‘Follow the money. Or jail time.’ Perspectives on the role of senior management in secure software development

Simple item page
dc.contributor.authorRyan, Ita
dc.contributor.authorRoedig, Utz
dc.contributor.authorStol, Klaas-Jan
dc.contributor.funderTaighde Éireann - Research Ireland, Research Ireland
dc.date.accessioned2026-09-23T16:10:01Z
dc.date.available2026-09-23T16:10:01Z
dc.date.issued2026-08-14
dc.description.abstractThe number of recorded vulnerabilities in software continues to rise, despite attempts to improve secure coding practice. Much software security research focuses on software developers' abilities, tools and motivations. However, software security budgets and priorities ultimately derive from an organisation's senior management. There is little research on senior management's understanding of software security. We interviewed 21 professional developers, managers and consultants to assess perceptions of how management priorities shape software security in organisations. We found that management priorities are important in providing the resources needed for secure software development. Software-security understanding can be lacking in senior management, which, along with budget pressures, can affect its prioritisation. Developers can be self-motivated to code securely despite lack of management support. Disturbingly, some senior managers will actively subvert software security. Acquisitions, divestitures, downsizing, and funding issues may affect an organisation's software security stance. We make a number of recommendations for policymakers, the C-suite and other stakeholders, and suggest directions for further research.en
dc.description.sponsorshipResearch Ireland|18/CRT/6222
dc.description.sponsorshipResearch Ireland|13/RC/2077_P2
dc.description.sponsorshipResearch Ireland| 13/RC/2094_P2
dc.description.sponsorshipResearch Ireland|23/US/3939
dc.description.versionAccepted Version
dc.format.mimetypeapplication/pdfen
dc.identifier.authororcidRyan, Ita§0000-0001-6844-6365
dc.identifier.authororcidRoedig, Utz§0000-0002-4020-0889
dc.identifier.authororcidStol, Klaas-Jan§0000-0002-1038-5050
dc.identifier.citationRyan, I, Roedig, U & Stol, K-J 2026, '‘Follow the money. Or jail time.’ Perspectives on the role of senior management in secure software development', ACM Transactions on Software Engineering and Methodology. https://doi.org/10.1145/3840288
dc.identifier.doi10.1145/3840288
dc.identifier.issn1049-331X
dc.identifier.journaltitleACM Transactions on Software Engineering and Methodology
dc.identifier.otherORCID: /0000-0001-6844-6365/work/223803406
dc.identifier.urihttps://hdl.handle.net/10468/19327
dc.language.isoen
dc.publisherAssociation for Computing Machinery
dc.rights© 2026, the Author(s). Publication rights licensed to ACM. For the purpose of Open Access, the authors have applied a CCBY public copyright licence to any Author Accepted Manuscript version arising from this submission.
dc.rights.accessrightsopen access
dc.rights.licensenameAttribution 4.0 International
dc.rights.urihttps://creativecommons.org/licenses/by/4.0/
dc.statusPeer reviewed
dc.subjectSecure software development
dc.subjectInterview study
dc.subjectExecutive management
dc.subject[ComputerScience]
dc.title‘Follow the money. Or jail time.’ Perspectives on the role of senior management in secure software developmenten
dc.typeArticle (peer-reviewed)
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Money_or_Jail_Time.pdf
Size:
675.56 KB
Format:
Adobe Portable Document Format
Download
Collections
School of Computer Science and Information Technology