• How well are developers approaching security? Depends who you ask. 72% of software developers say they are very security-conscious in their roles while only 50% of CISOs rate software developers as very security-conscious.
  • Developers report security teams don’t understand a crucial security surface area: container images. Only 43% of developers believe that CISOs are “very familiar” with how container images fit into their work, which is low when compared to other aspects of how developers perceive their security team to understand their work: open-source software libraries and projects (61%), source code repositories and source code management systems (60%), and software build tools (59%).
  • Despite disagreements on how each team views the other’s security prowess or understanding of tooling, software supply chain security is a top priority for developers and security teams alike. The report found that 92% of developers say software supply chain security is at least very important to their day-to-day work and development processes, with 39% marking it as absolutely essential. Ninety-three percent of CISOs noted effective software security as a critical component of their organizational maturity and threat / risk mitigation strategy, and 96% say effective software security practices are important to meeting government or regulatory requirements.
  • A concerning percentage of developers and CISOs report vulnerability scanning false positive fatigue. The report found that 36% of CISOs and 34% of developers report that an overwhelming number of scanner false positive vulnerability alerts are among the biggest obstacles an organization faces in ensuring software supply chain security. Both groups also cite consumption of vulnerable software and a lack of cohesion between CISOs and developers as main obstacles to software supply chain security.
  • Collaboration and communication between CISOs and developers is lacking, but there is strong alignment on desired business outcomes. CISOs (69%) and developers (64%) agree that lack of communication and collaboration between developers and security teams is a problem. Despite the tension present, both teams agree that it is absolutely essential that best practices and tooling in software security result in certain business outcomes, including customer retention (43% and 40%, respectively), meeting or satisfying procurement contract obligations (36% and 32%), fewer breaches or compromises (34% each), and developer / engineer productivity (32% and 34%).