Critical infrastructure industries making progress on Secure-by-Design developer readiness

Today, Secure Code Warrior issued new findings on developer upskilling and its impact on organizations’ Secure-by-Design (SBD) initiatives.

Since April 2024, more than 200 companies, including Secure Code Warrior, have signed the Secure-by-Design pledge. The new analysis shows that organizations across critical infrastructure industries, like financial services, defense, healthcare, and IT, are making progress in preparing their developers to advance their SBD initiatives. Secure Code Warrior found that these industries’ developer teams possess an average security posture, as measured by the SCW Trust Score, a global benchmark that quantifies developer teams’ security competencies, that is higher than that of other industries.

Chief information security officers (CISOs) find it increasingly difficult to prove the true ROI in the early stages of their SBD initiatives. In recent years, the absence of a benchmark to evaluate how organizations are tracking against industry standards has been a key challenge. The key to making Secure-by-Design initiatives work is not only giving developers the skills to ensure secure code but also assuring industry and government regulators that those skills are set in place.

“Now more than ever, we have a national responsibility to ensure SBD upskilling programs are in place,” said Chris Inglis, Senior Strategic Advisor at Paladin Capital Group and former National Cyber Director. “Risk reduction is at the core of this latest analysis, and Secure Code Warrior is leading the charge to enhance developer security learning, prevent cyberattacks, and strengthen our nation’s critical infrastructure.”

Key Findings: Secure Code Warrior’s analysis of developer upskilling across critical infrastructure industries is based on insights from over 20 million data points across 600 enterprise customers and more than 250,000 active developers around the world. The analysis found that:

• The total number of developers currently involved in developer-centric SBD upskilling initiatives is less than 4% of all developers globally.
• Certain critical infrastructure sectors, like the financial services industry, possessed the highest security posture, as measured by SCW TrustScore, compared to the average of non-critical infrastructures. For example, the Financial Services average Trust Score was 336.
• Surprisingly though, even with compliance and regulation requirements, the financial services sector had a similar security posture as several other critical sectors.
• Large-scale and smaller-scale Secure-by-Design upskilling initiatives can be successful, and research shows that smaller-scale initiatives can ramp up quickly and run faster. But for these initiatives to be successful and deliver a measurable return on investment (ROI) sooner, research shows a mandate has to be put in place.
• When upskilling initiatives are firmly in place, risks introduced by developers in applications are considerably fewer. The analysis found that developers within large upskilling initiatives (7000+ developers in a single company) can predictably reduce vulnerabilities by 47-53%.

Secure-by-Design is gaining momentum across the globe as countries weave in similar guidelines to their broader cybersecurity strategies. However, providing secure defaults for developers and fostering a software developer workforce that understands security will be difficult to achieve without the right data points to inform a developer skills benchmark. A program of agile upskilling can resonate with developers, when built on established baselines, with hands-on sessions that address real-world problems developers are facing.

“At a time of unprecedented global cyber threats, these new findings demonstrate the need to enhance SBD initiatives across our digital infrastructure to reduce critical vulnerabilities,” said Kemba Walden, President of the Paladin Global Institute and former acting National Cyber Director. “This research issues a clear call to action for upskilling personnel and creating benchmarks to meet critical cybersecurity goals.”

“Baselines and benchmarks can greatly optimize an organization’s security posture by making secure coding an essential part of its DNA,” said Matias Madou, co-founder and CTO, Secure Code Warrior. “To know if a SBD initiative is making real progress, you need the quantitative evidence that developer upskilling efforts are effective and that they absorb security best practices into their work habits. You must have complete faith that developers have truly earned their license to code.”

Many security leaders persistently highlight the difficulty of scaling most elements of an enterprise security program, especially those involving continuous upskilling and assessment of individual personnel. This is a valid concern, but in the wake of several global legislation reforms and guidelines demanding that developers have verified security skills, it must be overcome. Many organizations around the world are taking action and have implemented large-scale upskilling initiatives that are making a significant impact.

To learn more about Secure Code Warrior’s latest analysis and the SCW Trust Score, click here.