Resources library

Situation

Before Workday implemented agile learning with Secure Code Warrior, they were utilizing in-house courses that comprised of recordings of PowerPoint presentations that covered OWASP top 10 vulnerabilities with some pseudocode examples. Alex Uda, Program Manager for security developer training, realized this wasn’t helping his team and the security team at large to achieve their goals of improving Workday’s overall security posture. Because developers were quickly becoming unengaged in their training, they decided to begin soliciting their feedback and noted that there were two items that continued to come up:

1. The need for more hands-on type of training 
2. The need for more language-specific content
   

Action 

In working with developers, Alex and his team identified two main priorities in winning developer buy-in to create an engaging, successful secure code learning program.

Clarity and simplicity 

Most developers do not arrive at their jobs with knowledge of security. Anything that is frustrating or time-consuming will lead developers to stray towards workarounds and hacks. What Workday noted about SCW is that it allowed developers to have a clear sense of the process, own it, and integrate it into their workflows.

Actionability and value 

Developers, first and foremost, want to be able to action something that is affecting the codebase/lifecycle, and action it fast. To do so, developers need to be educated on how to do so. If you want a developer to be interested in something like security, highlighting the value of these topics.

In terms of structuring the program, Alex and his team first gathered feedback on the platform from a pilot group of security champions and worked with their customer success manager to implement their suggestions. Alex and the team then looked at their SAST tools and different metrics on the number of incidents and security events to assess what the highest risks are in their current environment, and what is happening across the industry. They initially focused on the OWASP top 10 and the most common, high-risk vulnerabilities at Workday
‍

“By giving developers that learning and that agency, SCW made it so that we were able to make active improvements to our software security. It’s not all about writing code, it’s also about growth opportunities and career opportunities. Workday’s support for the security program exists because it’s an area where the entire company is aligned, so developers were allowed that time for learning and development. Taking two hours a week to do some learning over a period of time helps to build that muscle memory with consistency.”
‍

Results

Traditionally, it’s easy to think of security at the end stage of the development process. Working with the security team, developers at Workday now see security as an important component of the development cycle. They can action security items quickly and earlier in the SDLC, which has been the biggest impact of that program. For one team based in Dublin, their developers went from 4662 security issues - which averaged almost 31.08 issues a day - down to 0 in a period of around 18 months.

Alex described the growth of the program as, “a snowball effect after we began with top-of-mind security champions. As we socialized the program and its benefits to leadership and continued to increase our membership we saw almost a natural growth due to word of mouth. From a training perspective, our goal is to give our developers the necessary skills to develop code securely. This is especially critical as Workday continues to grow."

Key takeaways

According to Alex, “In order to successfully scale security it’s imperative that our developers have a security mindset to help identify security risks during the design phase of their software development. This fits in our shift left initiative to empower our developers to help save time, money, and some heartache. The better job we do in secure code learning, the fewer vulnerabilities we see from our scans and pentest results.”

For developers, it’s important to have fun when learning about security 
SCW is great at showing how exciting it can be. If you are getting involved in security learning, embrace it fully. Consider it as a part of your development process and a part of your career growth.

‍Encourage developers to reach out to the team if they are curious about security
Have a conversation, and start that collaboration.‍

Security as a black box or as a bolt-on to your project is archaic and ultimately does a disservice to your software
Embracing security as part of the development process - the same way we embrace TDD, agile, and linting - will improve the flow and increase the quality of software being delivered to customers.

‍

The Cyber Resilience Act 2024 (CRA) is an EU regulation that introduces mandatory cybersecurity requirements for most products with a digital component sold in theEU. The CRA enhances cybersecurity standards of such products, which in turn requires manufacturers, importers, distributors, and retailers to ensure cybersecurity throughout the lifecycle of these products. Secure Code Warrior supports CRA readiness with CRA-aligned Quests and conceptual learning collections that help development teams build the Secure by Design, SDLC, and secure coding skills aligned with the CRA’s secure development principles.

Developer Risk Management is a holistic and proactive approach to application security, focused on code contributors rather than within the bits and bytes of the application layer itself.

Proactively measure, manage and mitigate developer security risk across the SDLC to improve security posture, release software faster and cut vulnerabilities by 53% or more.

The philosophy behind Developer Risk Management is that, through upskilling code contributors and applying governance to secure coding skills programmatically, the benefits and impact of developer-driven secure code initiatives increase exponentially.

During the webinar she discusses:

• Possible methods for locating developers
• Challenges faced by SCW customers
• Trust Agent: Commits for Developer Discovery
• Next steps for new customers
  ‍

Paysafe helps turn financial transactions into experiences rooted in trust, and they know that providing a secure, seamless platform that processes over $152B in annualized transaction volume requires far more than meeting basic compliance standards. Over the past four years, Paysafe continues to drive a holistic approach to developer risk management through their partnership with Secure Code Warrior, with their application security program demonstrating a positive impact on overall business needs, including:    

‍
The Challenge: Elevating Secure Code Standards Across Paysafe

As a multinational online payment provider, Paysafe has always seen secure coding as a strategic priority that extends beyond simply fulfilling PCI DSS compliance requirements. While formal, expert-led classroom training sessions and skill assessments were part of their early efforts, Paysafe’s goal has always been to continuously expand the scope and scale of their secure coding initiative, ensuring a best-in-class approach to application security and that engineers write secure code from the start.

“For us, it’s never been about just checking a box that we have provided training. Our goal is to keep our staff aware of ongoing developments. We are always striving to be better and do more. We want engineering teams and security teams to collaborate. Teams that can develop themselves are more informed and design better code,” said Boyan Hristov, People Development Partner at Paysafe.

Paysafe’s vision was to shift security left, developing security-aware engineers who embed secure coding practices into every stage of the software development lifecycle. To support this, they needed a scalable, engaging, and continuous program that would not only provide audit evidence for PCI compliance purposes, but also drive deep and lasting cultural change. This included gamified learning experiences, regular tournaments, and always-on training to help engage developers and push them to stay at the forefront of industry security trends.

The Solution: A Cutting-Edge Approach with Secure Code Warrior

Paysafe adopted Secure Code Warrior’s Developer Risk Management Platform to help scale secure coding practices, engage engineers and embed security earlier in the development lifecycle. Their Security Champions program has grown over time, with Secure Code Warrior playing a critical role in achieving cyber risk prevention goals.

Paysafe allowed developers to organically engage with the platform, encouraging gamified activities like tournaments with enticing prizes to get developers involved and excited. When the program initially rolled out, they made some assessments mandatory to help meet PCI compliance requirements and offered other content and activities as an option.

As the program gained traction, leadership provided additional support, further aligning the goals of development and infosec teams. This allowed the Paysafe team to take the program to the next level and introduce more formal certification programs with designated KPI and success incentives. 

The next phase of the program focused on industry-standard OWASP Top 10 topics, with certification stages allowing developers to advance through various levels of achievement. Now, the program has reached a new level of scale and maturity, elevating the baseline standards for developers across the board, from full-time employees to contingent workers.

‍“We greatly value the partnership we’ve built with SCW over the past four years. Together we’ve been able to deliver targeted application security training and foster stronger relationships between our security and engineering teams, anchored in a shared commitment to developing secure code the first time, and as early as possible in the SDLC,” says Alan Osborne, Chief Information Security Officer at Paysafe. 

With the continued support and alignment of the CISO, CTO and executive leaders across engineering, Paysafe has partnered with Secure Code Warrior to continuously evolve their program. Today, the program is closely aligned with business needs, provides tangible outcomes, and remains relevant and engaging for internal teams.

Results: A New Standard for Secure Code Across the Organization

Paysafe's application security initiatives have improved since the start of their journey four years ago. Through the partnership with Secure Code Warrior, Paysafe has demonstrated the tremendous impact a holistic approach to developer risk management can have across the organization. 

Paysafe’s analysis of SAST scan data showed that applications developed by teams trained with Secure Code Warrior showed a notable reduction in vulnerabilities detected during early-stage development scans. The number of vulnerabilities found at first scan decreased further in teams where developers were more actively engaged with the SCW platform. 

The team with the highest level of activity and engagement in Secure Code Warrior saw a significant reduction, year over year, in vulnerabilities found during early development phases – highlighting the added value of continuous, skills-based training in reinforcing secure coding habits. Creating secure code from the start saved their team and other teams along the SDLC a significant amount of time. Thousands of development hours were saved by eliminating the need to identify, log and rework code vulnerabilities by preventing them during early development. This resulted in a 45% improvement in developer productivity helping to demonstrate the benefits of secure code upskilling and improving the day-to-day development process. A win-win for engineering and AppSec teams alike.

Paysafe’s dedication to secure code has helped them stand out and achieve a fourth-place ranking SCW Trust Score^®  within the Banking & Financial Services benchmark. While this is an achievement they are proud of, Paysafe’s commitment to secure code initiatives doesn’t stop there. Encouraged by the results they’ve seen through the partnership with Secure Code Warrior, Paysafe seeks to further elevate the program. 

“Secure Code Warrior has helped us increase developer productivity, accelerate our ability to bring products and improvements to market, and significantly reduce costs and risk over time,” says Alan Osborne, Chief Information Security Officer at Paysafe. “We’ve demonstrated that secure coding, driven by enhanced developer training, is not just a ‘nice to have’, but a proven investment that delivers real ROI while strengthening our developers’ skills, experience and capabilities.”

Next up, Paysafe aims to further operationalize its security standards by incorporating additional governance and risk management measures into its process, with SCW Trust Agent deepening its long-standing partnership with Secure Code Warrior and demonstrating its commitment to cybersecurity excellence.

Transform Your Secure Code Governance: Gain Control and Insight into Every Commit 

Are you confident that every line of code committed is backed by a developer with the necessary secure coding skills? Many organizations face this critical gap, leading to preventable vulnerabilities and reduced development velocity. SCW Trust Agent offers unparalleled visibility across your code repositories, analyzing commits directly against developer security proficiency. With policy gates, Trust Agent enables you to apply governance at the commit level, with policies to ensure code contributors have the secure code knowledge you require for your business-critical applications. 

Download our one-pager today to learn how SCW Trust Agent can help you strengthen your security posture, optimize your development lifecycle, and significantly reduce vulnerabilities.

Organizations often approach security with the goal of reducing their risk profile organically - usually by identifying developers who can evolve into security champions. However, the challenge in identifying and nurturing security champions is to build a program that can scale over time and empower developers to help increase the overall security posture of an organization.