More than half of the 1200 developers in APAC, Europe and North America surveyed during December 2021 were unable to ensure that their code is protected from seven common vulnerabilities.

The problem, of course, is competing priorities. Almost a quarter (24%) cited the need to meet deadlines (24%), while 20% said developers are not given enough training or guidance on how to implement secure coding by their managers.

Worryingly, only 29% said they believe the active practice of writing code free of vulnerabilities should be prioritised.

The value of training related to secure coding can be seen in the finding that 81% of developers said they use the knowledge gleaned from training on a near-daily basis.

Yet 67% are still knowingly shipping vulnerabilities in their code.

One in four developers said they want more training guided by self-paced multimedia, and one in five think industry certifications would improve the perception of training.

Among the other findings, 33% of developers don't know what makes their code vulnerable, 30% think in-house security training would most be improved if it were more practical and included real world scenarios and outcomes, and the biggest concern of 30% of respondents is vulnerabilities introduced by co-workers.

"Developers want to do the right thing, and while they are starting to care more about security, their working environment doesn't always make it easy for them to make it a priority. Often, the tools at their disposal - and methods they are deploying - result in 'getting by', rather than actively reducing risk, and their priorities remain misaligned with the security team," said Secure Code Warrior co-founder and CEO Pieter Danhieux.

"While organisations encourage secure coding practices, developers are unclear on how they are defined in their day-to-day work, and what is expected of them. To reach a higher standard of code quality, organisations must formalise secure coding standards as they apply to developers, and guide a change in behaviour that reinforces good coding patterns and enables security at speed."

More information about the State of Developer-Driven Security 2022 survey is available here.