Any recommendations for secure software development assessment tools? What’s your preference?

Engineering Security & GRC

1.6k views1 Upvote2 Comments

Sort by:

Board Member, Advisor, Executive Coach in Software2 years ago

I like https://qwiet.ai/

Co-Founder & CISO in Finance (non-banking)2 years ago

I personally like Eureka from FwdSecurity. It allows us to have a SAST, SCA and DAST tool all in one!

Content you might like

Which of these areas are you targeting for funding increases in your 2026 cybersecurity budget? (Choose all applicable)

Threat detection & response 48%

Identity & access management 58%

Cloud security 48%

Security awareness training 30%

Other 3%

N/A

View Results

Digital transformation isn’t just about new tools, it’s about changing how teams work. Key lessons I’ve observed: 1. Start with process bottlenecks, not technology 2. Empower cross-functional teams 3. Measure outcomes, not outputs What has been the most surprising lesson your teams have learned during a transformation?

Read More Comments

When you’re starting a new leadership role in software, do you take time to find quick-win projects early on? What sorts of low-hanging fruit have you had the most success solving?

Are you looking to decentralize cybersecurity leadership?

Yes12%

We're currently exploring it.37%

We have already decentralized cybersecurity leadership.22%

No, but we should.9%

No, and I don't think we should.16%

Unsure1%

View Results

Has anyone drafted an SOW for a cloud-based SIEM with setup, migration, and maintenance? I’m working on a FedRAMP-authorized SIEM SOW, migrating from on-prem Splunk, covering data, searches, alerts, dashboards, and models. Scope includes Environment Setup: Cloud provisioning, configuration, testing. Connectors/Parsers: Custom data source integration. Content Development: Rules, use cases, threat feeds. Performance Tuning: Query/index optimization. Runbooks: Operational procedures. Also required: 24x7 support, maintenance, lifecycle and application management, role-based training, and documentation. Must comply with NIST SP 800-53, CJIS, and FedRAMP Moderate+. Goal: Secure, scalable SIEM for rapid deployment. I may be missing elements, so suggestions are welcome. Please share redacted SOWs or tips if possible.