Over a Decade of Software Security: What Have We Learned
summary
An open industry measurement called the Bsim/BCM framework collects interview-driven data from over 550 assessments across 128 organizations and scores 122 discrete activities so firms can compare maturity. Observed trends include a ~60% increase in open‑source identification and control, broader use of CI/CD security gates, and a push toward governance as code. Only one firm in the pool automates malicious‑code detection, and formal metrics driving financial decisions remain rare.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:32Software security with BSIM
- 3:38What is BSIM
- 8:18BSIM levels and activities
- 11:49Metrics vs measures
- 16:29Quality security initiative
- 22:33Bootstrapping security
- 29:58Engineering-led security
- 33:08Security trends over time
- 44:04Key takeaways
- 46:30Q&A
related talks
01h 20mKeynote: BSIMM: A Decade of Software Security
44mNavigating Open Source and Open Standards for Better Cybersecurity
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
22mBug Parades, Zombies and the BSIMM: A Decade of Software Security
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
50mSoftware Security Metrics
41mAim-Ready-Fire
57mThe Developer's Field Guide to Software Security