Black Duck BSIMM16 Finds AI and Regulation Reshaping Software Security Programs

Article Details

Publisher

BlackDuck

Scope

Observational benchmarking of software security initiatives across industry verticals using 128 activities in 12 practices and four domains.

Sample Size

111 organizations; business-unit assessments are excluded from the annual report data pool.

Key Statistics

• Incident-response integration was observed in 87.6% of the 111 organizations, making it the most frequently observed BSIMM16 activity.
• Responsible vulnerability disclosure streamlining increased by 15 observations and more than 40% compared with BSIMM15.
• Automated verification of operational infrastructure security grew by more than 50% compared with the previous year.
• Security champions programs were present in 90% of the highest-scoring group, compared with 22% of the lowest-scoring group.
• Median software security group size was 10, compared with an average of 33.5 across the 111 firms; the report cautions that large outliers affect staffing statistics.

Recommendations

• Benchmark the software security initiative with a BSIMM scorecard and create a prioritized improvement plan aligned with business risk.
• Maintain regularly updated inventories covering applications, third-party code, SBOMs, APIs, scripts, and infrastructure-as-code; favor automated discovery and management.
• Establish cross-functional standards for AI/ML adoption, use application risk rankings to restrict AI-generated code where appropriate, and require automated SAST scans alongside human-driven testing.
• Extend software supply chain risk management to AI/ML services, including documented shared responsibilities, vendor privacy and security SLAs, and rules governing data sharing and training data.
• Streamline vulnerability intake and involve software security experts in incident response, using operational findings to improve development controls.