If the goal is to rid applications of potential vulnerabilities before they get out in the world, then training has a major role to play in that equation. It allows you to embed security into your end-to-end SDLC process, and it teaches your teams how to design, develop, and implement secure code. Many developers don’t know what secure code looks like, and many more aren’t fully aware of the more than 1,000 categories of security mistakes that developers can make.

A study by the Aberdeen Group showed that companies adopting a “secure at the source” approach to development realized a fourfold return on their application security investments. “The clear takeaway,” the report concludes, “is that application security initiatives of any kind represent extremely good business value.”