Can AppSec Training Really Make a Smarter Developer?
summary
A yearlong survey of nearly 1,000 developers measures knowledge before and after formal training and retests a subset for retention, finding yearlong survey of nearly 1,000 developers, average post‑training gain around 25% retention, wide variance by role with 86% recognize XSS cause but poor answers on how to fix it, architects scoring ~64%, QA lowest, and an overall 73% fail passing threshold; PCI mandates drive most purchases, incentives (eg $100 Amazon) massively increase survey completion.
AI-written summary · about
chapters (15)
- 0:00Start
- 1:29Denim Group Overview
- 3:40How Developer Training is Different
- 5:42Yet Training is Mandated
- 6:39But Results Are Not Measured
- 9:18Research Overview
- 11:49Respondent Demographics
- 14:45Methodology
- 15:34Hypotheses
- 16:20Sample Questions
- 23:07CONCLUSION
- 25:19So How Do Developers Learn?
- 26:19Don't Ignore Basics of Training
- 27:45Incentives Matter!
- 30:10Where do we Go from Here?
related talks
33mCan AppSec Training Really make a smart developer
39mAppSec Survey 2.0 : FineTuning an AppSec Training Program Based on Data cut
30mAppSec in a DevOps World
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
28mSecure code from start; a journey through security training for developers
39mInternal AppSec Awareness and Education
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes