Name: BSIMM15 Insights: Trends Shaping Software Security in 2025
Start: 2025-02-27T06:00:00Z
End: 2025-02-27T06:00:50.000Z
Location: BrightTALK
Rating: 0

Black Duck® offers the most comprehensive, powerful, and trusted portfolio of application security solutions in the industry. We have an unmatched track record of helping organizations around the world secure their software quickly, integrate security efficiently in their development environments, and safely innovate with new technologies. As the recognized leaders, experts, and innovators in software security, Black Duck has everything you need to build trust in your software.

There are three regulations that every software development team should be aware of: NIST Secure Software Development Framework (SSDF), the EU Cyber Resilience Act (CRA), and the FDA Cybersecurity Requirements for Medical Devices. What’s your regulation IQ? 

Join this webinar to learn how to navigate these regulations to secure your software supply chain. We’ll cover:  

- Key requirements, commonalities, and differences across the three regulations  
- The importance of an SBOM in dependency tracking and risk management 
- Best practices for complying with these cybersecurity standards  

Register now.

Software Supply Chain Security: Navigating NIST, CRA, and FDA Regulations

Leverage the power of policies to flag non-compliant components. With Black Duck SCA policies, create your own rules to determine 'non-compliance'. Join us in this webinar as we explore what policies are, how to configure them and how we can use them within our Black Duck SCA scans.

Black Duck SCA - Policy Management

Open source is widely used in software development because it allows you to create high-quality software quickly - especially with the use of AI-assisted coding tools. But if left unmanaged, open source can lead to license compliance issues as well as security and code quality risks. Whether you’re on the buy side or sell side, these risks could negatively affect valuation in an M&A transaction.

Join this webinar for an inside look at the data Black Duck Audits complied in 2024 from the hundreds of tech transactions and thousands of codebases we audited. We’ll cover:

• Open source license and security risks by the numbers
• Why audits have become the norm in M&A tech due diligence
• How you can get a complete picture of open source risks

By the Numbers: 2025 Open Source Risk in M&A

As you start down the path of using generative artificial intelligence (GAI) in software development to improve efficiency, reduce costs, and increase revenue, you must also be aware of the associated legal issues. How can you leverage AI and minimize the risk it presents?

Join this webinar in which a panel of legal experts and practitioners will answer your questions about the rise of AI in software development, and how you can responsibly leverage this new technology. We’ll cover:

• The benefits and risks for using AI in software development 
• The evolving legal and regulatory landscape 
• Practical advice for using AI today and into the future

Ask the Experts: AI and Software Development

AI-powered development has greatly increased the rate at which software evolves. But using artificial intelligence as a proxy for security-aware developers introduces a variety of risks to the business.

Organizations must prepare for the complexities of AI-powered development. This requires establishing consistent and scalable DevSecOps initiatives. The discussion will cover

• Innovation and trends in AI-powered software development
• The inherent risks to application security and business operations of using AI and third-party digital artifacts
• Best practices for establishing application security testing and issue remediation within DevOps workflows that include AI
• Ways to use AI to empower developers and reduce the opportunity of an attack

Preparing DevSecOps for AI Development

Securing software takes teamwork—a unified approach from development through testing and into production. But each team has a distinct set of requirements and workflows that need to align to realize a concerted push for security. And while developers influence risk posture, they are often not trained in or focused on software security practices.

How can you make the effort that developers and DevOps teams are already putting in more valuable to the business? What's the best way to cultivate highly security-conscious developers so your software becomes more secure over time? Is there a way to derive tangible benefits for the business, the team, and the individual?

Join us as we break down a five-step process with real-world applicability. Topics include

• The critical distinction between developers' security awareness and their security capability
• Mechanisms to automate risk detection and accelerate remediation across the pipeline, including at the developer desktop
• How to establish security gates in DevOps pipelines in a way that doesn't derail development or lead to missed shipping deadlines
• How to create a DevSecOps initiative that can evolve with the business and enable developers to sustain security requirements as part of their day-to-day
• Ways to maximize security's value to the business and its customers

5 Steps to Achieving Developer-First Security

Generative artificial intelligence (GAI) will fundamentally change the way that software is built. Whether they are developing or using AI tools, organizations must understand the opportunities and risks involved, and evolve governance, policies and processes to address those risks.

Join this webinar for a deep dive into the issues that arise when using GAI in software development. We’ll cover:

• Open source data and software licenses and risks with AI
• Licensing and clearance considerations for materials used to train AI models
• Licensing considerations in building, training, and using AI models
• A deep dive on GitHub Copilot, including implications of the class action suit

Generative AI, Training Data, Open Source, and GitHub Copilot, Oh My!

The world of application security can be overwhelming for newcomers. The technical jargon, complex solutions, and confusing methodologies make it hard to navigate. It’s essential to understand threat modeling and threat and risk analysis, but that can be difficult without the right guidance.

Here’s the good news: threat modeling at its core is intuitive and adaptable. With the right approach, it can be a powerful tool that helps you understand risks and make informed security decisions while aligning with your organization's unique needs.

In this webinar, we’ll break down the complexity of threat modeling. We'll address common questions and show why it’s a central part of application security. Participants will leave with a clear understanding of
• What threat modeling is and why it matters
• How to tailor threat modeling to fit your organization and industry
• Where to find resources for further learning and practical implementation

Threat Modeling: Charting Your Security Journey

Just as most software assets contain open source, modern software applications commonly include third party software functionality via calls to external web services via APIs. By using web services, developers may be inadvertently signing their companies up to terms of service or using a web service without a suitable agreement. Using these services can expose a company to compliance, security, data privacy, and operational risks that could disrupt or severely affect the business. As part of the tech M&A due diligence process, you should be aware of these web services-related risks so that you can make informed decisions about deal valuation and remediation.
 
Join us for a discussion about web services and how they can affect M&A and other transactions. We’ll cover:
 
• The legal compliance, data privacy, security, and business risks that come with web services
• Typical terms of service and common pitfalls
• Real-world examples of these risks
• How a buyer can get a better understanding of these risks in a target’s codebase or how a seller can prepare for diligence to avoid risks
 
Don’t miss this informative webinar. Register today.

Web Services & APIs: Impact on M&A and Other Transactions

Open source software is at the heart of modern development, but it comes with its own set of challenges. The number of discovered vulnerabilities continues to rise year after year. Staying ahead in this evolving landscape requires not only vigilance but also access to accurate vulnerability data. 
Join us for an exclusive webinar with the Black Duck Vulnerability Research team, where you'll gain insights into their cutting-edge approach to identifying and addressing vulnerabilities in open source software. Discover how their innovative methods empower organizations to detect and remediate vulnerabilities quickly and effectively. 
In this session, you'll learn: 
- How the Black Duck Vulnerability Research team operates and innovates to deliver unparalleled vulnerability insights. 
- Why the quality and accuracy of vulnerability reports are critical to security success. 
- The latest trends and insights shaping the open source vulnerability landscape.

Black Duck Vulnerability Research

There is no shortage of buzz around generative artificial intelligence (GAI). GAI can be used in software development to generate and augment code which saves times and reduces development cycles. But using AI in software development comes with its own set of risks.

Join this webinar to get an introduction to GAI and how you can minimize risk when using it in your organization. We’ll cover:

• What GAI is and how machines learn
• Legal issues with AI including copyright, web scraping, and more
• Overview of current litigation
• Practical approaches to using GAI while minimizing risk

Best Practices for Using AI in Software Development

Kubernetes is known for its ability to scale quickly, but does its security and management keep up with that growth? As your Kubernetes setup expands, it becomes harder to spot and fix potential problems.

Join our experts as they share modern ways to manage Kubernetes clusters and explain how to find misconfigurations and reduce risks.

In this discussion, you'll learn:
- A new way to look at and manage your Kubernetes clusters.
- How to spot dangerous misconfigurations and improve your cluster's security.

Don't miss out on learning how to secure your Kubernetes setup as it grows.

Securing Kubernetes Clusters: Managing Security and Risk

Join us as we explore how to scale application security in today's dynamic development environments. Don't miss this opportunity to uncover actionable strategies for managing software risk. Learn to achieve scalable application security in today's fast-paced development landscape.

What You'll Learn
- How to streamline application security and maximize insights for improved outcomes
- Techniques to optimize processes, enhance collaboration, and deliver secure software without sacrificing development speed
- Why leveraging an Application Security Posture Management (ASPM) solution can help standardize AppSec practices across diverse tooling, teams, and applications within your organization

4 Steps for End-to-End Software Risk Management

The Board and C-Suite are starting to take notice of the opportunities and risks inherent with powerful new generative artificial intelligence (GAI) tools that can quickly create text, code, images, and other media. Product Development and Engineering teams want to use such tools to increase productivity by at least one order of magnitude. In response, the Security, Legal, and Compliance teams typically raise legitimate concerns about the risks involved. What role can the Board and C-Suite play in this situation?
 
Join this live Synopsys webinar to get a jump start on what AI strategy, security, and governance looks like from the Board-level and C-suite. We’ll cover:
 
• Fundamentals of AI, types of models, and data used to inform them
• Expanding existing processes and procedures to address the security risks of GAI
• The top three questions the Board and C-Suite should be asking about GAI
• How to navigate the existing and evolving legal and regulatory landscape

Fundamentals of AI Strategy, Security, and Governance

The Common Vulnerabilities and Exposures (CVE) system allows interested parties to track all the relevant information about a specific vulnerability. It helps avoid duplication and allows software vendors and users alike to ensure that they are referring to the same vulnerability in their efforts to protect systems against attack. 

In this 15 minute session, you’ll gain
• An understanding of what the CVE system is
• Knowledge of the stakeholders involved 
• Insight into the elements of a CVE ID
• A walkthrough of the CVE Record Lifecycle

CVE Explained

CISOs must ensure their organizations comply with various cybersecurity regulations and industry standards. Each industry has its own hodgepodge of requirements and states are beginning to roll out their own regulatory mandates. Would adopting a risk management framework help you prioritize and address risks and achieve compliance? How can your enterprise satisfy auditors that sensitive data is being handled securely? And how can you prove that to regulators following a breach? In this webinar, experts discuss the impact of tightening compliance and privacy rules — and enforcement — on the way enterprises approach cybersecurity, and how you can meet their requirements going forward.

During this webinar you will: 

- Get an overview of the shifting regulatory environment  
- Hear how organizations are using tooling to tackle regulatory challenges 
- Get best practices for avoiding enforcement actions from regulators

How CISOs Navigate the Regulatory and Compliance Maze

Join our webinar to delve into the world of Software Bills of Materials (SBOMs) and understand their significant impact on organizational security and transparency. Learn how managing SBOMs accurately can empower your organization to effectively track and manage software components, streamline security assessments, and bolster supply chain resilience. 

This webinar covers best practices that guide you through the process of creating comprehensive and accurate SBOMs, and offers strategies to ensure your organization remains compliant and vigilant. This training is particularly necessary for those working with countries that have their own SBOM guidelines such as Cert-IN guidelines.

This session is ideal for IT, cybersecurity, and supply chain professionals who are keen to secure their software ecosystem and stay ahead in the ever-evolving landscape of software security.

Managing SBOMs with Ease and Accuracy: Ensuring Comprehensive Compliance

Software is essential in everyday products like cars, medical devices, airplanes, and IoT devices. Bugs and security flaws can have serious impacts on safety, the environment, and your reputation. As AI speeds up software development, it's more important than ever to keep your policies, coding standards, and testing up to date.

In this webinar, we’ll discuss:
- Trends that offer innovation but also increase the risk of costly errors
- Updates to functional safety standards that improve software reliability
- How to reduce supply chain risks by getting a full view of your software
- Strengthening software with thorough testing techniques

Register now to learn practical tips for creating secure, reliable functional safety software in 2025 and beyond.

Building Safe and Reliable Software in 2025

The latest “Building Security in Maturity Model” (BSIMM) report, based on data from 121 firms, reveals critical trends shaping the future of application security. Since its start in 2008, the BSIMM report has been a trusted resource for organizations navigating the challenges of securing software.

This webinar will dive into the key findings of BSIMM15, including
- The transformative role of AI/ML in software development and security
- Managing risks in the increasingly vulnerable software supply chain
- The surprising decline in security awareness training
- How the “shift everywhere” approach is evolving to meet the needs of emerging technologies

Join us to uncover actionable strategies to strengthen your application security program in an era of rapid change.

BSIMM15 Insights: Trends Shaping Software Security in 2025

Data Analysis

Application Security

Cyber Security

Software Development

Risk Management

Risk Framework

Risk Analysis

Supply Chain

Vulnerabilities

Vulnerability Management

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

Get powerful market trends insights that are shaping the M

Mergers and Acquisitions

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

BSIMM15 Insights: Trends Shaping Software Security in 2025

Presented by

About this talk

More from this channel