Security Debt in Practice: Nuanced Insights from Practitioners

• URL: http://arxiv.org/abs/2507.11362v1
• Date: Tue, 15 Jul 2025 14:28:28 GMT
• Title: Security Debt in Practice: Nuanced Insights from Practitioners
• Abstract summary: Tight deadlines, limited resources, and prioritization of functionality over security can lead to insecure coding practices.<n>Despite their critical importance, there is limited empirical evidence on how software practitioners perceive, manage, and communicate Security Debts.<n>This study is based on semi-structured interviews with 22 software practitioners across various roles, organizations, and countries.
• Score: 0.3277163122167433
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: With the increasing reliance on software and automation nowadays, tight deadlines, limited resources, and prioritization of functionality over security can lead to insecure coding practices. When not handled properly, these constraints cause unaddressed security vulnerabilities to accumulate over time, forming Security Debts (SDs). Despite their critical importance, there is limited empirical evidence on how software practitioners perceive, manage, and communicate SDs in real-world settings. In this paper, we present a qualitative empirical study based on semi-structured interviews with 22 software practitioners across various roles, organizations, and countries. We address four research questions: i) we assess software practitioners' knowledge of SDs and awareness of associated security risks, ii) we investigate their behavior towards SDs, iii) we explore common tools and strategies used to mitigate SDs, and iv) we analyze how security risks are communicated within teams and to decision makers. We observe variations in how practitioners perceive and manage SDs, with some prioritizing delivery speed over security, while others consistently maintain security as a priority. Our findings emphasize the need for stronger integration of security practices across the Software Development Life Cycle (SDLC), more consistent use of mitigation strategies, better balancing of deadlines, resources, and security-related tasks, with attention to the Confidentiality, Integrity, and Availability (CIA) triad.

Related papers

• Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security [57.35851886874902]
  Agentic AI systems execute complex tasks autonomously, but their multi-step trajectories introduce new failure modes that challenge trustworthiness.<n>This survey provides a focused examination of trustworthy agentic AI through two core dimensions that are critical for high-risk deployments.<n>For each dimension, we clarify key concepts, identify where risks emerge along the agent workflow, and summarize stage-targeted mitigation strategies.
  arXiv  Detail & Related papers  (2026-05-17T10:26:37Z)
• ORCA -- An Automated Threat Analysis Pipeline for O-RAN Continuous Development [57.61878484176942]
  Open-Radio Access Network (O-RAN) integrates numerous software components in a cloud-like deployment, opening the radio access network to previously unconsidered security threats.<n>Current vulnerability assessment practices often rely on manual, labor-intensive, and subjective investigations, leading to inconsistencies in the threat analysis.<n>We propose an automated pipeline that leverages Natural Language Processing (NLP) to minimize human intervention and associated biases.
  arXiv  Detail & Related papers  (2026-01-20T07:31:59Z)
• Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies [57.521647436515785]
  We define frontier AI auditing as rigorous third-party verification of frontier AI developers' safety and security claims.<n>We introduce AI Assurance Levels (AAL-1 to AAL-4), ranging from time-bounded system audits to continuous, deception-resilient verification.
  arXiv  Detail & Related papers  (2026-01-16T18:44:09Z)
• A Systematic Mapping Study on Risks and Vulnerabilities in Software Containers [1.3099514901173375]
  Software containers are widely adopted for developing and deploying software applications.<n>Despite their popularity, major security concerns arise during container development and deployment.<n>This study offers critical insights into the current landscape of security issues within software container systems.
  arXiv  Detail & Related papers  (2025-12-12T10:22:34Z)
• Never Compromise to Vulnerabilities: A Comprehensive Survey on AI Governance [211.5823259429128]
  We propose a comprehensive framework integrating technical and societal dimensions, structured around three interconnected pillars: Intrinsic Security, Derivative Security, and Social Ethics.<n>We identify three core challenges: (1) the generalization gap, where defenses fail against evolving threats; (2) inadequate evaluation protocols that overlook real-world risks; and (3) fragmented regulations leading to inconsistent oversight.<n>Our framework offers actionable guidance for researchers, engineers, and policymakers to develop AI systems that are not only robust and secure but also ethically aligned and publicly trustworthy.
  arXiv  Detail & Related papers  (2025-08-12T09:42:56Z)
• Clean Code In Practice: Challenges and Opportunities [6.520228635709776]
  This paper explores the interplay between software reliability, safety, and security.<n>We identify critical threats to software reliability and provide a threat estimation framework.<n>We propose a set of actionable guidelines for practitioners to improve their reliability prediction models.
  arXiv  Detail & Related papers  (2025-07-26T00:13:50Z)
• Software Bill of Materials in Software Supply Chain Security A Systematic Literature Review [0.0]
  Software Bill of Materials (SBOMs) are increasingly regarded as essential tools for securing software supply chains (SSCs)<n>This systematic literature review synthesizes evidence from 40 peer-reviewed studies to evaluate how SBOMs are currently used to bolster SSC security.<n>Despite clear promise, adoption is hindered by significant barriers: generation tooling, data privacy, format/standardization, sharing/distribution, cost/overhead, vulnerability exploitability, maintenance, analysis tooling, false positives, hidden packages, and tampering.
  arXiv  Detail & Related papers  (2025-06-04T02:49:04Z)
• Towards Trustworthy GUI Agents: A Survey [64.6445117343499]
  This survey examines the trustworthiness of GUI agents in five critical dimensions.<n>We identify major challenges such as vulnerability to adversarial attacks, cascading failure modes in sequential decision-making.<n>As GUI agents become more widespread, establishing robust safety standards and responsible development practices is essential.
  arXiv  Detail & Related papers  (2025-03-30T13:26:00Z)
• Comprehensive Digital Forensics and Risk Mitigation Strategy for Modern Enterprises [0.0]
  This study outlines an approach to cybersecurity, including proactive threat anticipation, forensic investigations, and compliance with regulations like CCPA.<n>Key threats such as social engineering, insider risks, phishing, and ransomware are examined, along with mitigation strategies leveraging AI and machine learning.<n>The findings emphasize the importance of continuous monitoring, policy enforcement, and adaptive security measures to protect sensitive data.
  arXiv  Detail & Related papers  (2025-02-26T23:18:49Z)
• AISafetyLab: A Comprehensive Framework for AI Safety Evaluation and Improvement [73.0700818105842]
  We introduce AISafetyLab, a unified framework and toolkit that integrates representative attack, defense, and evaluation methodologies for AI safety.<n> AISafetyLab features an intuitive interface that enables developers to seamlessly apply various techniques.<n>We conduct empirical studies on Vicuna, analyzing different attack and defense strategies to provide valuable insights into their comparative effectiveness.
  arXiv  Detail & Related papers  (2025-02-24T02:11:52Z)
• Open Problems in Machine Unlearning for AI Safety [61.43515658834902]
  Machine unlearning -- the ability to selectively forget or suppress specific types of knowledge -- has shown promise for privacy and data removal tasks.<n>In this paper, we identify key limitations that prevent unlearning from serving as a comprehensive solution for AI safety.
  arXiv  Detail & Related papers  (2025-01-09T03:59:10Z)
• Leveraging Security Observability to Strengthen Security of Digital Ecosystem Architecture [0.0]
  complexity poses significant challenges for both observability and security in a digital ecosystem.<n>Observability allows organizations to diagnose performance issues and detect anomalies in real time.<n>Security is focused on protecting sensitive data and ensuring service integrity.<n>This paper examines the interconnections between observability and security within digital ecosystem architectures.
  arXiv  Detail & Related papers  (2024-12-07T11:17:29Z)
• Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Model [73.8765529028288]
  We introduce a novel safety alignment challenge called Safe Inputs but Unsafe Output (SIUO) to evaluate cross-modality safety alignment.<n>To empirically investigate this problem, we developed the SIUO, a cross-modality benchmark encompassing 9 critical safety domains, such as self-harm, illegal activities, and privacy violations.<n>Our findings reveal substantial safety vulnerabilities in both closed- and open-source LVLMs, underscoring the inadequacy of current models to reliably interpret and respond to complex, real-world scenarios.
  arXiv  Detail & Related papers  (2024-06-21T16:14:15Z)
• Communicating on Security within Software Development Issue Tracking [0.0]
  We analyse interfaces from prominent issue trackers to see how they support security communication and how they integrate security scoring. Users in our study were not comfortable with CVSS analysis, though were able to reason in a manner compatible with CVSS. This suggests that adding improvements to communication through CVSS-like questioning in issue tracking software can elicit better security interactions.
  arXiv  Detail & Related papers  (2023-08-25T16:38:27Z)
• Leveraging Traceability to Integrate Safety Analysis Artifacts into the Software Development Process [51.42800587382228]
  Safety assurance cases (SACs) can be challenging to maintain during system evolution. We propose a solution that leverages software traceability to connect relevant system artifacts to safety analysis models. We elicit design rationales for system changes to help safety stakeholders analyze the impact of system changes on safety.
  arXiv  Detail & Related papers  (2023-07-14T16:03:27Z)
• Dos and Don'ts of Machine Learning in Computer Security [74.1816306998445]
  Despite great potential, machine learning in security is prone to subtle pitfalls that undermine its performance. We identify common pitfalls in the design, implementation, and evaluation of learning-based security systems. We propose actionable recommendations to support researchers in avoiding or mitigating the pitfalls where possible.
  arXiv  Detail & Related papers  (2020-10-19T13:09:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.