Which research exactly? NIST? White paper sales puffpieces? From a training perspective, theres nothing worse than e-learning and interactive exercises for de

Which research exactly? NIST? White paper sales puffpieces? From a training perspective, theres nothing worse than e-learning and interactive exercises for developers. - If you are a dev who wants to learn more about appsec, then attend the local OWASP meetup and sit in on some actual CTFs and learn the tools/process. - If you are like most devs who just want to become better developers, then ask your company to be more transparent with their pentest readouts and let developers attend the meetings, reviw the findings and more importantly interact with the testers themselves. The biggest problem in appsec is the lack of transparency and poor communication between security professionals and developers. OWASP is just fine.