopsys, and IriusRisk, we’ll dive into practical solutions to reduce vulnerabilities and keep your teams competitive.
%25252520(1).avif)
Charity Pro-Am Scramble
Join Secure Code Warrior and our partner Arctiq for the Charity Pro-Am Scramble at Golf Le Diable in Mont Tremblant. Together, we’ll tee off for a great cause, supporting KidSport Québec to help more kids get involved in team sports and build their future through the power of play.
.avif)
AppSec Day Utrecht
As application security evolves, organizations are increasingly integrating AI solutions for real-time threat detection and prevention. Join Secure Code Warrior and our partners Opentext and Sonatype!
SF 49er Red Zone Experience
Join SCW and Guidepoint for amazing football, great tailgate food and engaging conversations on software security and how to avoid being “tackled” by security vulnerabilities.
SCW Trust Agent/Q3 Product Roadmap Webinar
Join Patrick Collins, Secure Code Warrior’s Chief Product Officer, as he highlights and demos the brand-new SCW Trust Agent product offering and dives into the product roadmap for the coming months.
OWASP 2024 Global AppSec
The Global AppSec US Conference should be action-packed with new trends and topics discussed. Join us at our booth in San Francisco for a demo on our latest product offerings.
Transformation DevSecOps
DevSecOps enables the identification of security issues earlier in the development life cycle—surfaced directly to developers who can have the greatest impact.
Cybersecurity Summit
The leading experts from mid-sized to large corporations, will meet with innovative providers of digital solutions for Cybersecurity in business. Learn from experts on our stages and meet the leading providers in the trade show area.
Blackhat USA
Now in its 27th year, Black Hat USA returns to the Mandalay Bay Convention Center in Las Vegas with a 6-day program. The event will open with four days of specialized cybersecurity Trainings (August 3-8), with courses for all skill levels. The two-day main conference (August 7-8) will feature more than 100 selected Briefings, dozens of open-source tool demos in Arsenal, a robust Business Hall, networking and social events, and much more.
AppSec & DevSecOps Summit
Unravel, unite, and uplift your security strategies at the Melbourne AppSec and DevSecOps Summit 2024. Boost your security prowess and be at the forefront of the application and cloud security revolution.
Benchmark the Current State of your Security Program with SCW Trust Score
In today's rapidly evolving security landscape, understanding where your security program stands is paramount. Join, Secure Code Warrior Chief Technology Officer & Co-founder, Matias Madou, to discuss an industry leading innovation in our security program benchmarking: SCW Trust Score.
.avif)
Nordic IT Security
The most reputable cyber security summit in Scandinavia, Nordic IT Security, has been around for 17 years acting as a steering wheel for navigation through the Nordic’s “cybersecurity watch-out” scheme.
.avif)
Belgian Coffee Hour
For those RSAC attendees from Belgium, we are hosting a special "Last Coffee of the Day" on Tuesday, March 7 at 3:00 p.m. Join our resident Belgians, CEO Pieter Danhieux and CTO Matias Madou, and other executives from Secure Code Warrior as we wind down another successful day of RSAC with great coffee and delicious bites.
Taking charge of vulnerability alerts
Today’s threat landscape is increasingly unmanageable for many companies as they struggle with an application security approach built to react rather than take charge.
SCW Coffee Shop @ RSAC 2024
The SCW Coffee Shop is back for its 4th year! Join us for coffee and learn how to brew good security into your applications!
.avif)
RSAConference 2024
The art of possibility is here! Stop by Booth 5179 to see how you can reduce your vulnerabilities by 53%
Meet with SCW Leadership @ RSAC24
Our co-founders and executives will be at Bluestone Lane Union Square Coffee Shop from May 6th through May 7th sipping on one of San Francisco’s best coffee and taking meetings.
In developers and AI, we trust
SCW Coffee Shop @RSAC24 presents: Join Matias Madou, our cofounder & CTO, and industry experts as they talk about the challenges and strategies for measuring security skills within the development cohort
How to quantify the effectiveness of your secure coding program with SCW Trust Score
SCW Coffee Shop @RSAC24 presents: Join Patrick Collins, CTPO, and Junie Dinda, CMO, as they dive into an in-depth session of the new SCW Trust Score, an industry-first benchmark reshaping the landscape of secure coding programs.
Carolina Hurricanes with GuidePoint
Join us and our partners from GuidePoint at the hockey rink for an exciting game and some AppSec talks!
Bay Area Vendor Happy Hour
More information soon.
Women Leaders in Security
SCW Coffee Shop @RSAC24 presents: Join Fatemah Beydoun, cofounder & CCO, along a panel of women leaders in the industry as they discuss how to shift left to course correct the gender gap in security. Moderated by our own, Holly Whalen, VP Channel Partners.
From Compliance Checkboxes to Risk Management: Unleashing the True Potential of SAST
Explore innovative strategies for maximizing the effectiveness of your SAST tools and implement a developer-driven security program.
secIT - Hannover 2024
Schedule time to meet or stop by Booth 14 during secIT!
Hands on Application Security Workshop
In partnership with AWS, Contrast Security, and Artiq, we bring you a interactive hands-on AppSec workshop
Virtual Wine Tasting - Ohio
Join us, GuidePoint, and other partners for a Virtual Wine Tasting with Silver Oaks Winery.
DevSecOps 360 - Riyadh
In partnership with IBM, Synopsys, and IriusRisk, we’ll share our latest integration vision for DevSecOps within the partner ecosystem
DevSecOps 360 - Munich
In partnership with IBM, Synopsys, and IriusRisk, we’ll share our latest integration vision for DevSecOps within the partner ecosystem
DevSecOps 360 - Dubai
In partnership with IBM, Synopsys, and IriusRisk, we’ll share our latest integration vision for DevSecOps within the partner ecosystem
The evolving role of the AppSec developer
Changes, causes, and considerations for one of the most important roles on your company's security team.
Strengthen left: Develop your security muscle
How to help your developers build and release secure software faster.
Shifting left for secure by design
Reduce the risks and costs associated with application security by empowering developers to be the first line of defense of your organization.
Shift left security training and vulnerability detection for embedded systems
In this webinar, we consider the challenges organizations face when adopting a security-first approach to development especially within embedded software and how to harness best practices in learning technology and benefit from shifting left to optimize developer secure code training.
Secure Coding Virtual Summit
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Saltworks and Secure Code Warrior: Better together
Preaching the gospel of when developer learning and skill-sets go up, code vulnerabilities go down.
Join us at the DEVOPS Conference
Come join us at the DEVOPS Conference this March 8-9 for some insightful talks and a chance to participate at the secure coding tournament. Get your free tickets now!
Is security a developer's problem?
Technology has exploded. And it ALL needs to be secured. Yet, security teams don’t have the manpower to cover all bases in times of rapid technological growth and evolving cybersecurity threats.
Increase software release velocity with holistic, developer-driven security
AWS + Secure Code Warrior on the importance of increasing the quantity and quality of developer code output.
Increase software release velocity with holistic, developer-driven security
We know these times may not suit everyone, so if you'd like to listen to the webinar at a more sociable hour please register and we'll send you a recording. With the rise of security breaches stemming from exploitable software vulnerabilities, organizations must look to minimize th
How to close the avoidance and remediation gap in open source compliance.
Closing this gap is important to help engineering teams and their leaders better understand the impact of open source software on an organization’s ability to create and deliver risk-free solutions. Hear how our experts tackle software audits.
How to build an AppSec program with a strong foundation
The importance and key approaches to setting a baseline when it comes to strategy development for your AppSec program.
Coders Conquer Security OWASP Top 10 API Series - Missing Function Level Access Control
The missing function level access control vulnerability allows users to perform functions that should be restricted, or lets them access resources that should be protected.
National Cybersecurity Awareness Month: More than a phishing expedition
Every organization can utilize Cybersecurity Awareness Month to refresh their security awareness, and this year, were also launching a new, free app for the coding community!
Coders Conquer Security OWASP Top 10 API Series - Lack of Resources and Rate Limiting
This vulnerability occurs when too many requests come in at the same time, and the API does not have enough computing resources to handle those requests. The API can then become unavailable or unresponsive to new requests.
ClickShare Vulnerabilities May Have Been Patched, But They Mask a Much Bigger Problem
Shifting security fixes back towards the development process isn't easy, but is necessary in today's world where even seemingly simple devices like presentation tools are both surprisingly complex, and also networked into everything else.
Coders Conquer Security OWASP Top 10 API Series - Excessive Data Exposure
The actual mechanics behind this vulnerability are similar to others, but excessive data exposure, in this case, is defined as involving legally protected or highly sensitive data.
Coders Conquer Security OWASP Top 10 API Series - Broken Authentication
Authentication often acts as a gateway to both an application and potentially to the rest of a network, so they are tempting targets for attackers. If an authentication process is broken or vulnerable, there is a good chance that attackers will discover that weakness and exploit it.
Expert Interview: Infrastructure as Code with Oscar Quintas
We'd like to shine the spotlight on one of our experts, Oscar Quintas. He's part of our Product Content team, working as a Senior Security Researcher. He's also our resident sorcerer on all things Infrastructure as Code (IaC).
Coders Conquer Security OWASP Top 10 API Series - Broken Object Level Authorization
In general, object level authorization checks should be included for every function that accesses a data source using an input from the user, and failure to do so comes at a great risk.
Death by Doki: A new Docker vulnerability with serious bite (and what you can do about it)
Cyberattacks are only getting more frequent, and threats affecting Linux-based infrastructure are becoming more common, with the end goal being an opportunity to crack open a loot chest of sensitive data stored in the cloud.
Is your organization really DevSec-ready? Put it to the test.
With your organization in mind, think about these questions in the context of your role. How would it fare when put to the DevSec test?
Strike first, strike hard: Why curated secure coding courses extend no mercy to cyber threats
A curated course containing the exact modules in which your developers would need to show proficiency will have a potent impact, and allow them to hit the ground running when it comes to security best practices in their day-to-day work.
Want developers to code with security awareness? Bring the training to them.
We already know there is too much going on in a workday, so what incentive do developers have to schlep off to a classroom, or context-switch to go through five steps to access static theory-based training?
COVID-19 contact tracing: What's the secure coding situation?
The idea behind contact tracing apps is sound. This technology, when functioning well, would ensure hotspots are quickly revealed and comprehensive testing can occur - both essential components of fighting the spread of a contagious virus.
Stop disrupting my workflow! How you can get the right security training at the right time
We started to think about what we could do to reduce the barrier to getting training when you need it, and how micro-learning could be implemented into your workflow in a more seamless way.
International Women in Engineering Day: Meet Our Stars
June 23rd is a special entry in the geek calendar, marking International Women in Engineering Day. This is our chance to cast light on the contribution of women to software development.
Coders Conquer Security Infrastructure as Code Series - Business Logic
This vulnerability can occur when coders fail to properly implement business logic rules, which could leave their applications vulnerable to different kinds of attacks should a malicious user choose to exploit them.
Rust is the most-loved programming language for the fifth time. Is it our new security savior?
Rust incorporates known and functional elements from commonly used languages, working to a different philosophy that disposes of complexity, while introducing performance and safety.
Coders Conquer Security Infrastructure as Code Series - Using Components From Untrusted Sources
The vulnerability-inducing behavior that we are going to focus on here is using code from untrusted sources, a seemingly benign practice that is causing big problems.
Cybercriminals Are Attacking Healthcare (But We Can Fight Back)
Healthcare could be the next 'great' cybersecurity battleground, with criminals attacking the very machines that diagnose medical problems, provide treatments and sustain life.
Coders Conquer Security Infrastructure as Code Series: Security Misconfiguration - Improper Permissions
Security misconfigurations, especially those of the improper permissions variety, most often happen whenever a developer creates a new user or grants permission for an application as a tool in order to accomplish a task.
Coders Conquer Security Infrastructure as Code Series: Insufficient Transport Layer Protection
At times, applications will also share data with other programs as part of an overall workload. Unless the transport layer is protected, it makes it vulnerable to both outside snooping and unauthorized internal viewing.
Coders Conquer Security Infrastructure as Code Series: Insecure Cryptography
These days, having critical data like passwords, personal information and financial records hashed while at rest is a cornerstone of any cybersecurity defense.
COBOL Application Development Security | Secure Code Warrior
Legacy COBOL, although an older computer language, is still effective to this day. Learn more about COBOL secure application development from Secure Code Warrior.
Coders Conquer Security Infrastructure as Code Series: Plaintext Storage of Passwords
The key to most computer security these days involves passwords. Even if other security methods are employed, like two-factor authentication or biometrics, most organizations still employ password-based security as one element of their protection.
Webinar: Are you ready to put the "Sec" in DevOps?
We must get to a stage where security is seen as a shared responsibility across the entire organization, and throughout the SDLC. This is certainly possible when you commit to a fully-fledged, highly supportive DevSecOps environment.
Coders Conquer Security Infrastructure as Code Series: Missing Function Level Access Control
Without infrastructure-level access control in perfect order, it opens up an entire enterprise to attackers, who can use that vulnerability as their gateway for either unauthorized snooping or a full attack.
Coders Conquer Security Infrastructure as Code Series: Disabled Security Features
Attackers will always attempt to find easily exploitable vulnerabilities first and may even use a script to run through common weaknesses. It's not unlike a thief checking all the cars on a street to see if any doors are unlocked, which is a lot easier than smashing a window.
Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 2 - CISOs and developer awareness
This is part 2 of a mini-series on PCI-DSS compliance within an organization. In this final chapter, we detail how CTOs and CISOs can lead from the top in reducing cyber risk and making the process seamless, successful... and maybe a little fun for developers.
Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 1 - AppSec
This is part 1 of a two-part series on successful PCI-DSS compliance within an organization. In this chapter, we detail how AppSec specialists can work closely with development managers to empower developers, strengthen the SSDLC and get specific outcomes from general legislation.
The future of cybersecurity: What WON'T be happening in the year to come
In our industry, many security experts have started predicting the hot-button issues for the year, but with more than five billion sensitive data records stolen in 2019, we figured it would be more accurate to predict what won't be happening in cybersecurity in the foreseeable future.
Shifting left is not enough: Why starting left is your key to software security excellence
Much of the initiative around "shifting left", that is, introducing security much earlier in the development process, simply doesnt move the needle far enough.
DevSecOps in DACH: Key findings from secure coding pilot programs
With the advent of GDPR, as well as a revised strategy following a multi-stage attack that exposed the sensitive data of many public figures - as well as servers in the German federal government - it is clear that cybersecurity awareness and action are front-of-mind for leaders in the DACH region.
How to Become a Kick-Ass DevSecOps Engineer
The world is starting to move on past Waterfall, Agile, and now DevOps, so what is the next solution? And as a developer, what is your role in keeping pace with these changes in approach?
The most dangerous software errors of 2019: More evidence of history repeating
Towards the end of last year, the amazing community at MITRE published their list of the CWE Top 25 Most Dangerous Software Errors that affected the world in 2019. And most of it was no surprise.
The growth spurt: Happy 5th birthday, Secure Code Warrior
I could have started this article with all the facts and figures indicating a thriving, hyper-growth startup; they are undeniably impressive and our ongoing company trajectory is strong. However, for me, these numbers don't reflect what I am most proud of in 2019.
Why DevOps Implementation is Often Unsuccessful (and How You Can Fix It)
Few companies are truly successful in their DevOps implementation. However, the right support, nurturing and understanding across the business can transform your process.
The new NIST guidelines: Why customized training is essential to create secure software
The National Institute of Standards & Technology (NIST) released an updated white paper, detailing several action plans for reducing software vulnerabilities and cyber risk.
OWASP AppSec Day 2019: Nurturing Secure Developers
These developer-focused events are among my favorite on the calendar; they provide a humbling reminder of the community that works tirelessly to educate and empower software engineers and specialists to champion security in their work.
Static Vs. Dynamic Cybersecurity Training: Impulsive Compliance, Future Problems
While regulatory initiatives will undoubtedly improve and grow over time, if organizations are already hitting the panic button and leaping into training now, they might just find themselves ill-equipped for the future.
It takes a village: How community spirit creates more secure developers
There are developers of all types, from all walks of life, and there has always been a sense of community in everything we do.
In-depth security training is raising questions in education
While secure coding needs to become a mandatory component of software engineering at the tertiary level, some universities are leading the charge in providing top-notch training and prioritizing security as part of the development process from the very beginning.p
Women in Security: Spotlight on Fatemah Beydoun
Our VP of Customer Success, Fatemah Beydoun, recently presented her talk, "Mentoring for the future: How we can all do better in fostering female cybersecurity talent" to a very receptive audience. She has been an integral part of driving positive change within the cybersecurity industry.
Coders Conquer Security: Share & Learn Series - Insecure Deserialization
Insecure deserialization can happen whenever an application treats data being deserialized as trusted. If a user is able to modify the newly reconstructed data, they can perform all kinds of malicious activities such as code injections, denial of service attacks or elevating their privileges.
Contextual, Hands-On Learning: The Supercharged Way to Train Your Brain for Security
It truly boggles the mind that many places still rely on classrooms, dry textbooks and mind-numbing video training to get their best and brightest on-board with new initiatives, especially when there's a far better, more engaging and more valuable way to learn: contextual training.
Empathy, Gratitude, and Staying Humble: The Foundation of Our Culture
The software security industry isn't exactly known for its warm and fuzzy feelings, whimsical observations and life commentary, but, perhaps as I get older, I find myself reflecting on the impact we can all have in the world.
Coders Conquer Security: Share & Learn Series - Sensitive Data Exposure
Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state.
Why we need to support, not punish, curious security minds
Teen security researcher, Bill Demirkapi, exposing major vulnerabilities in software used by his school certainly brought back some memories. I remember being the curious kid, lifting the hood on software to take a peek underneath and see how it all worked... and if I could break it.
The Great Global Patch: VxWorks Flaws Set to Compromise Millions of Devices
While VxWorks isn't a household name to the average consumer, this software product benefits many people just like you and me, each and every day. And now, we are faced with the possibility that hundreds of millions of VxWorks-powered devices are now compromised.
Coders Conquer Security: Share & Learn Series - XXE Injection
The XML External Entity Injection attack, sometimes simply abbreviated as XXE injection, is relatively new, but it's extremely popular among hacking communities right now, and growing even more so as it racks up successes.
Coders Conquer Security: Share & Learn Series - CRLF Injection
If an attacker can insert a CR or LF code into an existing application, they can sometimes change its behavior. The effects are less easy to predict compared with most attacks, but can be no less dangerous to the target organization.
How creative CISOs and CIOs can innovate and transform their security program
Creative, inspiring CISOs and CIOs have the power to innovate and shape our digital world, but they can also be instrumental in transforming an organizations security culture.
Coders Conquer Security: Share & Learn Series - Remote File Inclusion
In many ways, the remote file inclusion vulnerability is much more dangerous, and also easier to exploit, than its local file counterpart. As such, it should be found and remedied as soon as possible.
The Revamped PCI Security Standards Council Guidelines: Do They Shift Far Enough Left?
This year, the PCI Security Standards Council released an all-new set of software security guidelines as part of their PCI Software Security Framework. This update aims to bring software security best practice in-line with modern software development.
Coders Conquer Security: Share & Learn Series - Local File Inclusion and Path Traversal
Unlike many vulnerabilities, exploiting local file inclusion and path traversal processes for nefarious purposes requires a sufficiently skilled attacker, a fair amount of time, and perhaps a bit of luck.
Coders Conquer Security: Share & Learn Series - Insufficient Transport Layer Protection
Even if you have completely secured an application server and the backend systems it uses, communications might still be vulnerable to snooping if you have insufficient transport layer protection.
Coders Conquer Security: Share & Learn Series - XML Injections
XML injection attacks are nasty little exploits invented by hackers to help them compromise systems hosting XML databases. This includes the kinds of things that come to mind when one thinks about traditional databases - detailed stores of information about anything from medicines to movies.
Huawei security UK problems demonstrate the need for secure coding
A recent report from the UK's Huawei Cyber Security Evaluation Centre identified major security issues within Huawei's software engineering processes. But it's a problem that can be fixed.
Best of the Brunch: Our Leaders in AppSec Share Their Wisdom
Addressing hot-button issues like how to make the most of an organization's AppSec budget, as well as several curly questions from the audience, the Leaders in AppSec panel delivered some real morning magic that will help security specialists build out viable programs within their organizations.
Coders Conquer Security: Share & Learn Series - Insufficient Logging and Monitoring
Insufficient logging and monitoring is one of the most dangerous conditions that can exist within an application's defensive structure. If this vulnerability or condition exists, then almost any advanced attack made against it will eventually be successful.
Coders Conquer Security: Share & Learn Series - Unvalidated Redirects and Forwards
Coding a website or application with the ability to process unvalidated redirects and forwards can be extremely dangerous for both your users and your organization.
Secure Code Warrior and Bugcrowd: A Match Made in Security Geek Heaven
It's official: we are joining forces with Bugcrowd in the fight to educate, empower and enlighten developers on secure coding.
Coders Conquer Security: Share & Learn Series - Code Injection
Code injection attacks are among the most common, and also the most dangerous, that many websites and applications will encounter. They run the gamut both in terms of sophistication and in the danger that they pose, but nearly any site or app that accepts user input could be vulnerable.
GitHub Users Held to Ransom with Plaintext Pain
The recent attack on GitHub repositories highlights a well-known issue within the security industry: most developers are simply not sufficiently security-aware, and valuable data could be at risk at any time.
Coders Conquer Security: Share & Learn Series - Broken Access Control
When you build a business application, whether for internal use or external use by your customers, you probably don't let every user perform every single function. If you do, you may be vulnerable to broken access control.
For Cybersecurity Best Practice, Look to the Finance Industry
With cyberattacks on the rise - affecting every type of organisation in every vertical - the threat of expensive, embarrassing and bottom-line-affecting data breaches is very real. The problem is not getting smaller, it's growing like a tumour.
Coders Conquer Security: Share & Learn Series - Information Exposure
When your web app reveals too much information, it can make it easier for attackers to break into it. jIn this post, we'll cover what information exposure is, why it's dangerous, and how to prevent it.
Coders Conquer Security: Share & Learn Series - Using Components with Known Vulnerabilities
Since all applications use components, most of which you haven't written, vulnerabilities within the components you use can become liabilities. Let's discuss what using components with known vulnerabilities means, how dangerous it is, and how to resolve it.
Security' is Not a Dirty Word: How a Positive Approach Will Transform Your Security Program
Having been on both sides of the fence, I know all too well the tension that can arise between the development team and AppSec specialists when it comes to upholding security best practice. However, there is a better approach.
Coders Conquer Security: Share & Learn Series - Authentication
Were going to cover one of the most common problems faced by organizations that either run websites, or which allow employees to remotely access computer resources - which is pretty much everyone. And yes, you probably guessed that we are going to be talking about authentication.
Coders Conquer Security: Share & Learn Series - Insufficient Anti-Automation
If an application has insufficient anti-automation checks in place, attackers can simply keep guessing at passwords until they find a match. Heres how to stop them.
Coders Conquer Security: Share & Learn Series - Business Logic Problems
Although coding issues may be part of the problem, business logic errors are most frequently a result of design flaws or incorrect logical assumptions when an app is first created.
DevSecOps: The Old Security Bugs Still Performing New Tricks
In cybersecurity, we are often like hunters. Our eyes are firmly glued to the horizon, scanning for the next breakout vulnerability. However, this forward-looking focus can have the surprising effect of dampening our overall security awareness.
Coders Conquer Security: Share & Learn Series - Email Header Injection
It's common for websites and applications to allow users to send feedback and various other bits of information through an application using email. And most people don't even think about it in terms of a potential security risk.
Coders Conquer Security: Share & Learn Series: Insecure Direct Object Reference
A direct object reference is when a specific record (the 'object'), is referenced within an application. It usually takes the form of a unique identifier and may appear in a URL.
Software Security is in the Wild West (and it's going to get us killed)
Software security is always front-of-mind for me, as is the very real danger posed by our increasingly digital, personal information-sharing lifestyles. After all, we are in a largely unregulated, unsupervised and blissfully ignored territory. We're in the Wild West.
Insecure Cryptographic Storage & Security | Secure Code Warrior
In this digital society, developers are responsible for keeping info & businesses safe from insecure cryptographic storage. Learn from Secure Code Warrior.
Coders Conquer Security: Share & Learn Series - XQuery Injection
A huge majority of websites use XML databases to perform critical functions such as holding user login credentials, customer information, personal identity information and confidential or sensitive data, leaving XQuery attacks with a rather large attack footprint.
What is Security Misconfiguration? | Secure Code Warrior
What is security misconfiguration? Find the most popular security misconfigurations & how to prevent vulnerabilities. Learn from Secure Code Warrior.
Happy 4th Birthday Secure Code Warrior, You Cheeky Little Toddler
The older my daughter and the company gets, the more I realise there are so many similarities between a startup journey and the ���first-time� parent journey. I am in my fourth year for both now.pi
Coders Conquer Security: Share & Learn Series - Clickjacking
Let's take a look now at how clickjacking works, why it's dangerous, and what developers like you can do to prevent it.
Coders Conquer Security: Share & Learn Series - OS Command Injection
OS command injection attacks can be performed by entry-level and less skilled hackers, which makes them one of the most common weaknesses that security teams experience. Thankfully, there are quite a few very effective ways to prevent them from being successful.
Coders Conquer Security: Share & Learn Series - Session Management Weaknesses
Sessions are key to a good user experience when using the web. However, managing sessions incorrectly can lead to security holes that attackers can exploit.
Developer Tournaments: AppSec's Secret Weapon to Improve Security Culture and Engagement
Don't you think it's time we gave security a makeover? It's as simple as changing the conversation and making everything a little more positive (not to mention fun!) for both sides, especially the development team.
Coders Conquer Security: Share & Learn Series - Padding Oracle
While Padding Oracle sounds like a really bad name for an alternative rock band, it's actually a vulnerability that can be used by attackers to decrypt information without knowing the encryption key.
Coders Conquer Security: Share & Learn Series - LDAP Injections
Problems can occur when malicious users can manipulate an LDAP query. Doing this can trick the receiving server into executing invalid queries that would normally not be allowed, or even granting high level or administrator access to invalid or low-security users without a password.
The Change We Need In The AppSec Badlands: My 2019 Predictions
The real battle we face isn't against script kiddies, or dangerous organized cybercrime syndicates... its in getting more people to care that data breaches are happening at all.
Coders Conquer Security: Share & Learn Series - Unrestricted File Uploads
In cybersecurity, attackers can be quick to exploit any application or program that has been allowed to support unrestricted file uploads. And the results can be devastating.
Coders Conquer Security: Share & Learn Series - NoSQL Injection
NoSQL databases are becoming increasingly popular. It's hard to deny their speed and ease of dealing with unstructured data, but as use becomes widespread, more vulnerabilities inevitably bubble to the surface.
Coders Conquer Security: Share & Learn Series - Cross-Site Request Forgery
CSRF attacks are fairly complex and rely on multiple layers to be successful. In other words, lots of things have to break in favor of the attacker for it to work. Despite this, they are an extremely popular, lucrative attack vector.
Coders Conquer Security: Share & Learn - SQL Injection
Attackers are using SQL injection - one of the oldest (since 1998!) and peskiest data vulnerabilities out there - to steal and change the sensitive information available in millions of databases all over the world.
Confusing Privacy with Security: The Fatal Mistake
When online privacy attempts to exist without security, chaos reigns. Just ask Ross Ulbricht.
Why financial institutions are leading the charge to upskill their developers in secure coding
Observing: the rising innovation and leadership of financial institutions in upskilling their developers on secure coding.
Why SQL Injections Are The Cockroaches of the AppSec World (and how CISOs can eradicate them once and for all)
There's a well-known theory that cockroaches can survive basically anything - even a nuclear explosion.
A Brighter Future For DevSecOps? It's Closer Than You Think
There are many solutions that find vulnerabilities in code, but security needs to place more emphasis on teaching developers to follow security guidelines that will prevent them from making these mistakes in the first place.
Why gamification is the key to leveling up your software security
We must work to change the conversation, to make security an integral part of every developer's working life. And I think one of the best ways to do this is by empowering and engaging with developers on security through, for example, gamification.
More Breaches, More Problems: The Cost of Trust in Third-Party Apps
We must stop thinking of security as an irritating obstacle on the path of company innovation.
Celebrating International Women in Engineering Day: Meet Lucy
I thought I would end up in an infrastructure or service support sort of career, and then got a development opportunity in a graduate program. Turns out thats exactly where I needed to be.
Some CISOs are turning the security skills shortage into an opportunity
Empowering developers to write secure code from the start is an opportunity for CISOs to seize some proactive control from the security predicament, and where there is the chance for fast, easy and measurable improvements for both security and development teams.
"Explosive" cyber attacks in Oil and Gas are life threatening
The only thing that prevented an explosion was a mistake in the attackers computer code, the investigators said.
Secure Code Warrior - Happy 3rd Birthday to us
Our vision is to empower developers to be the first line of defence in their organisation by making security highly visible and providing them with the skills and tools to write secure code from the beginning.
Kamer van Koophandel: Developer-Driven Security at Scale
Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.
Going for Gold: Soaring Secure Code Standards at Paysafe
See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.
Devlympics 2023: In Review
Explore the Devlympics 2023 results in this report. Dive into developer engagement, tech stack and languages trends in each industry that participated, and key vulnerabilities and CWEs covered in the annual global event hosted by Secure Code Warrior.
One Culture of Security: How Sage Built Their Champions Program
Discover how Sage enhanced security with a flexible, relationship-focused approach, creating 200+ security champions and achieving measurable risk reduction.
The path to security champions: How Workday utilized agile learning to upskill developers
Discover how Workday transformed developer training with agile learning through Secure Code Warrior. By empowering developer with hands-on, language-specific education, Workday reduced vulnerabilities early in the SDLC. See their impressive results and key takeaways to build a secure code culture.
How Thales implemented developer-driven security
In this case study, learn how Thales has developed people, process, and technology approaches for an agile secure code learning program in order to engage developers to become active security champions.
How Colgate-Palmolive boosted developer security skills and created a secure coding culture
Discover how retail giant Colgate-Palmolive reshaped its application security during its digital transformation journey. Facing challenges in secure coding, they innovated their approach by integrating bite-sized, in-context learning into the developer workflow.
How a ‘Game of Codes’ is leading IAG Group to a more secure coding future
IAG Group is the name behind many of the leading insurancecompanies in the Asia-Pacific region, underwriting policies formillions of customers to the tune of approximately AUD $11.4 Billionin premiums per annum.
Creating a revolutionary security certification experience
Learn how they created an in-house technology education initiative, aimed at supporting thousands of employees to learn practical, cutting-edge skills in a number of disciplines, including machine learning and cybersecurity.
ASRG's push for automotive software security
Explore this comprehensive case study to learn more about how they utilized Secure Code Warrior's tournaments to engage developers, increase awareness of key vulnerabilities affecting automotive software, and gain metrics across multiple languages and frameworks.
SecurityBrief Australia: How AI and software development will continue to shape the developer community in 2025
Organisations are facing tough decisions on AI usage to support long-term productivity, sustainability, and security ROI.It's become clear to us over the last few years that AI will never fully replace the role of the developer. From AI + developer partnerships to the increasing pressures (and confusion) around Secure-by-Design expectations, here's what we can expect over the next year.
ITWire: Why Software Developers Need a Security ‘Rewards Program’
Frequent flyer and other points-based programs reward people who remain loyal to particular brands or organisations. The programs issue points to participants who can use them for discounts or purchases in the future. Some airline programs also reward loyal customers with perks such as priority boarding and lounge access. It’s becoming clear that the software development industry could use something similar, especially when it comes to ensuring a ‘security first’ mindset among developers.
In AI Today: Achieving effective security in an AI-assisted software development world
It’s highly likely that AI-assisted development will become even more of a norm in the near future. Organisations will, therefore, have to establish policies and best practices to effectively manage it, just as they’ve done with cloud deployments, Bring Your Own Device (BYOD), and other tech-in-the-workplace trends.
DevOps Digest: 2025 DevSecOps Predictions
As part of DEVOPSdigest's annual list of DevOps predictions, DevSecOps experts — from analysts and consultants to the top vendors — offer thoughtful, insightful, and often controversial predictions on how DevSecOps and related risks and tools will evolve in 2025.
SecurityWeek: How to Implement Impactful Security Benchmarks for Software Development Teams
Benchmarking is all about taking back control – you’re measuring to gain complete awareness of your development teams’ security skills and practices.
KBi Media: Secure-By-Design Is A Significant Exercise, But The Rewards Are Significant, Too
Concerted multilateral efforts are underway to influence and change developer behaviour when it comes to secure software creation.
The Peter Carr Blog: Gary Kasparov and the New Code Generation
Man vs. Machine in the Era of AI and Secure Coding.
VMBlog: OpenText Partners with Secure Code Warrior to Deliver Comprehensive Application Security and Customized Developer Risk Management
OpenText announced a strategic partnership with Secure Code Warrior to integrate its dynamic learning platform into the OpenText Fortify application security product suite. This partnership will help developers improve their secure coding skills through real-time training to reduce risks, quickly identify and resolve vulnerabilities, and ultimately build greater trust with customers.
SecurityInfoWatch: OpenText partners with Secure Code Warrior to deliver comprehensive app security
The new agreement empowers development teams with continuous upskilling to turn security into a strategic advantage, reduce risks, and elevate customer trust.
SecurityBrief Australia: OpenText partners with Secure Code Warrior to boost security
OpenText and Secure Code Warrior have announced a strategic partnership to integrate Secure Code Warrior's dynamic learning platform into the OpenText Fortify application security product suite.
ITWire: OpenText Partners with Secure Code Warrior to Deliver Comprehensive Application Security and Customised Developer Risk Management
The new agreement empowers development teams with continuous upskilling to turn security into a strategic advantage, reduce risks, and elevate customer trust.
Cyber Magazine: OpenText Partnership Targets Software Supply Chain Fears
OpenText partners with Secure Code Warrior to address rise in supply chain attacks through enhanced security training for coders and adoption of DevSecOps.
OpenText Partners with Secure Code Warrior to Deliver Comprehensive Application Security and Customized Developer Risk Management
The new agreement empowers development teams with continuous upskilling to turn security into a strategic advantage, reduce risks, and elevate customer trust.
[PODCAST] Information Week: Have We Gone Too Far With AI in Software Development?
Has the promise of improved efficiency through AI been realized in software development? Is there still a place for citizen developers with AI in the development cycle?
DevOps Digest: How Organizations Can Create Successful Secure-by-Design Programs
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving the best practices for implementation based on data-driven findings.
Cybersecurity Insiders: Building a Security “Loyalty Program” for Software Developers is a Winning Formula in 2025
The software development industry could use something like a “frequent flyer status” system – especially when it comes to fostering a “security-first” mindset among developers. Without any incentive program, it’s nearly impossible for organisations and their developer teams to evaluate their security proficiency and compare their competencies alongside peers.
Authority Magazine: Matias Madou Of Secure Code Warrior On Embedding Security in Product Design and Development
CISOs need to lead a transition from the uncertainty of shadow AI to a more known, controlled and well-managed ‘Bring Your Own AI’ (BYOAI) environment. This will require full executive buy-in, careful implementation of AI into the existing tech stack and adoption of secure-by-design principles as part of a security-first culture that doesn’t slow down a product rollout.
Dynamic Business: New Cyber rules: Are experts pumped or pessimistic?
On November 25, 2024, the Australian Parliament passed significant reforms to bolster the nation’s cyber security posture, forming part of a strategic effort to position Australia as a global leader in cyber security by 2030.
Cyber Daily: Industry responds to passing of Australia’s Cyber Security Act
Opinions are mixed on the nation’s new cyber security legislation, which has been deployed as part of the 2023–2030 Australian Cyber Security Strategy.
Forbes: Strategic Secure-By-Design Initiatives: Best Practices For Meaningful Outcomes
It is possible to realize a meaningful secure-by-design initiative and lead the charge in transforming the current status quo around security culture. Let’s discuss the challenges ahead and techniques to overcome them in enterprise security and development teams.
KBI Media: Overcoming Common Security Vulnerabilities In The Banking Sector
While the physical security measures in place within many banks today are impressive – large vaults, bullet-proof glass, silent holdup alarms – it can be a very different story when it comes to cybersecurity.
DevOps Digest: Exploring the Power of AI in Software Development
DEVOPSdigest invited experts across the industry — consultants, analysts and vendors — to comment on how AI can support the software development life cycle (SDLC). Part 3 of this series covers advantages gained by leveraging AI tools in software development.
SecurityWeek: How to Improve the Security of AI-Assisted Software Development
CISOs need an AI visibility and KPI plan that supports a “just right” balance to enable optimal security and productivity outcomes.
DevOps.com: 6 Essential Components of a Successful Security ‘Rewards Program’ for Software Developers
Whether teams opt for on-the-job collaborative training opportunities or interactive, agile learning sessions, they would substantially benefit from standardized developer benchmarking for success. Such benchmarking could lead to a ‘trust score’ that, much like rewards programs, would provide incentives to developers for their security achievements and offer clear pathways for improvement.
SecurityInfoWatch: Critical infrastructure industries making progress on Secure-by-Design developer readiness
Secure Code Warrior's analysis highlights the critical need for developer upskilling to properly measure Secure-by-Design progress.
ITWire: Secure Code Warrior Research: Critical Infrastructure Industries Making Progress on Secure-by-Design Developer Readiness
New analysis collaborated on with Paladin Global Institute highlights the critical need for developer upskilling to properly measure Secure-by-Design progress
Secure Code Warrior Research: Critical Infrastructure Industries Making Progress on Secure-by-Design Developer Readiness
New analysis collaborated on with Paladin Global Institute highlights the critical need for developer upskilling to properly measure Secure-by-Design progress.
Politico: Cyber is getting schooled
Less than 4 percent of developers globally are involved in Secure-by-Design upskilling initiatives, according to new research out this morning by Secure Code Warrior.
NextGov: Few software developers employ secure by design training, research finds
The analysis, conducted by Secure Code Warrior, is supported by former White House cybersecurity officials Kemba Walden and Chris Inglis.
Cyberscoop: Organizations can substantially lower vulnerabilities with secure-by-design practices, report finds
Ex-National Cyber Director Inglis says “quantitative data” in Secure Code Warrior’s report shows the importance of the cybersecurity practice.
Pulse 2.0: Secure Code Warrior: Interview With CEO Pieter Danhieux About The Coding Platform
Secure Code Warrior is a secure coding platform that sets the standards that keep our digital world safe. Pulse 2.0 interviewed Secure Code Warrior CEO Pieter Danhieux to learn more about the company.
Techopedia: Shadow AI Poses Risks in Everything From Healthcare to DevSecOps
Shadow AI — the use of unapproved AI apps by workers — has been a problem since generative AI burst onto the scene. The temptation to get ChatGPT to do all of your work might override any thoughts about sending confidential or private data over to a third party.
DZone: Misconfiguration Madness: Thwarting Common Vulnerabilities in the Financial Sector
Financial services are among the most attacked sectors of any industry, making it critical that developers operate at the highest level to produce secure code.
KBi Media: How CISOs Are Getting Developers to Put Security First
For years, many CISOs have struggled to educate their developers about the importance of putting security first. They’ve also been working to control an increasingly complex threat landscape and spiralling attack surface, all while navigating a security skills shortage. They need a new approach that helps to uplift the security culture organisation-wide while ensuring AppSec professionals and developers alike have what they need to drive down vulnerabilities and risks.
ITWire: The Challenge of Maintaining Code Security in the Era of AI
Of all the tasks that large language models (LLMs) and Generative AI can undertake, one that’s captured significant attention is generating computer code. Developers are increasingly using GenAI tools to streamline workflows and improve productivity.
In AI Today: How software development will evolve in the AI era
Security-aware developers who demonstrate expertise in safely leveraging Artificial Intelligence (AI) tools will eventually be able to take on new roles as AI guardians or mentors, working with AI to ensure the passage of safe code into their codebase.
Solutions Review: How CISOs Can Prepare the Enterprise for AI Coding Assistants
Secure Code Warrior’s Pieter Danhieux offers insights on how CISOs can prepare for enterprise AI coding assistants. This article originally appeared on Solutions Review’s Insight Jam, an enterprise IT community enabling the human conversation on AI.
KBI Media: Why ‘Secure by Design’ Is Critical In Today’s Interconnected World
The challenges faced by IT security teams are increasing by the day. Wider attack surfaces and the emergence of more sophisticated techniques have resulted in approaches that may have worked in the past no longer being sufficient to ensure effective protection.
IT Brief Australia: Titans of Tech - Pieter Danhieux of Secure Code Warrior
Pieter Danhieux, the Co-Founder and CEO of Secure Code Warrior, is making his mark as a visionary leader in the realm of cybersecurity. With a deep-rooted passion for secure coding and a career spanning over two decades in the cybersecurity industry, Pieter has played a pivotal role in reshaping the way developers approach software security, transforming Secure Code Warrior into a global leader in its field.
SecurityWeek: How Exceptional CISOs Are Igniting the Security Fire in Their Development Team
For years, many CISOs have struggled to influence their development cohort on the importance of putting security first. Matias Madou weighs in.
Dark Reading: The Changing Expectations for Developers in an AI-Coding Future
AI's proficiency at creating software code won't put developers out of a job, but the job will change to one focused on security, collaboration, and "mentoring" AI models.
Betanews: How are CISOs coping with developer gatekeeping? [Q&A]
CISOs are under the microscope to prove they can reduce vulnerabilities in the software development life cycle -- particularly, that they can do so from the start of code creation. As such, CISOs are searching for the most effective way to ensure the security awareness of their developers before they take on the responsibility of writing and introducing code.
SecurityBrief Australia: Cybersecurity experts praise new Australian Government mandate
The Federal Government’s recent mandate, PSPF Direction 002-2024, aims to significantly bolster cybersecurity measures within Australian Government entities by requiring them to identify and actively manage risks tied to vulnerable technologies. The announcement has sparked reactions from key figures in the cybersecurity industry, who have shared their insights on its implications and potential impacts.
Forbes: Git Defenders: How Security Leaders Can Make 'Secure By Design' Stick
CISA’s Secure by Design movement has gained significant momentum, with governments around the world—like Australia, New Zealand, Canada, Singapore, Japan, Germany and the U.K.—contributing to its creation or following it directly as part of their own publicized cybersecurity strategies.
SD Times: Trust Agent can show if developers know their stuff
Developers, it appears, will not be replaced by artificial intelligence – at least not yet, anyway. What they will need to do is learn or improve their skills in providing templates for AI, become masters of fixing problems in AI-generated code, and actually learn the best uses for AI in software development.
LinkedIn News Australia: Cyber threats remain high, but demand for cybersecurity workers in Australia has dipped
Cyber threats remain high, but demand for cybersecurity workers in Australia has dipped.
ITWire: Secure Code Warrior Introduces Industry-first Solution that Measures Developers’ Security Competencies for Code Commits
New SCW Trust Agent facilitates a Secure-by-Design approach for enterprises; equips security leaders with unparalleled visibility into their organisations’ software security posture.
Secure Code Warrior Introduces Industry-First Solution that Measures Developers’ Security Competencies for Code Commits
New SCW Trust Agent facilitates a Secure-by-Design approach for enterprises; equips security leaders with unparalleled visibility into their organizations’ software security posture.
Help Net Security: SCW Trust Agent measures developers’ security competencies for code commits
Secure Code Warrior introduced SCW Trust Agent – a solution that assesses the specific security competencies of developers for every code commit.
DevOps.com: Secure Code Warrior Unveils Agent to Manage Commit Permissions
The SCW Trust Agent can be deployed on any Git-based code repository, including Github, Gitlab and Atlassian Bitbucket to ensure that only developers that have only developers that have attained a specific security rating are allowed to make a commit. Those ratings are based on more than 20 million data points collected from 250,000 developers around the world.
Computer Weekly: Innovations to power secure-by-design development
Secure Code Warrior unveils technology designed to help CISOs and AppSec teams ensure their projects remain safe and free of coding errors and vulnerabilities – a big issue following the CrowdStrike incident.
Australian Cyber Security Magazine: Industry Responds to Protective Security Policy Framework Directive
The cybersecurity industry has responded to the Australian Government’s Protective Security Policy Framework (PSPF) Direction 002-2024, issued on July 8, 2024. The directive requires Australian Government entities to identify and actively manage the risks associated with vulnerable technologies they manage for themselves and others.
Dynamic Business: Tech Tuesday: Top Cybersecurity tools for SMEs in 2024
Running a successful SME requires juggling many hats. But one area that can’t be overlooked is cybersecurity. Data breaches and cyberattacks are on the rise, and even small businesses are attractive targets.
DZone: The XZ Utils Backdoor in Linux: A Symptom of Ailing Security in the Software Supply Chain
Software is the foundation of virtually every modern enterprise, yet our reliance on potentially vulnerable open-source components in critical systems represents an extreme risk in the software supply chain. It’s an ailment for which we must find an appropriate cure.
IT Wire: Why AI can’t replace humans in secure code development
One of the most challenging aspects of integrating AI tools into business operations is determining which outputs are trustworthy, which tools you can trust to become part of your tech stack, the strengths and weaknesses of each tool, and how you can ensure consistent results if different tools or processes are being used.
SecurityBrief Australia: How AI can help developers boost the security of new code
AI coding tools can assist the defence capabilities of developers, enabling an easier pathway to a ‘security-first’ mindset. However, like any new and potentially impactful innovation, they also raise potential questions that teams and organisations need to explore.
KBI Media: Why Software Developers Play a Critical Role in Achieving Effective Cybersecurity
When it comes to enterprise cybersecurity, nothing is set in stone. With a constantly shifting threat landscape on one hand and evolving tools on the other, security teams can often feel overworked and overwhelmed.
In AI today: How AI coding tools can help developers boost software security
Few technological advances have captured widespread attention as quickly as Artificial Intelligence (AI). In less than two years, AI has evolved from being a technical novelty into a powerful tool, and its rate of evolution shows no sign of slowing.
Information Week: The Impact of AI Skills on Hiring and Career Advancement [PODCAST]
Demand is high for professionals with knowledge of AI, but do such talents really get implemented on the job?
SD Times: The 2024 SD Times 100: 'Best in Show' in Software Development
The 2024 SD Times 100: 'Best in Show' in Software Development, Developer Experience category featuring Secure Code Warrior.
Help Net Security: Infosec products of the month: May 2024
Here’s a look at the most interesting products from the past month.
IBRS: VENDORiQ: Secure Code Warrior Adds A Yardstick For Secure Coding Skills
IBRS analysis sheds light on the importance of continuous measurement of secure coding skills and industry benchmarks for cybersecurity readiness.
Data Breach Today: Enhancing Code Security With the Developer Trust Score
Pieter Danhieux on the Benefits of Trust Score for CISOs and Developers.
Assured: Solving the Cyber Skills Shortage In-House
Peter Danhieux shares three best practices to consider when developing an internal upskilling programme.
Mi3: Federal Budget 2024-25: Industry pundits weigh in on living costs focus, investing in 'Future made in Australia' and Digital ID
Industry pundits across retail and technology have welcomed the Australian Federal Budget for 2024-25 and its particular focus on easing cost-of-living pressures as well as digital and cyber investments - even though several were hoping for more action.
DZone: You’ve Got a Friend in Me: How AI Coding Tools and Security-Aware Developers Can Work Together Safely
Code created by AI can be rife with vulnerabilities and flaws, but AI-assisted coding tools can still be helpful if paired with security-aware, human developers.
KBi Media: Australia’s FSIs Can Lead The Way In Secure AI-augmented Software Development
As AI becomes an integral part of code delivery in banks and other FSIs, the volume of code produced will increase, and so will the number of errors, flaws and vulnerabilities – unless these are corrected early in the software development lifecycle. The responsibility to run those quality checks will initially fall squarely on development teams to execute.
CSO Online: Australian federal budget outlines investment in cybersecurity
The Australian government announced its 2024-25 federal budget and CSO has selected highlights that indicate how much will go towards cybersecurity and in what areas.
Security Brief: Secure Code Warrior launches industry-first SCW Trust Score for developer teams
Secure Code Warrior has announced the introduction of its SCW Trust Score, the industry's first benchmark that gauges the security posture of organisations' developer teams.
IT Wire: Secure Code Warrior unveils SCW Trust Score to quantify developer team security posture
Secure Code Warrior, the global, developer-driven security leader, today unveiled SCW Trust Score, the industry’s first benchmark that quantifies the security posture of organisations’ developer teams.
Secure Code Warrior Unveils SCW Trust Score to Quantify Developer Team Security Posture
New benchmark leverages over 20 million learning data points from more than 250,000 developers around the world
IT Ops Times: Secure Code Warrior’s new SCW Trust Score helps companies benchmark their security posture
The security learning company Secure Code Warrior is making it easier for organizations to assess the security posture of their development teams with the SCW Trust Score.
Computer Weekly: Secure coding benchmark to increase standards among developers
Developer security advocate Secure Code Warrior has launched what it claims is the industry’s first benchmark designed to quantify the security competence of its customers’ software developer teams.
IT Brief: Secure code starts with a training commitment to development teams
We’ve established that developers are an integral—yet frequently underutilised—part of reaching a state of software security excellence. This is especially relevant to more than just PCI DSS compliance. It is crucial that developers understand the broader picture of PCI DSS 4.0 - even if they are not subject to it - in terms of what they can control and integrate as part of their default approach to a software build.
TechRadar Pro: An agile approach to AI-supported coding
Teams that implement agile learning in secure code, along with safe deployment of AI assistive tooling enjoy the benefit of hands-on experience with the tools while achieving security at speed. This has been notoriously difficult to achieve, especially if developers have little experience with security awareness and training. The “just-in-time” approach directly ties into what developers are doing on a day-to-day basis, with context that allows them to anticipate and solve relevant vulnerability problems that have been created by AI.
Forbes Technology Council: Benchmarking Developer Security Skills: A New Standard For Enterprise Cybersecurity Programs
Recent evolutions in developer security education have enhanced the ability for enterprises to benchmark their cohorts' security abilities, ultimately designing programs to ensure they operate with security as second nature. This can result in meaningful risk mitigation and favorable comparisons against others in their industry as a whole.
Security Journal UK: Fasten your seat belts: A new cybersecurity plan is set to make a change
Pieter Danhieux Co-Founder and CEO, Secure Code Warrior, discusses the need for leadership when it comes to cybersecurity and why the Cybersecurity and Infrastructure Security Agency (CISA) could be the answer.
IT Brief UK: Zombie APIs: the resident evil in too many businesses
The Marsh McLennan Cyber Risk Analytics Center has estimated that API vulnerabilities cost businesses anywhere up to $75 billion annually. Clearly, businesses should be decommissioning those old APIs. What’s stopping them?
TechRadar Pro: How AI remediation will impact developers
Will AI remediation entirely remove security-related coding tasks from developers?
Cybersecurity Insiders: The human-AI partnership: a guide towards secure coding
The doomsayers are, so far, losing the argument. The panic around AI replacing humans has been countered with a new narrative: “Let AI redefine your job rather than replace it.” According to a recent survey from Stack Overflow, 44% of developers are either using or planning to use AI tools—even though just 3% “highly trust” the accuracy of the results. Twice as many (6%) say they highly mistrust AI due to security concerns and inaccuracy.
KBI Media: Why developers need security skills to effectively navigate AI development tools
While it’s true that AI can help save some time for overworked programmers, the future will likely be one where humans and AI work together, with trained personnel in charge of applying critical thinking and precision skills to ensure all code is as secure as possible.
SC Magazine: Software makers can enhance their brand by embracing CISA’s new secure code guidelines
CISA’s Secure-By-Design guidelines, which call for shifting the responsibility for secure coding back to those making the devices, software and applications people increasingly rely on, and trust with sensitive data. The program defines what many frustrated technology users already know, that the industry needs a new model for cybersecurity in which vulnerabilities are fixed long before they reach the public.
Help Net Security: Apiiro and Secure Code Warrior join forces for developer training integration
Apiiro has announced a product integration and partnership with Secure Code Warrior to extend its ASPM technology and processes to the people layer. The partnership combines Apiiro’s deep code analysis and risk context with Secure Code Warrior’s agile learning catalog to deliver developer training directly to developers in their tools and workflows.
Apiiro and Secure Code Warrior Partner to Deliver Hyper-Relevant Developer Security Training
Apiiro, the leading application security posture management (ASPM) platform, today announced a product integration and partnership with Secure Code Warrior, the leading agile developer security training platform to extend its ASPM technology and processes to the people layer.
SafetyDetectives: Interview With Pieter Danhieux - Co-Founder & CEO of Secure Code Warrior
Pieter Danhieux, Co-Founder and CEO of Secure Code Warrior, recently discussed the evolving role of developers and the integration of AI tools in software development with SafetyDetectives. He emphasized the need for developers to prioritize security practices and provide oversight to AI-generated code. Danhieux highlighted essential security benchmarks for both AI assistants and developers, stressing the importance of visibility, data-driven measurement, and flexibility in security programs.
Authority Magazine: C-Suite Perspectives On AI: Pieter Danhieux Of Secure Code Warrior On Where to Use AI and Where to Rely Only on Humans
Building a simple calculator is a lot different from navigating the compliant configuration of a payment gateway, so exercising discretion and resisting the temptation to outsource complex issues to AI tools is paramount.
Security Brief: The importance of cybersecurity training for software developers
By embracing agile learning and allocating sufficient time for developers to undertake the training, organisations will be better placed to withstand the constantly evolving threat landscape with which they are faced.
KBI Media: Why Agile Learning is Vital for Secure Software Development
Agile training sessions are built around just-in-time ‘microburst’ teaching scenarios. This means development teams can learn, test, and apply knowledge quickly and within the context of their work, in addition to addressing their current security challenges.
Help Net Security: Does AI remediation spell the end for developers in 2024?
In this Help Net Security video, Matias Madou, CTO at Secure Code Warrior, discusses how AI remediation unlocks new motivations among developers to demonstrate why the human element is still more valuable to the SDLC than relying on AI entirely.
Dark Reading: 4 Ways Organizations Can Drive Demand for Software Security Training
Developer-driven security programs place the development team at the center of reducing vulnerabilities.
Techerati: Eight Cybersecurity Trends to Navigate in 2024
Pieter Danhieux, CEO at Secure Code Warrior, notes the rising demand for AI/ML coding tools. While these tools assist developers, there is a risk of increased security vulnerabilities, particularly when used by less skilled developers. The need for security-skilled developers capable of safely leveraging AI technology is therefore growing.
Dynamic Business: Cybersecurity must-dos for businesses in 2024
While the internet propels us into an era of unparalleled innovations and conveniences, it concurrently exposes individuals and organisations to an ever-evolving network of malicious entities.
Built In: Do Your Developers Have Enough Time for Security Training?
Investing in secure code training for developers can reap big rewards in the face of a challenging threat landscape, but only if people have the time they need to learn meaningful lessons.
In AI Today: How AI’s impact will shape cybersecurity strategies in 2024
Having survived a year of rapid technological advances and high-profile cyber breaches, it’s now time for security professionals to polish the crystal ball and predict what lies ahead in 2024 for AI technology in security, and more.
Forbes: How To Equip Software Developers With Actionable Security Awareness
As the complexity and volume of vulnerabilities continue to increase, it’s encouraging to see that software developers are starting to understand the vital role they can play in upholding cybersecurity best practices.
DevOps.com: From Reaction to Robots: Riding the AI Wave in 2024
We occupy a notoriously unpredictable space, but that’s half the fun. Compared to many other verticals, technology—especially cybersecurity—is relatively youthful, and the future should be something we can all look forward to blossoming in sophistication alongside the technology we swear to protect. So, what can we expect in the industry in 2024?
VMBlog: Secure Code Warrior 2024 Predictions: Security, developers and the road ahead in 2024
Challenging economic dynamics, emerging cybersecurity threats, and society's most accessible introduction to AI to date, shaped what was an interesting 2023 for DevSecOps. Even more curious - none of these elements are in the rearview mirror as we turn the page and head into 2024. They are front and center for organizations, their developer and cybersecurity teams, and government regulators.
SecurityBrief: How AI’s impact will shape cybersecurity strategies in 2024
If the past 12 months are any guide the hottest topic in town will continue to be artificial intelligence (AI). As well as reshaping many aspects of work, the technology will continue to pose new challenges when it comes to cyber security.
DZone: With the Right Support, Developers Can Lead Your Organization to Superior PCI-DSS 4.0 Compliance
The Payment Card Industry Data Security Standard (PCI-DSS) version 4.0 will change almost everything about security for any business or organization that accepts electronic payments, which is a vast majority of them. And make no mistake, this update will be transformative for most businesses.
Secure Code Warrior’s Agile Learning Platform Empowers Netskope Developers to Code Cloud Solutions at Scale
Netskope partners with Secure Code Warrior to reimagine secure code education and accelerate software development
.avif)
Which AI Model Codes Most Securely?
See how 16 leading AI models actually code, scored across 11 real-world frameworks and 1,760 codebases — the framework matters as much as the model.
Citizen AI by Secure Code Warrior
AI risk doesn't stop at engineering. Get the one-pager on Citizen AI — build AI literacy and safe habits across your whole workforce.
Understand how AI is transforming software development—and how security must evolve with it.
From AI autocomplete to autonomous agents—explore how software development is evolving and what it means for security, governance, and your team.
SCW named in new Agentic Coding Security category
Gartner named SCW twice in the 2026 Hype Cycle for Secure Software Engineering. Here's why it matters for AI-driven development.
SCW Learning Content for KnowBe4
Secure Code Warrior content available through KnowBe4 helps technical teams build secure coding and AI governance awareness through structured learning covering OWASP Top 10 risks, AI-assisted development, and modern secure coding practices.
Secure AI-driven development with KnowBe4 + Secure Code Warrior
Secure Code Warrior joins KnowBe4 to bring hands-on secure coding training into security awareness programs — covering OWASP, AI development, and 10 languages.
Trust Agent:AI - Secure and scale AI-Drive development
AI is writing code. Who’s governing it? With up to 50% of AI-generated code containing security weaknesses, managing AI risk is critical. Discover how SCW's Trust Agent: AI provides the real-time visibility, proactive governance, and targeted upskilling needed to scale AI-driven development securely.
OpenText Application Security + Secure Code Warrior
OpenText Application Security and Secure Code Warrior combine vulnerability detection with AI Software Governance and developer capability. Together, they help organizations reduce risk, strengthen secure coding practices, and confidently adopt AI-driven development.
Secure Code Warrior corporate overview
Secure Code Warrior is an AI Software Governance platform designed to enable organizations to safely adopt AI-driven development by bridging the gap between development velocity and enterprise security. The platform addresses the "Visibility Gap," where security teams often lack insights into shadow AI coding tools and the origins of production code.
Secure code training topics & content
Our industry-leading content is always evolving to fit the ever changing software development landscape with your role in mind. Topics covering everything from AI to XQuery Injection, offered for a variety of roles from Architects and Engineers to Product Managers and QA. Get a sneak peek of what our content catalog has to offer by topic and role.
Cyber Resilience Act (CRA) Aligned Learning Pathways
SCW supports Cyber Resilience Act (CRA) readiness with CRA-aligned Quests and conceptual learning collections that help development teams build the Secure by Design, SDLC, and secure coding skills aligned with the CRA’s secure development principles.
%20(1).avif)
OWASP Top 10 2025 eBook
Want to dominate the OWASP Top 10? Download the No-BS Guide to Defending Your Applications Against the OWASP Top 10:2025
Trust Agent: AI by Secure Code Warrior
This one-pager introduces SCW Trust Agent: AI, a new set of capabilities that provide deep observability and governance over AI coding tools. Learn how our solution uniquely correlates AI tool usage with developer skills to help you manage risk, optimize your SDLC, and ensure every line of AI-generated code is secure.
AI Coding Assistants: A Guide to Security-Safe Navigation for the Next Generation of Developers
Large language models deliver irresistible advantages in speed and productivity, but they also introduce undeniable risks to the enterprise. Traditional security guardrails aren’t enough to control the deluge. Developers require precise, verified security skills to identify and prevent security flaws at the outset of the software development lifecycle.
Professional Services - Accelerate with expertise
Secure Code Warrior’s Program Strategy Services (PSS) team helps you build, enhance, and optimize your secure coding program. Whether you're starting fresh or refining your approach, our experts provide tailored guidance.
Quests: Industry leading learning to keep developers ahead of the game mitigating risk.
Quests is a learning platform that helps developers mitigate software security risks by enhancing their secure coding skills. With curated learning paths, hands-on challenges, and interactive activities, it empowers developers to identify and prevent vulnerabilities.
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
Trust Agent in action
SCW Trust Agent gives you the tools you need to deliver secure code faster, ensuring developers have the knowledge and skills to implement security best practices in the specific programming language of their code commits.
.avif)
Trust Agent by Secure Code Warrior
Are you confident that every line of code committed is backed by a developer with the necessary secure coding skills? Many organizations face this critical gap, leading to preventable vulnerabilities and reduced development velocity. SCW Trust Agent offers unparalleled visibility across your code repositories, analyzing commits directly against developer security proficiency. With policy gates, Trust Agent enables you to apply governance at the commit level, with policies to ensure code contributors have the secure code knowledge you require for your business-critical applications. Download our one-pager today to learn how SCW Trust Agent can help you strengthen your security posture, optimize your development lifecycle, and significantly reduce vulnerabilities.
SCW Trust Score - The best way to build, measure, and optimize your security program
Learn more about Secure Code Warrior Trust Score, the best way to build, measure and optimize your security program.
Trust Score by Secure Code Warrior
Discover SCW Trust Score, an industry-first benchmark to help measure your security program's effectiveness. Benchmark against industry peers, optimize your security posture, and drive data-driven decisions for enhanced software security.
Preparing for PCI-DSS 4.0 Compliance
Evaluate your software security infrastructure to support PCI-DSS requirements
The ultimate guide to security trends in financial services
Financial services institutions face an array of challenges that hinge on their ability to make efficient, effective use of technology in a fast-evolving financial world. Organizations are operating in a time of rapid changes—both internally and across the industry—in a highly competitive, cloud-based business environment. In pursuing their ongoing digital transformations, for example, organizations are working to get around the organizational friction that hinders investments into new technologies, such as artificial intelligence, that could accelerate payment processes and other procedures.
PCI DSS 4.0 Unraveled
This guide offers practical strategies to engage development teams in PCI DSS 4.0 compliance. It outlines the modern developer's requirements for compliance, strategies for security professionals and development managers to collaborate on developer-focused security programs, and step-by-step advice on effective training initiatives to mitigate vulnerabilities permanently.
ROI of Secure Code Learning
Explore the long-term ROI of secure coding education. Learn how investing in agile, proactive learning strategies enhances security and offers cost-effective protection against today's cyber threats.
Why developers need security skills to effectively navigate AI development tools
The promise of artificial intelligence writing complex code at the touch of a button is intriguing, but the reality is that AI will need a lot of help from human developers to craft truly secure and reliable code.
Top 10 predictions for 2024
Check out what SCW experts are predicting in the world of cybersecurity and software security in 2024.
Agile learning platforms: ROI of developer-driven security
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Forge your fortress: Six essential pillars of developer enablement in software security
In this white paper, security expert and Secure Code Warrior CTO & Co-Founder Matias Madou, Ph.D. will discuss:The six pillars you need to roll out effective security education and enablement for your development cohort. Lessons learned from ten executives implementing security programs at the enterprise level, and common pitfalls to avoid on your road to success.
The Agile Learning Platform
Empower your development team with Secure Code Warrior, the agile learning platform designed to tackle the evolving challenges of application security. Stay ahead in the battle against security breaches and regulatory complexities with our industry-leading, up-to-date content, ensuring a proactive and engaging approach to secure code education.
OWASP Top 10 API 2023: A tactical guide for smart developers
Explore the Latest in API Security. Dive into our 2023 OWASP Top 10 guide. Elevate your coding skills, tackle vulnerabilities, and stay agile in the ever-evolving world of API development. Download now for an insightful journey!
The secure code learning blueprint
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Your handbook to developer-driven security and agile learning
Start shifting left with developer-driven security. This handbook will show you how to engage with developers to upskill and increase their security knowledge, as well as how to go about measuring impact to write more secure code.
Software is your colleague: A new perspective to strengthen access control and API security
APIs act like flawed humans; is treating them as such the key to better cybersecurity?
The secure code training blueprint
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The developer security maturity matrix
Building security maturity in development teams can be approached in stages. Based on our experience with 400+ organizations, we've identified common practices and traits in three different stages of security maturity - defining, adopting, and scaling.
The importance of security maturity in developer teams
By assessing and understanding a development team’s security maturity, organizations can formulate a plan with the right stakeholders, process, and technology to build and support the necessary skills and capabilities.
Development Team Security Maturity
Security maturity in development teams should be a continuous cycle of improvement with realistic goals along the way. As development teams increase their security maturity, they reduce the amount of rework and minimize risk, while also allowing automation to help create efficiency in the SDLC.
Report: The state of developer driven security 2022
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Whitepaper: The challenges (and opportunities) to improve software security
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Brief: A cohesive approach to developer-led security
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Security and privacy at Secure Code Warrior
Secure Code Warrior is committed to safeguarding our information assets, and those of our customers, against misuse, abuse or compromise. We adopt and foster a risk-based approach to managing information security, with the goal of consistently implementing appropriate risk management and mitigation measures to address the threat landscape posed to the security of the platform, customer data and information. As Secure Code Warrior continues to succeed as a major player providing services to our customers, we will continue to build security capabilities as part of our security and privacy programs. Read our whitepaper for more information.
.avif)
Shift left (and achieve compliance) with repeatable secure coding skills
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Defining secure code
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Why you need more than scanning tools to create secure code
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Your guide to defense against the dark art of zero-day attacks
Zero-day attacks can be the stuff of nightmares, but when an organization commits to using all available tools in their security arsenal towards a preventative strategy, security professionals can sleep a little easier.
A plan to upskill and engage your developers
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The preventative, developer-driven approach to software security
Learn more about how security-aware developers represent a vast and largely untapped resource that can support cyber defenses by consistently standing against modern threats.
OWASP Top 10 API: Strategies for Smart Developers
Download the practical guide to defeating common API security baddies in your code.
How to unify your security and development teams to stand together against security risk
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
How AppSec can reduce vulnerabilities and achieve compliance - leaving them free to tackle larger beasts
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Shared Assessments SIG Lite Questionnaire
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
SCW Pen Test Summary
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
SCW Cyber Insurance Certificate
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Cybersecurity Executive Order: A deliberate approach to improve software security with developer skills
While this Executive Order for touches on many aspects of functional cybersecurity, it specifically outlines, for the first time, the impact of developers, and the need for them to have verified security skills and awareness.
FSQS-NL Certificate
Secure Code Warrior is now FSQS-NL registered. This registration is an important milestone in our continuous efforts to being compliant with regulations within the financial industry.
Platform Architecture Diagram
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
CAIQ Questionnaire
Secure Code Warrior has completed a publicly available Consensus Assessment Initiative Questionnaire (CAIQ), based on the results of our due diligence self-assessment.
The DevSecOps Super Bowl: How security champions can support your team to victory against late-stage vulnerabilities
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Executive Roundtable Whitepaper - Visma & Blue Prism
How has 2020 changed the way we look at software security, an executive roundtable with Visma.
The women of mimmit koodaa movement dive into secure coding
Mimmit Koodaa (women who code in Finland) tell us about their secure coding experiences.
Teams in a global financial institution go head-to-head in secure coding contest.
See how a global financial organization promoted the importance of securing their banking applications across the world. With fun interactive tournaments.
Missions - Experience the impact of poor code in real-world simulations
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Courses - Build Secure Coding Skills and Competency
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
A Step-By-Step Guide to Tournaments
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Your Battle Plan to Defeat the OWASP Top 10
The ten most common security vulnerabilities don’t stand a chance against secure development superheroes like you. This free eBook is your ultimate field guide to understanding each infamous entry in the OWASP Top 10 2021, gaining insight into how each bug operates.
Triumph with OWASP and Secure Code Warrior Tournaments - Whitepaper
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Tournaments - Build organizational awareness and developer engagement, making secure coding top of mind
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The Infamous 8: Infrastructure as Code Vulnerabilities to Find and Fix
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The Five-Step Road to DevSecOps Success: How AppSec Professionals Can Thrive in Their Dream Team
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The Fastest and Easiest Way to Improve Your Software Security Program
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
The Creative CISO's Guide to Transforming Their Security Program
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Introduction to Secure Code Warrior
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Empowering developers to write secure code
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Empower developers to be the first line of defense and grow your organization's security posture
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Assessments - Benchmark the secure coding skills of your developers, and build your security posture.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
AppSec Checklist
Download the AppSec checklist and see if you’re in need of a security lifeline.
6 Critical Steps Before You Roll Out a Security Uplift Program
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
2019 AppSec Trend Report
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.