‘Follow the money. Or jail time.’ Perspectives on the role of senior management in secure software development
Loading...
Date
2026-08-14
Authors
Ryan, Ita
Roedig, Utz
Stol, Klaas-Jan
Journal Title
Journal ISSN
Volume Title
Publisher
Association for Computing Machinery
Published Version
Abstract
The number of recorded vulnerabilities in software continues to rise, despite attempts to improve secure coding practice. Much software security research focuses on software developers' abilities, tools and motivations. However, software security budgets and priorities ultimately derive from an organisation's senior management. There is little research on senior management's understanding of software security. We interviewed 21 professional developers, managers and consultants to assess perceptions of how management priorities shape software security in organisations. We found that management priorities are important in providing the resources needed for secure software development. Software-security understanding can be lacking in senior management, which, along with budget pressures, can affect its prioritisation. Developers can be self-motivated to code securely despite lack of management support. Disturbingly, some senior managers will actively subvert software security. Acquisitions, divestitures, downsizing, and funding issues may affect an organisation's software security stance. We make a number of recommendations for policymakers, the C-suite and other stakeholders, and suggest directions for further research.
Description
Keywords
Secure software development , Interview study , Executive management , [ComputerScience]
Citation
Ryan, I, Roedig, U & Stol, K-J 2026, '‘Follow the money. Or jail time.’ Perspectives on the role of senior management in secure software development', ACM Transactions on Software Engineering and Methodology. https://doi.org/10.1145/3840288