Insights from experts shaping secure development

管理金融服务行业的法规，例如PCI DSS，强调了安全代码的重要性以及对开发人员进行安全最佳实践培训的必要性。

在主要 Linux 发行版使用的 XZ Utils 数据压缩库中发现了一个名为 CVE-2024-3094 的严重漏洞，该漏洞是由威胁行为者通过后门程序引入的。这种高严重性问题允许潜在的远程代码执行，对软件构建过程构成重大风险。该漏洞影响了Fedora Rawhide中XZ Utils的早期版本（5.6.0和5.6.1），并紧急呼吁各组织实施补丁。该事件凸显了社区志愿者在维护开源软件方面的关键作用，并凸显了在软件开发生命周期内加强安全措施和访问控制的必要性。

生成式人工智能为金融服务公司提供了很多优势，但也带来了很多潜在风险。培训开发人员掌握安全最佳实践并将其与 AI 模型配对，有助于从一开始就创建安全代码。

Kamer van Koophandel shares how it embedded secure coding into everyday development through role-based certifications, Trust Score benchmarking, and a culture of shared security ownership.

See how Paysafe's partnership with Secure Code Warrior led to a 45% boost in developer productivity and a major reduction in code vulnerabilities.

DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.

The Telecoms Security Bill, which seeks to introduce a new security framework for the UK telecoms sector, is currently being passed through the UK parliament. The bill aims to ensure that public telecommunications providers operate secure and resilient networks and services, and manage their supply chains appropriately. Telecoms, like many other industries, have relied on a reactive approach to security for far too long, and while the new rules introduced by the bill don’t prioritise a grass-roots approach to security led by secure coding, it does introduce a series of tests to ensure providers are meeting government standards. So, what exactly does the bill mean, and how are these new rules going to ensure that security risks and compromises are minimised in the sector?

Matias Madou, CTO and co-founder, said "There are more efficient ways to maximise telecoms security, many of which are missing from the proposed government bill. These solutions include, and are not limited to a good security culture, attentive executive leadership and upskilling developers in security. Many companies and government bodies who are looking to build more robust security programs that stay in step with key security developments are already investigating a more preventative approach, however, it is imperative that the people factor is a key consideration in any defensive security plans."

See how 16 leading AI models actually code, scored across 11 real-world frameworks and 1,760 codebases — the framework matters as much as the model.

AI risk doesn't stop at engineering. Get the one-pager on Citizen AI — build AI literacy and safe habits across your whole workforce.

From AI autocomplete to autonomous agents—explore how software development is evolving and what it means for security, governance, and your team.