AppSecure.nrw Software Security Study

TL;DR

This study investigates the state of software security in German companies, revealing challenges like low awareness and lack of competence that threaten the security of software products.

Contribution

It provides empirical insights into the gaps and challenges in secure software development practices among German companies.

Findings

Low awareness of security issues among stakeholders

Inaccurate self-assessment of security practices

Lack of competence in secure development

Abstract

In recent years, the World Economic Forum has identified software security as the most significant technological risk to the world's population, as software-intensive systems process critical data and provide critical services. This raises the question of the extent to which German companies are addressing software security in developing and operating their software products. This paper reports on the results of an extensive study among developers, product owners, and managers to answer this question. Our results show that ensuring security is a multi-faceted challenge for companies, involving low awareness, inaccurate self-assessment, and a lack of competence on the topic of secure software development among all stakeholders. The current situation in software development is therefore detrimental to the security of software products in the medium and long term.