AppSec Survey 2.0 : FineTuning an AppSec Training Program Based on Data cut
summary
A 600-developer survey (about 500 usable responses) finds baseline appsec knowledge at 56% correct mirroring prior work, with those reporting 3+ days training scoring ~65% — twice the no-training group but still below a 70% pass. QA respondents perform markedly worse. E‑learning and instructor‑led courses remain the dominant delivery methods, 42% of respondents do not know if training led to SDLC changes, and incentives measurably increase participation.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:09When Not Thinking about AppSec...
- 1:52Snake Hunting Essentials
- 4:01AppSec Study 1.0 Results
- 6:59Overview of 2014 "2.0" Study
- 8:41Approach and Survey Participants
- 9:54Demographic Questions Asked
- 10:082014 Study Demographics
- 13:03Key Survey Results
- 14:19Change Implementation
- 15:04Types of Training Received
- 15:37E-Learning & Instructor-Led Training
- 15:51Perceived Effectiveness of Training
- 18:13Question Types
- 19:22Pass Rate by Job Function: Security
- 20:49What we Can Put to Work
- 29:04Conclusions
- 30:17Questions and Answers
related talks
33mCan AppSec Training Really make a smart developer
45mCan AppSec Training Really Make a Smarter Developer?
21mWhy Unleashing Your Software Security Potential is Necessary & How to Achieve It
39mInternal AppSec Awareness and Education
28mData-Driven AppSec Champions Programs – Benchmarking Your Program with Numbers
30mThe AppSec Error Loop: How We Can Stop Repeating Common Security Mistakes
30mAppSec in a DevOps World
26mTopics of Interest: These are the Vulns You are Looking For: AppSec Champions & Jedi...