We are excited to continue the conversation on the newest enhancement to the SCW Platform- SCW Trust Score. This ground-breaking feature was officially launched in May and represents a pivotal advancement in our mission to empower developers and organizations with the tools they need to write secure code.

At its core, the SCW Trust Score offers invaluable insights into your organization's security posture and the efficacy of your secure coding practices. Let’s walk through the main advantages and benefits of SCW Trust Score.

• Visibility: Diverse skills and competencies emerge across teams through learning and education programs, which rely on various factors for success. Despite undergoing identical secure code programs, teams often yield a spectrum of expertise, encompassing top performers, average achievers, and those who need additional support. SCW Trust Score provides organizations with a data-driven measurement of the effectiveness of their security learning program by aggregating individual developer security posture as they use Secure Code Warrior. 
  
  
• Benchmarking Metrics: Organizations need a benchmark to define the bell curve of their developers' security standing and pinpoint areas to optimize to truly create a security-ready and high-performing and productive software team.  With the SCW Trust Score, organizations gain the ability to assess their security posture relative to industry benchmarks and best practices. By leveraging this comprehensive metric, stakeholders can identify areas of strength and opportunities for improvement with unparalleled precision.
  
  
• Data-Powered: SCW Trust Score harnesses the power of 20 million learning data points sourced from over 600 companies and 250,000 developers. By analyzing all learning activities completed on our platform, our algorithm generates a comprehensive score. This score considers factors such as the breadth and depth of learning activities, activity comprehension, recency of learning, job description, onboarding lifecycle, and total number of developers trained.
  
  

We are proud to have continued our conversations with customers and prospects recently at RSAC, where it earned considerable interest from customers, partners, and industry leaders alike.

We are pleased to announce that we will be hosting a webinar on June 12th, in which our Chief Technology Officer & Co-founder Matias Madou will provide a comprehensive overview of the SCW Trust Score and its practical applications in real-world scenarios. We look forward to seeing you there.

Finally, we extend our appreciation to each member of the customer and partner community who has contributed to the development and refinement of the SCW Trust Score. Together, we embark on a journey toward understanding what good security posture looks like across organizations

Developers face constant challenges to keep their skills sharp and stay ahead of the curve. With technology advancing at rapid pace and new tools and frameworks emerging regularly, the need for continuous learning has never been more critical. In this digital era, where information is readily available at our fingertips, developers can harness the power of learning content on demand to propel their careers forward and stay relevant in the competitive field of software development.

Learning content on demand offers developers several key benefits. On-demand resources offer unparalleled flexibility and convenience, allowing developers to learn at their own pace, and fit education around their busy schedules and personal preferences. Moreover, agile platforms often feature targeted learning paths tailored to individual goals and skill levels, maximizing learning efficiency and ensuring developers acquire the skills necessary for career advancement. Ultimately, on-demand learning fosters a culture of continuous skill development, empowering developers to remain agile and resilient in the face of technological change and ensuring their long-term success in the software development field.

‍

At Secure Code Warrior, we're committed to providing developers with the most comprehensive and robust content available. Our goal is not only to offer superior learning and development resources but also to deliver them at the right time with information that's relevant to developers' current needs. This commitment is embodied in our Explore tab, a content library within the SCW platform designed to address the challenge of scattered resources. Explore consolidates all training content into one centralized location, providing users with a comprehensive view of available content types effortlessly. Whether learners seek to master a new programming language or explore intricate concepts, Explore has them covered. Our meticulously curated content catalog caters to a wide range of interests and skill levels, ensuring there's something for everyone. With Explore, learners will discover a wealth of interactive tutorials, practical exercises, and real-world scenarios, all designed to enhance the learning experience and empower developers to excel.

‍

‍

Tech ecosystems today are characterized by constant innovation and disruption, so the need for agile learning platforms has become increasingly critical. Traditional methods of learning and skill development no longer suffice in keeping pace with the rapid advancements in technology and the dynamic demands of the industry. As a result, organizations are turning to agile learning platforms to provide developers with the tools and resources they need to adapt and thrive in this fast-paced environment where developer driven security is essential.

One of the primary reasons why agile learning platforms are essential is their ability to deliver timely and relevant learning content. Agile learning platforms leverage dynamic content delivery mechanisms, such as microlearning modules and just-in-time resources, to provide developers with the knowledge they need, precisely when they need it. Another revolves around their ability to offer flexibility and customization, allowing developers to tailor their learning experiences to suit their individual needs and preferences. Whether they prefer interactive tutorials, hands-on labs, or video content, developers can choose the format that best suits their learning style and schedule.

All-in-all, agile learning platforms play a crucial role in empowering developers to thrive in today's fast-paced and ever-changing tech landscape. By delivering timely, relevant, and personalized learning experiences, these platforms enable developers to acquire new skills, stay ahead of industry trends, and drive innovation within their organizations. At Secure Code Warrior, we have developers top of mind as we continuously enhance our platform. Understanding the pivotal role developers play in crafting secure software, we ensure that our enhancements not only address current challenges but also empower developers to build resilient code with confidence. Here are some of the developer-forward platform enhancements we've recently implemented to reinforce this dedication.

We believe we can be more effective at engaging your developers through modern communications channels like Microsoft Teams. Our integration with Microsoft Teams is our first step towards next gen user communications within the SCW platform. Invite them to new learning activities, and send them custom reminders on course learning activities. You can also use Teams as a channel of delivery for Nudges, where you can Nudge course participants to complete their course via Teams notification.

‍

Adding to our developer driven product innovation is our Explore tab. Whether users are seeking to enhance their skills or dive into new areas, Explore ensures a seamless and enriching developer experience by providing a comprehensive hub for self-paced training and knowledge expansion. With over 7,000 activities available in 64 languages, Explore empowers users to effortlessly discover, play, and replay learning activities tailored to their preferences. Click here to learn more about Explore and the importance of content on demand.

‍

Lastly, reports are crucial for keeping developer training effective and engaging. They not only track progress and ensure compliance with security standards, but also identify gaps where developers can improve. This insight allows for tailored training that strengthens security defenses and keeps learning relevant and targeted. Reports also help justify the investment in training by demonstrating its impact, ensuring ongoing support for security initiatives. Overall, reports are essential tools for enhancing both compliance and developer engagement, keeping everyone on track and engaged in their learning journey. Be on the lookout for some exciting news around SCW reporting coming soon!

‍

To learn even more about recently released functionality, check out our latest product talk webinar or reach out to us today!

‍

Financial services institutions have strong reasons to ensure that the software code they use is secure. An obvious motivation, of course, is the need to protect their data from a breach, which can be costly in terms of leaked PII, cleanup expenses, fines and restitution, and damage to an organization’s reputation. Another ongoing reason is the need to stay in compliance with an array of industry and government regulations.

Because they handle so much sensitive, personal and financial information, as well as people’s money, financial services are a highly regulated industry. Depending on the services they provide, companies must comply with a mix of rules and requirements.

The Payment Card Industry Data Security Standard (PCI DSS) is well-known for its rules on protecting cardholder data, for instance. Requirements in the Sarbanes-Oxely Act govern financial records management. Companies that operate internationally are familiar with the Digital Operational Resilience Act (DORA), which is a binding risk management framework, and the global standards for fund transfers established by the Society for Worldwide Interbank Financial Telecommunication, known as Swift.

And laws such as the California Consumer Privacy Act (CCPA) and the EU’s General Data Protection Regulation (GDPR) set requirements for protecting the privacy and personal information of customers. There are others, such as regulations set by the U.S. Office of the Comptroller of the Currency (OCC) and the European Central Bank (ECB).

If that’s not enough, the National Cybersecurity Strategy states among other things that software makers should be held responsible for ineffective software security. And the Cybersecurity and Infrastructure Security Agency (CISA), alongside 17 U.S. and international partners, has issued guidance on Secure-By-Design principles for software development. 

A common thread for financial services companies is that secure code is a critical element in helping to meet the goals of those regulations that can help make demonstrating compliance with them easier. And it underscores why developers need training and upskilling to ensure that security is applied to code at the start of the development process.

As an example of how that works, let’s look at the newest version of PCI DSS.

Secure coding (and developer training) Is at the core of PCI DSS 4.0

PCI DSS 4.0, which became mandatory as of April 1, 2024, includes several substantial updates to PCI DSS 3.2.1—not least of which is an emphasis on the role developers play in ensuring secure software code.

PCI has long recognized the importance of secure software in the past. Version 2.0, which was released in 2017, included guidance for developers on ensuring secure transactions on mobile devices. The guidance in Version 4.0 now emphasizes applying security best practices to software development and includes some specific guidance on developer training. 

The requirements are often broadly stated, though companies may want to implement a more thorough approach.

For example, one requirement from Version 4.0 states that the “processes and mechanisms for developing and maintaining secure systems and software are defined and understood.” A good way to ensure that is true is for developers to receive precise training in the programming languages and frameworks they’re using in order to fill any knowledge gaps.

Another requirement states that developers working on bespoke and custom software must receive training at least once every 12 months, covering:

• Software security relevant to their job function and development languages.
• Secure software design and coding techniques. 
• How to use security testing tools—if they are being used—to detect vulnerabilities in software.

In reality, however, once a year isn’t frequent enough to address core security issues and break bad coding habits. Training should be continuous and measured, with a skills verification process to ensure it is being put to good use.

PCI DSS 4.0 includes more than a half-dozen other requirements that address areas such as preventing and mitigating various types of attacks, documenting third-party software components, identifying and managing vulnerabilities, and other security steps. In every case, organizations would be wise to thoroughly pursue those measures. Training on attack vectors should be frequent, rather than yearly. Third-party components, frequently a source of vulnerabilities, should be carefully inventoried through a Software Bill of Materials (SBOM) program. And organizations should be sure to have clearly defined roles for managing vulnerabilities.

The new version also gives organizations some flexibility in meeting its requirements, focusing on outcomes rather than checking boxes, while adding new requirements for authentication controls, password lengths, shared accounts and other factors. 

Compliance starts at the beginning of the SDLC

What these regulations have in common is that they attempt to set high standards for protecting data and transactions in the financial services industry. And, as in the case of the latest PCI DSS version, they are increasingly emphasizing the importance of secure code at the beginning of the software development lifecycle (SDLC). The National Cybersecurity Strategy and CISA’s Secure by Design principles also place responsibility for security with the makers of software—before it’s shipped—so that even companies that aren’t directly governed by financial services regulations need to comply.

Organizations need to bridge the gap that exists between DevOps teams (who are focused on speed of development) and AppSec teams (who are rushing to bring security into the process) by training developers to make security inherent to their approach. That requires a complex set of skills, however, that involves more than yearly training sessions or standard, stagnant educational programs can provide. Training should be continuous and agile, built to engage learners with active, real-world scenarios and delivered in small bursts that fit their work schedules.

Financial services companies need to ensure security to both protect against breaches and to stay compliant with increasingly stringent regulations. The costs of non-compliance can be as damaging as a breach in terms of the impact on a company’s reputation and monetary costs. IBM’s Cost of a Data Breach Report 2023, for example, found that organizations with a high level of non-compliance faced, on average, fines and other costs totaling $5.05 million—a half-million dollars more than the average cost of an actual data breach.

The continued growth of cloud-based environments and digital transactions has made the security of software in the financial services industry of paramount importance, something that regulations such as PCI DSS recognize. The best way to ensure secure software is through secure coding at the start of the SDLC. And the way to get there is by effectively training developers in secure coding practices. 

For a comprehensive overview of how secure coding can help ensure success, security, and profits for financial services companies, you can read the newly-released Secure Code Warrior e-book: The ultimate guide to security trends in financial services.

Check out the Secure Code Warrior blog pages for more insight about cybersecurity, the increasingly dangerous threat landscape, and to learn about how you can employ innovative technology and training to better protect your organization and your customers.

‍

The cybersecurity industry was once again placed on high alert following the discovery of an insidious software supply chain compromise. The vulnerability, affecting the XZ Utils data compression library that ships with major Linux distributions, is logged under CVE-2024-3094 and boils down to a backdoor deliberately inserted by a once-trusted volunteer system maintainer. Allowing remote code execution (RCE) in some instances if successfully exploited, it represents a high-severity issue with the ability to cause serious damage in established software build processes.

Thankfully, another maintainer discovered this threat before the malicious code entered stable Linux releases, but it still poses an issue to those who have started running version 5.6.0. and 5.6.1. of XZ Utils as part of Fedora Rawhide, and organizations are urged to patch it as an emergency-level priority. If this discovery were not made in time, the risk profile would make it one of the most devastating supply chain attacks on record, perhaps even eclipsing SolarWinds.

The reliance on community volunteers to maintain critical systems is widely documented, yet rarely discussed until high-impact issues such as this incident bubble to the surface. While their tireless work is essential to the maintenance of open-source software, this highlights the need for serious emphasis on security skills and awareness at the developer level, not to mention heightened access controls around software repos.

What is the XZ Utils backdoor, and how is it mitigated?

On March 29, Red Hat published an urgent security alert to inform users of Fedora Linux 40 and Fedora Rawhide that the latest versions of the “XZ” compression tools and libraries contain malicious code that appears to be purpose-built to facilitate unauthorized third-party access.How this malicious code was injected will likely be the subject of intense study in the future, but it amounts to a sophisticated, patient, years-long social engineering exercise on the part of the threat actor, a pseudonymous attacker called “Jia Tan”. This individual spent countless hours gaining the trust of other maintainers, making legitimate contributions to the XZ Utils project and community for over two years, eventually earning “trusted maintainer” status after multiple sockpuppet accounts eroded confidence in volunteer project owner, Lasse Collin:

‍

‍

This unusual scenario is a prime example of a highly technical person still falling victim to tactics typically reserved for use against those who are less savvy, showing the need for precision, role-based security awareness training. It was only for the inquisitiveness and quick thinking of Microsoft software engineer and PostgreSQL maintainer, Andres Freund, that the backdoor was discovered and versions rolled back, thus stopping what could have been the most devastating supply chain attack in recent memory.

The backdoor itself is officially being tracked as a vulnerability of the highest possible severity in NIST’s registry. Initially thought to allow SSH authentication bypassing, further investigation revealed that it enabled unauthenticated remote code execution on vulnerable Linux systems, including Fedora Rawhide, Fedora 41, Kali Linux, openSUSE MicroOS, openSUSE Tumbleweed, and some versions of Debian.

Jia Tan appears to have gone to great lengths to obfuscate the malicious package, which, when triggered to construct itself during the build process, hampers authentication in SSHd via systemd. As Red Hat detailed, in the right circumstances, this interference could potentially allow an attacker to break SSHd authentication and gain remote unauthorized access to the entire system.

‍

Microsoft, among others, has published comprehensive guidance on scanning systems for instances of the exploit and mitigating its effect, and the immediate action recommended by CISA is that affected developers and users should downgrade XZ Utils to an uncompromised version, like XZ Utils 5.4.6 Stable.

Preventing this attack type is incredibly difficult - especially when utilizing open-source components in software - as there is precious little assurance and transparency over the security of the supply chain. We've already combatted accidental flaws in the software supply chain, but this risk has elevated to include security bugs deliberately planted with malice to compromise open-source security.

Most developers will not be able to stop an attack of this nature unless they have a strong sense of security awareness, healthy security knowledge, and a sprinkling of paranoia. It’s almost a case of requiring a threat actor mindset. However, a chief consideration should always center around source code repos that are controlled internally (i.e. not open-source). These should only be accessible to people who have verified, relevant security skills. AppSec professionals might consider a setup like branch-level security controls, only allowing security-skilled developers to commit changes to the final master branch.

Volunteer maintainers are heroes, but it (should) take a village to sustain secure software

To those outside the realm of software engineering, the notion that a spirited community of volunteers painstakingly maintains critical systems in their own time is a difficult concept to grasp, but this is the nature of open-source development, and it continues to be an area of critical risk for security professionals protecting the supply chain.

Open-source software is a vital part of virtually every enterprise’s digital ecosystem, and trusted maintainers (of which most are acting in good faith) are truly heroic in their selfless pursuit of technological progress and integrity, but it is farcical to keep them delivering in isolation. In these DevSecOps-centric times, security is a shared responsibility, and every developer must be armed with the knowledge and right-fit tooling to navigate the security issues they are likely to encounter in their workday. Security awareness and hands-on skills should be non-negotiable in the software development process, and it’s up to security leaders to influence change at the enterprise level. 
‍

‍Build a thriving security culture in your organization today with in-depth Courses from Secure Code Warrior.

Software developers have shown they are ready and willing to make use of generative artificial intelligence (AI) to write code, and they have generally seen some favorable results. But there are also plenty of signs that they could be playing a dangerous game.

According to a recent survey by GitHub, more than 90% of U.S. developers are using AI coding tools, citing advantages such as faster completion times, quick resolution of incidents, and a more collaborative environment, which is something they feel is important. Working with AI tools allows developers to hand off routine tasks, allowing them to work on more creative jobs that benefit their companies and, not incidentally, reduces the chances of on-the-job burnout.

However, studies have also shown that AI tools have a propensity to introduce flaws when writing code. A survey by Snyk found that although 75.8% of respondents said that AI code is more secure than human code, 56.4% admitted that AI sometimes introduces coding issues. Alarmingly, 80% of respondents said they bypass AI code security policies during development.

Since OpenAI's ChatGPT debuted in November 2022, the use of generative AI models has spread with lightning speed throughout the code development process in financial services, as it has in many other fields. The fast emergence of other models, such as GitHub Copilot, OpenAI Codex, and a growing list of others, suggests that we have only scratched the surface of what generative AI can do and the impact it can have. But for that impact to be positive, we need to ensure that the code it generates is secure.

Coding bugs can spread quickly

Whether created by human developers or AI models, code is going to contain some errors. With AI helping to accelerate code development to meet the ever-increasing demands in highly distributed, cloud-based computing environments, the chances of bad code propagating widely before it is caught could increase. 

AI models being trained to write code will ingest thousands of examples of code that perform various tasks, and then they can draw on those examples to create their own code. But if the samples that it’s working from contain flaws or vulnerabilities—whether they were originally created by a human or another AI—the model could transfer those flaws to a new environment. 

Considering research has shown that AI models aren’t capable of reliably recognizing flaws in the code it’s using, there is little built-in defense against the spread of flaws and vulnerabilities. AI will not only make mistakes in coding, but it will repeat its own mistakes and those of other sources until the vulnerability is identified somewhere down the line—perhaps in the form of a successful breach of a company using the software it created.

The real defense against the proliferation of coding flaws is for humans and AI models to work together. Human developers should oversee AI code writing and serve as a check against unsecure coding practices and vulnerable code. But for that to happen, developers must be thoroughly trained in the best practices of secure code writing so they can identify coding mistakes an AI might make and quickly correct them.

The challenges of AI code creation and remediation

The sudden explosion of large language models (LLMs) like ChatGPT has been something of a double-edged sword. On one side, companies and everyday users have seen tremendous productivity gains from using AI to handle time-consuming, onerous, or difficult chores. On the other side, there have been plenty of examples of what can go wrong when blindly trusting AI to handle the work.

AI models have made glaring mistakes, demonstrated bias and produced flat-out hallucinations. In many cases, the root of the problem was inadequate or irresponsible training data. Any AI model is only as good as the data it’s trained on, so it’s essential that training data be comprehensive and carefully vetted. Even then, however, some mistakes will be made.

The use of AI for coding faces many of the same hurdles. Code generated by AI has been shown to contain a range of flaws, such as vulnerabilities to cross-site scripting and code injection, as well as attacks specific to AI and machine learning (ML), such as prompt injection. AI models also operate in a black box because their processes aren’t transparent, which prevents a security or development team from seeing how an AI reaches its conclusions. As a result, the model can repeat the same mistakes over and over. The same shortcomings that can affect code writing also carry over to using AI for code remediation and meeting compliance requirements. 

The potential for flaws being created or repeated by AI models has grown to the point that LLMs now have their own Open Web Application Security Project (OWASP) list of top ten vulnerabilities.

Developers and AI can work together to create secure code

Concerns about the potential flaws in AI-generated code might give some organizations pause, albeit briefly, about moving ahead with the technology. But the potential benefits are too great to ignore, especially as AI developers continue to innovate and improve their models. The financial services industry, for one, is unlikely to put the genie back in the bottle. Banks and financial services companies are technology-driven already, and they operate in a field where they’re always looking for a competitive advantage. 

The key is to implement AI models in a way that minimizes risk. And that means having developers who are security-aware and thoroughly trained in secure coding best practices—so they can write secure code themselves and closely monitor the code AI models produce. By having AI engines and human developers working together in a tight partnership, with developers having the final say, firms can reap the benefits of improved productivity and efficiency while also improving security, limiting risk and ensuring compliance. 

For a comprehensive overview of how secure coding can help ensure success, security, and profits for financial services companies, you can read the newly-released Secure Code Warrior guide: The ultimate guide to security trends in financial services.

‍

‍

Check out the Secure Code Warrior blog pages for more insight about cybersecurity, the increasingly dangerous threat landscape, and to learn about how you can employ innovative technology and training to better protect your organization and your customers.

‍

Recently I had the privilege of hosting a webinar where our very own CTO Matias Madou and with Mednd.io’s Sharon Kochevsky addressing Taking charge of vulnerability alerts. During the session they explored both the challenges and the solutions in handling security vulnerability alerts. In case you missed the webinar, here are a few key takeaways from their conversation. Of course, the webinar is also now on-demand here to get the full details. 

Impact of AI on security

Matias incorporated the analogy of self-driving cars to explain the current state of AI creating secure software. While self-driving cars can technically drive themselves they still face problems while on the road. For instance, he referenced one situation where self-driving cars encountered a problem on the road never encountered before and would ghost break as a result. Problems will come, and it’s the human technicians that need to resolve. Similarly, if developers blindly follow AI, errors in code and vulnerabilities could come into play.  

For AI to produce better output, Matias stressed the need for regularity and numerous good code examples to train developers on the AI models. While AI presently works well on generic frameworks, it falls short with real-world applications that operate on millions of code lines.

He further explained that seasoned developers could reap the benefits of generative AI for accelerated coding, but those not trained might pose a threat as they could reproduce and paste faulty codes at rapid pace. 

Shifting towards proactiveness

One topic that led the discussion was the shift towards proactive actions. Rather than keeping tabs on security issues, Sharon Kochevsky advocates for enterprises and AppSec programs to  take a more proactive approach with actual code fixes versus a reactive approach focused on security reporting. In line with Matias, he underscores the need to surpass purely administrative practices and focus on consequential outcomes. The panel also discussed primary areas of creating reports along with utilizing security products incorporated with real-time dashboards and issue tracking. 

Bridging the gap 

Sharon and Matias also identified a crucial problem that should get addressed: the disconnection between developers and security managers. Organizations and enterprises are now adding security champions to help bridge the gap. These are security pros located within the engineering team, and help promote proactive security measures.

Needless to say, we just scratched the surface on this topic and the conversation extends beyond these webinars; continuous discussion and engagement are crucial in our ever-evolving industry. If you would like to learn more or replay the session, it is now available on-demand.

‍

At Secure Code Warrior, our mantra has always been to provide hands-on agile learning experience for developers – delivering real-world, practical security training as part of their everyday work experience. We like to call it “learning by doing”. 

We know that targeted training geared towards what developers are working on at the very moment provides a rewarding experience that helps deliver even more meaningful results for companies – faster code releases that are battle tested, quality controlled and ready to ship to market in a timely manner. What enterprise doesn’t love the sound of that?  

We’re enhancing this experience through an exciting new integration with Apiiro, a leading application security posture management (ASPM) platform that empowers AppSec teams and leaders with the visibility they need to prioritize, fix, prevent, and manage application risks that matter.  Bringing our two platforms together, our integration delivers hyper-relevant context and real-time security training to developers as they remediate security risks, so they can learn without context-switching or leaving the familiar environments of the development tools they use every day.  

So how does this magic happen? Apiiro maps application security findings—detected by Apiiro or ingested by third-party security tools—to the relevant training by type and language in Secure Code Warrior, and then surfaces these via tickets, issues, or messages to the relevant developer or team. The integration between Apiiro and Secure Code Warrior minimizes disruptions to software development lifecycle by eliminating the need to take action in a separate tool at a different point in time. It’s just another way we are helping companies release quality code faster with improved developer efficiency.

To learn more about this new integration and partnership, check out Apiiro’s blog here.

‍

Have you been wondering what we have been up to lately in the world of new product innovation. We recently held a product talk session where we covered a variety of details. Be sure to check it out, but just to pique your interest, here’s a quick overview. Here we give an overview of our most recent releases and visionary roadmap for 2025. 

More ways to customize your educational paths

We listened and we heard you. We have made improvements dedicated to the developer experience, revolutionizing the way users can customize their educational paths. Challenges are overhauled, ensuring a seamless fixing stage while adhering to accessibility standards, and the Explore menu offers a diverse array of activities, promoting self-paced and interactive learning.

Bolstering the enterprise experience

In addition, we also drill down into enterprise-focused improvements that emphasize reporting, analytics, SCIM integration, and enhanced administration features. Streamlined reporting provides administrators with comprehensive insights, while SCIM automates user provisioning, simplifying onboarding and offboarding. The addition of "nudges" via email and Microsoft Teams rounds out the overall administration experience. 

What’s on the horizon

Finally, catch up on Secure Code Warrior’s vision for 2024, where we unveil six pivotal initiatives:

• Executive Value Benchmark Reporting and Comprehensive Program Reporting provide deep insights into company performance.
• Developer Empowerment focuses on enhancing self-led learning experiences.
• Increased Content Development Investment ensures a robust content library.
• Deep Integration with Code Repositories offers unparalleled insights into developer activities.
• Administrator Productivity Enhancement streamlines communication channels.

To delve deeper into these exciting developments, listen to the full recording and learn how to be part of shaping the future of Secure Code Warrior’s future innovations.

‍