Name: BSIMM15 Insights: Trends Shaping Software Security in 2025
Start: 2025-02-27T06:00:00Z
End: 2025-02-27T06:00:50.000Z
Location: BrightTALK

Black Duck is now defining the next frontier of application security. With the avalanche of AI-generated code plus expanding regulatory pressure, you need solutions that can scale, adapt, and keep pace with the demands of your business.

Black Duck meets the demands of modern software development with True Scale Application Security. In the cloud or on-prem, 100,000 lines of code or 100 million. For safety-critical systems with stringent compliance requirements or modern web apps deploying 100 times per day. Our flexible, scalable, high-precision solutions enable you to code with confidence.

AI coding assistants and open source AI models are revolutionizing productivity and innovation. But these new resources introduce a systemic challenge that impacts the entire pipeline. How do we embrace innovation without introducing invisible risk at astonishing scale? Does AI-enabled development threaten the value of the assets that drive your business? This session shows the results of a new study on this shared reality. It shows a way to get security and compliance done that doesn’t stop development teams.
We’ll address the main worries of technology executives and effective approaches to handling risks caused by AI. It's time to align development and security teams. You may ask how? Through integrated tools that make secure coding a natural part of daily workflows.
What’s in it for you?
• Gain exclusive insights from new research on AI adoption and its security implications
• Learn practical strategies to manage AI-generated risks in development pipelines
• Discover how to align Security and Development for frictionless, secure innovation

Secure or Sorry? What AppSec Leaders Must Know About AI Adoption

Open source software powers modern development—but it also introduces risks. From direct and transitive dependencies to container images, these risks can enter your applications in many ways, often without full visibility. 

Join this webinar to learn

• The common entry points for open source in your applications
• The risks of unmanaged open source, including vulnerabilities and license issues
• Best practices for securing and governing open source usage
• Tools and strategies for maintaining compliance and visibility

Whether you're a developer, security professional, or compliance lead, this session will help you build safer, more resilient software.

The Open Source Wildcard: Don't Roll the Dice on Risk

The tech M&A landscape is rapidly evolving with the pervasive integration of AI into target company applications. As machine learning, Generative AI, and other intelligent technologies become central to innovation, traditional software due diligence is no longer enough. This session addresses the critical new dimensions of risk and opportunity that AI introduces to acquisitions.

Join us for a practical framework designed to equip M&A principals and legal counsel with the tools to thoroughly assess AI-driven targets. We’ll dive into the essential areas you must explore, from evaluating model provenance and performance to navigating complex data governance and ethical considerations.

Key takeaways will include how-to effectively assess:

• AI Footprint: Understanding the strategic implementation and problem-solving capabilities of AI.
• Security Risks: Comprehensive data protection, access control, and penetration testing for AI systems.
• Legal & IP Risks: Clarifying model and training data ownership, alongside API terms.
• Quality & Reliability Risks: Ensuring performance, effective retraining, and model explainability.
• Regulatory & Compliance Risks: Navigating emerging regulations like the EU AI Act and critical data privacy concerns.

M&A's New Frontier: Assessing AI Software Risk in Your Next Deal

AI-enabled development tools and coding assistants are pushing CI pipelines, fueling innovation, and iterating business-critical software faster than ever before. Security teams are now forced to catch up. The burden to remedy AI tools often weak coding practices and to overcome their ignorance to third-party vulnerabilities and licenses is further complicated by developers' implicit trust in their output and an intrinsic incompatibility between AppSec and Dev teams' primary role: to ship functional code quickly.  

Enterprises can no longer treat development and AppSec workflows as separate entities. To unify them, however, requires fast, reliable, automated ways to evaluate every line of code that flows through the pipeline and to provide immediate access to fix methods. This only manifests with integrated security gates across CI/CD pipelines, aligned to risk-tolerance standards and optimized to maintain the speed benefits of AI-enabled development.  

Join us as we analyze DevSecOps in the age of AI and structure a viable strategy that accounts for:  

- Software security and license compliance issues introduced, at speed, by AI coding assistants  
- The dissonance between the adoption of AI-enabled dev tools and AppSec's preparedness to secure their output  
- Business priorities that span development, security, legal, and executive requirements

AI's IOU: Maximizing value from AI without paying for it later

With software development accelerating in the AI era, there are even more sources of vulnerabilities to track. Managing this is an enormously complex task, as organizations are already struggling to unify data across disparate tools for testing, SCM, and reporting. As more organizations adopt AI-assisted development, existing issues with fragmented risk visibility will only get bigger. 
 
In this webinar, you will learn about capabilities for achieving a high-fidelity, organizational view of risk posture to better streamline auditing, visualize AppSec gaps, and identify your most vulnerable software. We will talk about necessary capabilities for aggregating key sources of data, standardizing risk scoring, and how you can set up the right technical foundations for success.

Contextualizing Risk in the Age of AI Development

AppSec teams are being stretched to the limit trying to keep up with the pace, volume and complexity of modern application development. Current trends in software development – the transformative role AI, the increasingly complex and vulnerable software supply chain, and the mounting requirement to both scale and focus security issue remediation – help shed light on what measures organizations need to put in place to stay ahead.     

In this session we will outline these trends and provide data and insights from our research into them. We will also outline practical steps you can take now to position yourselves to manage the evolving requirements of Application Security.

The State of AppSec & Beyond

Join two of our cybersecurity experts for a lightning round that cuts through the hype and addresses the immediate challenges of AI in software development. We'll explore the paradigm shift that is reshaping creativity and problem-solving in development, the new frontier of AI-influenced software risk, and discuss ways in which AI coding assistants and open source AI models form the next evolution of the software supply chain crisis.
 
This session charts a course from high-level business concerns directly to the developer experience, examining:
- The business and contractual liabilities that arise when AI-generated code enters your products.
- New, instinct-driven "vibe programming" and the debate over whether this emerging methodology is a sustainable path to innovation or a source of unpredictable risk.
- How AI coding assistance alters hiring strategies and the critical role of code review by security-capable developers in an AI-driven workflow.
- Emerging attack vectors tied to the growing use of open-source AI models.
- Viable paths forward to harness the power of AI, manage its inherent risks, and minimize organizational disruption by establishing resilient and scalable safety nets within your pipeline.

AI-Assisted Disruption: How Change Impacts Dev and Sec as Organizations Pivot to AI

Application security hasn’t gotten any simpler—especially as AI accelerates the way software is built. More code, more complexity, and more fragmented tooling make it harder to answer a basic question: Where are we exposed?  

This session explores how teams can regain clarity at the first step of any risk management program. That means identifying what’s running, what’s been tested, and what needs attention. We’ll look at how automation, speed, and policy can work together to improve visibility without slowing delivery.  

As part of Black Duck’s broader approach to application risk management, we’ll also show how solutions like Black Duck Polaris™ Platform scales with the way modern teams build software.

Identifying Risk in the Age of AI-Assisted Development

Security is the result of implementing the tools, personnel, and insight necessary to make informed decisions to mitigate risks within the software you create and the assets you consume through the software supply chain. While this process can be elaborate, rapid releases and CI/CD methodologies require that AppSec move at the speed of DevOps.

Achieving this is only possible with integrated controls and mechanisms to detect, prioritize, and address security issues at every stage in the SDLC and CI/CD pipelines. But how do you get there?

Join us as we recommend ways to establish security within DevOps without sacrificing efficiency. We’ll discuss:
- Pitfalls that can derail an organization’s AppSec initiative
- Strategies for overcoming obstacles to efficient, effective DevSecOps
- Recommendations for realizing integrated DevSecOps at scale

Integrating AppSec for Efficient DevSecOps

AI technologies are compelling teams to accelerate software development and to explore innovations previously regarded as unattainable. While 67% of organizations use AI coding assistants at least weekly to realize these goals, 57% feel that using AI coding assistants has introduced new security risks or has made it harder to detect issues in their codebase. AppSec teams are scrambling to keep pace.  

Join us for an in-depth exploration of today's DevSecOps landscape based on our yearly Global State of DevSecOps report and findings from independent research institute, SANS. We'll examine the delicate balance between AI-assisted development and modern DevSecOps strategies, focusing on: 
* The impact of AI coding assistants on development pipelines and security workflows 
* How AI-ready organizations maximize AppSec coverage and agility 
* The evolution of traditional application security testing (AST) to AI-enabled AST 
* Prerequisites for a scalable, robust DevSecOps program purpose-built for AI-enabled development

From Code to Security: The DevSecOps Frontier

Securing your software supply chain begins with knowing what’s in your code. With AI-generated code and ubiquitous open source software use, it’s never been more critical to understand what risks your software may contain. In fact, last year alone we found that 81% of codebases contained a high-/critical risk vulnerability.
 
Join this webinar as we explore the findings from the 2025 “Open Source Security and Risk Analysis” report. We’ll cover:
 
• The state of open source software security
• Tips for mitigating risks and keeping vulnerabilities out of your supply chain
• How to protect against security and IP risks from AI coding tools

The 2025 Guide to Open Source Security and Risk

Evaluating a target’s software development process, software architecture, and code quality are becoming a must do in M&A software due diligence. Acquiring poorly designed software or buggy code could derail your post-close plans. 

Join this webinar to learn how to sidestep the tech debt trap. We’ll cover: 

      - The dimensions of software quality 
     - Norms for typical tech M&A targets 
     - How to uncover and mitigate tech debt and post-close “gotchas” 
     - Software due diligence best practices around software quality

Avoid Buggy Deals: Evaluating Software Quality in M&A Due Diligence

There are three regulations that every software development team should be aware of: NIST Secure Software Development Framework (SSDF), the EU Cyber Resilience Act (CRA), and the FDA Cybersecurity Requirements for Medical Devices. What’s your regulation IQ? 

Join this webinar to learn how to navigate these regulations to secure your software supply chain. We’ll cover:  

- Key requirements, commonalities, and differences across the three regulations  
- The importance of an SBOM in dependency tracking and risk management 
- Best practices for complying with these cybersecurity standards  

Register now.

How to Navigate NIST, CRA, and FDA Regulations

Software is essential in everyday products like cars, medical devices, airplanes, and IoT devices. Bugs and security flaws can have serious impacts on safety, the environment, and your reputation. As AI speeds up software development, it's more important than ever to keep your policies, coding standards, and testing up to date.

In this webinar, we’ll discuss:
- Trends that offer innovation but also increase the risk of costly errors
- Updates to functional safety standards that improve software reliability
- How to reduce supply chain risks by getting a full view of your software
- Strengthening software with thorough testing techniques

Register now to learn practical tips for creating secure, reliable functional safety software in 2025 and beyond.

Building Safe and Reliable Software in 2025

Developers have utilized source code management (SCM) tools since the 1980s to track, control, and manage changes across the software development life cycle. But the use of SCM tools is even more widespread now due to the emergence of distributed version control systems such as Git.

For DevSecOps though, it is essential to seamlessly integrate application security testing (AST) into the SCM environment, without compromising on fidelity and scalability. This gives organizations complete control over AST in their CI/CD pipelines.

What you'll learn:
- Onboard new projects easily from GitHub
- Get a centralized view of all your projects
- Orchestrate AST within GitHub actions & workflows
- Monitor all of your GitHub organizations continuously

Getting high fidelity AppSec results within your SCM environment

The Bridge CLI, Coverity CLI, and cov-build offer different ways to run your Coverity Static Analysis.  Join us as we explore how these tools complement each other and help you discover the right one for your CI/CD pipelines, pull request workflows, and ad-hoc scans. This session will include a live demonstration followed by a brief Q&A.  This webinar is targeted for developers, DevOps, or anyone responsible for configuring Coverity Analysis.

The CI/CD Plugin Playbook: How Bridge CLI, Coverity CLI, and cov-build Fit Together

Any tech acquisition target worth its salt is not only using generative AI tools to write code, but also incorporating AI technology into its products. As AI transforms these companies’ applications, and how they develop them, potential investors and acquirers face a new set of risks and questions. 

Join our panel of tech lawyer/AI experts for sage advice on how-to up your software due diligence game. Whether you’re an acquirer, an investor, or expect to be on the sell-side one of these days, learn about:

• The evolving state of risks associated with non-human written code
• Important considerations for integrators of AI models, evaluating the chain of custody and legal hygiene of datasets
• How due diligence is evolving to help investors and acquirers assess and plan for risks
• Market reps and warranties to complement derisking through due diligence 

Register today.

Intelligent Software Due Diligence in the Age of Artificial Intelligence

Join us for an exclusive insider session! We’ll explore the latest trends and challenges in embedded software development. “The State of Embedded Software Quality and Safety” report uncovers key issues in the industry. It highlights the fast rise of AI, potential new risks to software quality, and a shift in what’s driving Software Bill of Materials (SBOMs) requirements.

Here's what you can expect to learn
• How “shadow AI” introduces new risks to governance, security, and IP
• The evolving skillset required for modern embedded developers
• The rising demand for SBOMs as a commercial requirement
• Strategies for balancing speed and quality in software development
• How leading organizations are managing the risks associated with AI and open source software

Get key insights into embedded software development. You'll learn to handle quality, safety, and security in an AI-driven world.

The Rise of AI and New Risks to Embedded Software Development

Security teams face a rapidly expanding attack surface given a multitude of factors-- AI-assisted coding, distributed architectures, and hybrid environments. The complexity of integrating security testing with DevOps locks security teams in a constant struggle to keep up with rapid releases and emerging threats. 
In this webinar, we will cover how Black Duck Polaris™ Platform integrates security into every step of the development process, from quick pull request scans and real-time developer feedback to continuous monitoring and automated workflows. You'll learn how AI and natural language analytics enable early risk detection and resolution, making security testing simpler and more efficient. See how top companies are using Polaris to enhance compliance and manage risk across thousands of applications, all while driving innovation. Don't miss this last session of our three-part series to stay ahead of the AI game.

Scaling Application Security in the AI Era: Reducing Risk Without Slowing Innovation

CISOs must ensure their organizations comply with various cybersecurity regulations and industry standards. Each industry has its own hodgepodge of requirements and states are beginning to roll out their own regulatory mandates. Would adopting a risk management framework help you prioritize and address risks and achieve compliance? How can your enterprise satisfy auditors that sensitive data is being handled securely? And how can you prove that to regulators following a breach? In this webinar, experts discuss the impact of tightening compliance and privacy rules — and enforcement — on the way enterprises approach cybersecurity, and how you can meet their requirements going forward.

During this webinar you will: 

- Get an overview of the shifting regulatory environment  
- Hear how organizations are using tooling to tackle regulatory challenges 
- Get best practices for avoiding enforcement actions from regulators

How CISOs Navigate the Regulatory and Compliance Maze

Modern software development has completely transformed the way organizations operate and compete in the market. With the attack surface growing exponentially and the software supply chain becoming more complex due to developments like the rise of AI and increasing regulatory pressure, organizations are struggling to keep pace. 
 
In this webinar, learn how to remove complexity and ease the resource strain associated with securing modern software through consolidation initiatives. Join us with Accenture Security and Enterprise Strategy Group for a roundtable discussion on
 
• Key trends and core challenges associated with security tool proliferation
• Blueprints for taking a consolidation initiative beyond TCO to improving overall risk management
• Key learnings from actual customer consolidation journeys

AppSec Optimized! A Guide to AppSec Tool Consolidation

Explore key insights from the “2024 Vulnerability Snapshot” report, which is based on data from over 200,000 application security scans. This webinar will explore critical findings, such as the prevalence of injection vulnerabilities, and highlight evolving threat landscapes impacting organizations today. Our expert panel will also discuss how strategic use of dynamic application security testing (DAST) and other methodologies can address these challenges. 
 In this webinar you will learn
• Emerging threat patterns and which vulnerabilities pose the greatest risk across industries
• Why DAST is essential for uncovering complex, runtime vulnerabilities that traditional testing might miss
• Practical recommendations, backed by comprehensive data, to enhance your security practices
 Join us to deepen your understanding of today’s security landscape and learn how data-driven insights can inform better security decisions.

Essential Vulnerability Insights for AppSec

Do you want to secure your software at scale? An application security posture management (ASPM) solution could be the answer. Maintain a strong security posture —and ensure compliance with industry standards and regulations—by gaining visibility into your applications.

Join us for a panel discussion where we share steps for securing applications. You'll learn

• Real-world use cases: Discover how regulatory-heavy industries and large enterprises use ASPM to address security challenges

• Operationalizing testing: Gain insights into how security teams can use ASPM to automate and operationalize security testing

• Maturing your AppSec program: Learn practical steps to enhance your AppSec program with ASPM

Don't miss the opportunity to learn how to be proactive in risk management.

Secure Application Software at Scale

Join us as we explore how to scale application security in today's dynamic development environments. Don't miss this opportunity to uncover actionable strategies for managing software risk. Learn to achieve scalable application security in today's fast-paced development landscape.

What You'll Learn
- How to streamline application security and maximize insights for improved outcomes
- Techniques to optimize processes, enhance collaboration, and deliver secure software without sacrificing development speed
- Why leveraging an Application Security Posture Management (ASPM) solution can help standardize AppSec practices across diverse tooling, teams, and applications within your organization

4 Steps for End-to-End Software Risk Management

AI coding assistants, such as Microsoft CoPilot and ChatGPT, will fundamentally change the way teams build software, much like open source software has over the last decade. As with open source, teams seeking the benefits of AI will also need to take precautions to address the security, quality, and intellectual property risks that come with the use of AI-generated code. Is your team ready for AI? 

In this webinar, we'll explore: 

Key risks teams might encounter using coding assistants 

Safeguards needed for confident use of AI-generated code

Keeping Pace: Managing the risks of AI-generated code

APIs have become central to the daily operations of most businesses. Their rapid proliferation has exposed significant vulnerabilities that need immediate attention. This presentation provides an in-depth assessment of the current state of API security. We discuss the growth of API-related incidents and provide a framework for improving API security within organizations.

Join this webinar to learn about
• API security challenges due to the increase in API usage, and the resulting vulnerabilities
• Proactive security integrations for incorporating security measures throughout the entire API development life cycle
• A framework for enhancing API security to protect against emerging threats

Elevating API Security: A Structured Approach

With the cost of cyberattacks predicted to cost $10.5 trillion by 2025, the European Commission is looking to transform the cybersecurity landscape through the Cyber Resilience Act. The goal of the CRA is to “bolster cybersecurity rules to ensure more secure hardware and software products.” But what does that mean for those of us already involved in AppSec?

Join our experts as they discuss how AppSec professionals may be impacted by CRA as it exists today. Specifically, we’ll explore: 
- Which products may be subject to the CRA based on the definition of “digital elements”
- What impacts this could have on software supply chain moving forward
- How you can assess your AppSec programs to see where you stand with CRA as defined today

The CRA is currently a draft, as such opinions and insights from presenters are subject to change.

What the EU Cyber Resilience Act Means for AppSec

Learn about OWASP as an organization and its key projects, and dive into the evolution and process of building the OWASP Top 10 list. Learn whether this list should be considered a one-size-fits-all standard for application security and how to use it for your application security activities. We will also discuss if there are any other alternatives.

The key takeaways from this talk include

· What OWASP and the OWASP Top 10 list are
· How the OWASP Top 10 list is defined and monitored
· How to use  the OWASP Top 10 list for your application security activities

OWASP Top 10 | Understanding IT and Using IT

Boost business success with modernised application security in today's digital era. As businesses shift to cloud software it's essential to find effective solutions for development and testing. Our advice: Build a robust AppSec solution. You might ask yourself how? We’ll share some insightful real-world examples of successful app security implementation. 

  

Join the webinar to explore: 

- key components of modern application security 

- empower developers for quick code scanning 

- discover strategies for identifying and mitigating vulnerabilities

Effective Cloud-based Application Security Practices for Modern Development

Companies adopt many application security testing (AST) tools to pinpoint where critical fixes are needed and avoid costly postproduction software issues. Yet despite a lot of AppSec investment, they still fail to get an accurate view of risk, and struggle integrate testing, triage, and remediation within developer workflows. This has driven the evolution of application security posture management (ASPM). 

In this session, we’ll dive into 
- The difference between application security orchestration and correlation (ASOC) and ASPM
- The capabilities that a comprehensive ASPM solution should have
- How ASPM can help your development and security teams mitigate software risk at scale

What is Application Security Posture Management (ASPM)?

The growth of software across every industry poses significant challenges for teams that need to keep up with the fast pace of innovation while making sure the software they put into production is secure. This has led to a proliferation of tools deployed by security teams. You may ask why? In simple terms, to tackle the increasing pressure of a larger and more sophisticated threat landscape. Ultimately, teams are now left with added complexity and friction in the SDLC and a bloated total cost of ownership (TCO).  

As a result, Gartner indicates an increase in organizations pursuing vendor consolidation from 29% in 2020 to 75% in 2022 to tackle the cost and complexity of present day AppSec programs. But, consolidating vendors is only one part of the equation. 

Join us, as we unlock the key to mastering software security in the era of rapid innovation. We delve into a differentiated approach to consolidation initiatives that extends beyond improving TCO.  

Join now and understand how to: 

- Streamline tools & processes to improve resource efficiency. 
- Focus your teams with prioritized risk data across your security program. 
- Deliver rapid, comprehensive risk insight for improved time to audit.

How to Improve AppSec Efficiency

Understanding the complexities of production testing is essential for any robust security strategy. Although conducting dynamic application security testing (DAST) in live environments is challenging, it is vital for ensuring application safety. This webinar bridges the gap between the daunting nature of production testing and its benefits.

Join our panel of experts to learn
- Common vulnerabilities that persist in production environments
- How to overcome challenges in configuration changes and supply chain vulnerabilities
- Real-world examples of how organizations have navigated these complexities

Secure Your Frontline: Start Continuous DAST in Production

In January, the EU published the final version of the Cyber Resilience Act (CRA). While this won't come into force until late 2026, there are still actions you can take.  

The good news is most of what's required is already part of a mature modern AppSec programme.  

In this session we’ll cover some of what DevSecOps and product security teams should be planning for to address CRA, with lessons drawn from efforts present in highly regulated spaces in other jurisdictions.

What the CRA means to DevSecOps Teams

Organizations continue moving their business applications and services to the cloud. With this shift, you need solutions that can keep up with your development, deployment, and testing needs without breaking the bank. Moving to cloud-based application security testing (AST) solutions has often meant having to choose between breadth, ease-of-use, and scalability. That changes now.

Polaris® Software Integrity Platform provides all the benefits of a cloud-based solution without having to make compromises on the breadth, depth, or scale of their testing. In this webinar, we’ll give you a tour of the future of AppSec and discuss how you can

- Embed continuous security in your development, QA, and DevOps workflows
- Manage security testing across teams, applications, and scan types 
- Gain a comprehensive view into your portfolio and project AppSec risks

It’s Time for AppSec to Evolve

Securing software takes teamwork—a unified approach from development through testing and into production. But each team has a distinct set of requirements and workflows that need to align to realize a concerted push for security. And while developers influence risk posture, they are often not trained in or focused on software security practices.

How can you make the effort that developers and DevOps teams are already putting in more valuable to the business? What's the best way to cultivate highly security-conscious developers so your software becomes more secure over time? Is there a way to derive tangible benefits for the business, the team, and the individual?

Join us as we break down a five-step process with real-world applicability. Topics include

• The critical distinction between developers' security awareness and their security capability
• Mechanisms to automate risk detection and accelerate remediation across the pipeline, including at the developer desktop
• How to establish security gates in DevOps pipelines in a way that doesn't derail development or lead to missed shipping deadlines
• How to create a DevSecOps initiative that can evolve with the business and enable developers to sustain security requirements as part of their day-to-day
• Ways to maximize security's value to the business and its customers

AppSec Automation: Five Steps to Achieving Developer-First Security

Join us for an insightful webinar that explores the dynamic landscape of application security. Learn about the alarming rise of supply chain attacks and the shifting tide of high-severity vulnerabilities, as well as the impact of these trends on organizations worldwide. Discover actionable strategies to combat these threats, including the importance of tool consolidation and fostering security champions within your teams. We'll cover
 
• The implications of supply chain attacks
• Effective tool consolidation strategies
• Empowering security champions to strengthen your defense

Securing Tomorrow - Navigating Trends in Application Security

Vulnerabilities pose a vast threat to the security of software, systems, and users, and the number of vulnerabilities discovered is increasing year-on-year. Understanding the life cycle of vulnerabilities can help you track, manage, and mitigate these threats effectively. 
 
In this session, you'll gain
• Knowledge of the life cycle of a vulnerability, including examples
• An understanding of why managing vulnerabilities at each stage is crucial
• Awareness of how vulnerabilities are handled in the public and private domains
• Insight into the methods used to manage and fix vulnerabilities

Life Cycle of a Vulnerability

Just over a year ago, OWASP refreshed its list of the top 10 vulnerabilities. Broken access controls moved up four spots to top the list, and it is followed by cryptographic failures, and injection. Three new vulnerabilities made their debut in the new list.
In this webinar, we will discuss the findings of the 2023 “Software Vulnerability Snapshot” report and see vulnerability trends from the past three years. We will also compare vulnerabilities discovered to the OWASP Top 10 list. Additionally, we will cover
• Vulnerability trends, especially critical- and high-severity vulnerabilities
• Danger from third-party software libraries
• Best practices employed by leading software security programs to manage AppSec risk

Securing the Future: Emerging Trends in Application Security

Security at Every Stage: Integrating AppSec for Efficient DevSecOps

Securing today's applications requires a new approach.

You need to deliver new applications and API’s, fast. Unfortunately, this “need for speed” can lead to vulnerabilities in software code. Once discovered in production, so begins the process by which SecOps and DevOps work to fix the vulnerabilities in runtime applications.  Unfortunately, SecOps and DevOps teams have historically operated independently, establishing their own processes, tools and KPI’s which can create roadblocks.

For an organization to truly develop and deploy secure applications, they need to move beyond traditional methodologies and adopt a new approach – one that bridges the gap between security operations and development.

Join us as we discuss how the Modern AppSec Framework delivers a functional plan your organizations can use to develop and deliver secure applications, regardless of where you are in your security or application development journey.

Register now to learn how the Modern AppSec Framework can take your application security program to the next level.

A Modern Approach to Application Security

Despite significant investment in AppSec tooling, staffing, and maintenance, organizations are unable to adequately secure their software. There is a lot of complexity in managing disparate tools, and not having the means to make testing well integrated or repeatable makes it difficult to get an accurate picture of software risk posture. At large, these factors downgrade the value of AppSec programs.

To achieve AppSec efficacy, security leaders need a way to standardize testing, triage, and remediation processes, all while continuously assessing software compliance, regardless of where source code resides or how it was built. This is where an Application Security Posture Management (ASPM) solution comes in.

In this session, you will:
- Understand how ASPM can help with issue identification, triage, and software compliance, from IDE to runtime testing
- Learn tactics to standardize issue detection, prioritization, and risk assessment through a centralized policy
- Discover how ASPM can help maximize the value of your existing AppSec investments and drive software resiliency at scale

A Practical Guide to Scaling AppSec with ASPM

The proliferation of software across every industry poses significant challenges for teams that must both keep up with the fast pace of innovation and ensure that the software they build is secure. This has led to security tool sprawl, unnecessary complexity, increased operational costs and in many cases, a decreased ability to quickly assess risk. As a result, many organizations are looking to consolidate the number of security tools and vendors they manage to improve resource efficiency and overall risk posture.
 
In this webinar, we will discuss the key things necessary to capitalize on consolidation initiatives beyond a simple reduction of tools, and provide a roadmap for how organizations can realize these benefits rapidly.

Reduce Complexity & Improve TCO with AST Vendor Consolidation

You’ve automated security tooling in development pipelines and your organization has moved to agile practices, but you are still not experiencing the DevSecOps promise land you were told about.

The three pillars of DevSecOps are people, process, and technology. Have you invested enough into your people? Without a bridge between the security and the development teams, all your hard work can get stuck in mud. 

A Security Champions program can help enable your teams reduce process friction and ensure successful adoption of security within developers’ daily work. This talk will address 

• Common challenges organizations experience
• Ways a Security Champions program can help
• Getting started with building your Security Champions program

Enable your DevSecOps Initiative with Security Champions

Software security is a large and complicated topic, with a bevy of acronyms and inconsistently applied terminology.

In this webinar, Jonathan Knudsen clears the air by providing a bird’s-eye view of software security. You will learn what application security is and what it is not. Topics include

- How the sausage is made
- Which vulnerabilities are most common
- What the secure software development life cycle entails
- What is in the toolbox

AppSec vs. NetSec

What differentiates a highly mature threat modeling program from a less mature program? How do companies get started with threat modeling? What does the journey to higher levels of maturity look like? What are the key anchors of building the threat modeling capability? 

Join our talk as we share what we've learned through the years working with clients. Find out how companies evolve their threat modeling programs and maturity.

Threat Modeling Program Maturity – Establish and Mature Threat Modeling Programs

Simplify AppSec Risk Management

The latest “Building Security in Maturity Model” (BSIMM) report, based on data from 121 firms, reveals critical trends shaping the future of application security. Since its start in 2008, the BSIMM report has been a trusted resource for organizations navigating the challenges of securing software.

This webinar will dive into the key findings of BSIMM15, including
- The transformative role of AI/ML in software development and security
- Managing risks in the increasingly vulnerable software supply chain
- The surprising decline in security awareness training
- How the “shift everywhere” approach is evolving to meet the needs of emerging technologies

Join us to uncover actionable strategies to strengthen your application security program in an era of rapid change.

BSIMM15 Insights: Trends Shaping Software Security in 2025

Data Analysis

Application Security

Cyber Security

Software Development

Risk Management

Risk Framework

Risk Analysis

Supply Chain

Vulnerabilities

Vulnerability Management

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

Get powerful market trends insights that are shaping the M

Mergers and Acquisitions

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

BSIMM15 Insights: Trends Shaping Software Security in 2025

Presented by

About this talk

Black Duck