Alleviating Modern-Day Developer Pressures: 3 Ways to Ensure Effective AppSec Training
April 19, 2021

James Brotsos

As organizations rapidly accelerated digital transformation efforts due to COVID-19, software developers have had to endure the brunt of the increased workload. In fact, a recent Checkmarx study found that nearly half (46%) of developers said the rate at which they're expected to build and deploy software is somewhat or significantly faster now compared to before the pandemic, while another 36% admitted a top challenge weighing on their shoulders include keeping up with increased development speeds and demands.

While it may seem counterintuitive to add another component to developers' workloads, organizations can meet the needs of today's developers by prioritizing effective AppSec training. Developers themselves have expressed interest in increased training and resources amid the ongoing pandemic, with 36% asking for more AppSec training. This investment will not only reduce a company's risk from software vulnerabilities, but will also have a lasting impact on developers' efficiency and productivity, empowering them to operate more securely from the first line of code written.

But what exactly makes AppSec training effective, and how does this differ from the traditional types of educational resources developers are currently exposed to? Let's explore:

1. Just-in-time training to increase productivity

Let's face it — developers don't have the time (or patience) to sit in one-time, outdated training lessons, signaling the need for an alternative approach. We all know that an educated developer is a productive — and secure — developer. Security training that embeds lessons and modules directly into workstreams teaches developers how to write more secure code in real-time, learning as they go for maximum productivity and learning power. Training modules can help users understand how an application or portion of code might be exploited and how to prevent the issue from happening in the first place.

With integrated training, developers learn how to better understand and discover security vulnerabilities and weaknesses, and then proactively remediate them. In a recent case study where an organization implemented just-in-time developer training, the company saved each of its 1,000 developers two hours per week, translating to 104,000 hours and 1.7 million Euro annually through increased employee productivity. By cutting down on the hours spent towards archaic security training modules, developers are able to produce software faster and meet the pace of demand in a more secure manner.

2. Gamified education to prevent boredom (and burnout)

"Burnout” is a growing concern of business leaders across all industries and roles, but with the pressure that's now being put on developers to operate faster, they are specifically at-risk. Fortunately, increasing and promoting secure coding education can be an effective tactic against developer burnout — if implemented correctly.

A method widely adopted in the training and development world has been gamification due to its ability to engage and motivate participants. According to a recent survey, 83% of those who received gamified training felt motivated, while 61% of those who received non-gamified training felt bored and unproductive — both symptoms of burnout. Gamification can take many forms, such as tournaments, realistic role-plays or even personalized avatars. When combined, these tactics make for interactive, immersive training environments while simultaneously improving a developer's ability to code securely.

When developers are able to correct security concerns quickly (or better yet, not make the mistakes in the first place), they limit stress and feel empowered in the work they accomplish. Team empowerment can instill greater trust in leadership, further encourage employee motivation, lead to greater creativity and improve employee retention.

3. Incentivize training to cultivate a security culture

It is crucial that organizations establish a security culture that keeps pace with the rapidly evolving threat landscape. When training is paired with open communication, ongoing engagement and on-the-spot remediation support, security managers can cultivate a culture of software security that empowers developers to think and act securely in their day-to-day work.

A security culture can also be built when developers are rewarded for upskilling in critical areas. Instilling an ongoing leaderboard that tracks peers against each other and incentivizes winners with rewards (like gift cards or company recognition) will spur friendly competition and increased engagement amongst co-workers. The key is creating a system that is both engaging and motivational, while ultimately making everyone within the organization pay more attention to security, starting with developers in the trenches.

As application security continues to move under developers' ownership, with more than half (55%) of developers taking on more application security responsibility during COVID-19, organizations must meet them halfway. While business leaders can never exactly pinpoint the dollar amount that was saved by avoiding a breach, the benefits of effective training alone are priceless during a time when developers are on the front lines of innovation, helping advance today's accelerated digital transformation efforts that seemingly are here to stay.

James Brotsos is a Developer Advocate at Checkmarx
Share this

Industry News

March 30, 2023

CloudBees announced the integration of CloudBees’ continuous delivery and release orchestration solution, CloudBees CD/RO, with Argo Rollouts.

March 30, 2023, a Mirantis company, announced that its fully-managed application delivery platform is available in AWS Marketplace.

March 30, 2023

env0 secured an additional $18.1 million of funding to conclude its Series A investment round with a total of $35.1 million.

March 29, 2023

Planview announced a new strategic collaboration with UiPath. The integration is designed to fuse the UiPath Business Automation Platform with the Planview Value Stream Management (VSM) solution Planview® Tasktop Hub.

March 29, 2023

Noname Security announced major enhancements to its API security platform to help organizations protect their API ecosystem, secure their applications, and increase cyber resilience.

March 28, 2023

Mirantis announced the latest version of Mirantis Container Cloud -- MCC 2.23 -- that simplifies operations with the ability to monitor applications performance with a new Grafana dashboard and to make updates to Kubernetes clusters with a one-click “upgrade” button from a web interface.

March 28, 2023

Pegasystems announced updates to Pega Cloud supported by an enhanced Global Operations Center to deliver a more scalable, reliable, and secure foundation for its suite of AI-powered decisioning and workflow automation solutions.

March 28, 2023

D2iQ announced the launch of DKP Gov, a new container-management solution optimized for deployment within the government sector.

March 28, 2023

StackHawk announced the availability of StackHawk Pro and StackHawk Enterprise for trial and purchase through the Amazon Web Services (AWS) Marketplace.

March 27, 2023

Octopus Deploy announced the results KinderSystems has seen working with Octopus. Through the use of Octopus, KinderSystems automates its software deployment processes to meet the complex needs of its customers and reduce the time to deploy software.

March 27, 2023

Elastic Path announced Integrations Hub, a library of instant-on, no-code integrations that are fully managed and hosted by Elastic Path.

March 27, 2023

Yugabyte announced key updates to YugabyteDB Managed, including the launch of the YugabyteDB Managed Command Line Interface (CLI).

March 23, 2023

Ambassador Labs released Telepresence for Docker, designed to make it easy for developer teams to build, test and deliver apps at scale across Kubernetes.

March 23, 2023

Fermyon Technologies introduced Spin 1.0, a major new release of the serverless functions framework based on WebAssembly.

March 23, 2023

Torc announced the acquisition of coding performance measurement application Codealike to empower software developers with even more data that increases skills, job opportunities and enterprise value.