Last reviewed 4 November 2026 against the sources linked in this post.
The pull request looks tidy. The coding assistant wrote most of it, the tests pass, and it adds a library nobody on the team has heard of. Merge it, and you may ship a package that did not exist last week or an endpoint that skips an access check. That is the gap security training for developers has to close. OWASP's Top 10:2025 puts broken access control first and reports that 100% of the applications tested had some form of broken access control.
This list is for engineering managers and security champions. You get 10 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The one legal point describes a US federal rule, so use this as a syllabus, not a ruling.
All 10 courses at a glance
| Course | What it covers | Length | Law behind it? |
|---|---|---|---|
| Secure AI-assisted software development | Coding assistants, agents and the secure AI coding loop | 45 min | No |
| Memory-safe C and C++ to CERT and MISRA standards | Lifetimes, pointers, common flaws and static analysis | 45 min | No |
| Concurrency safety | Threads, locks, race conditions and deadlock | 40 min | No |
| Enterprise platform developer onboarding | A first safe change, extensions and change control | 45 min | No |
| Data classification & handling | Levels, storing, sharing and disposing of data | 25 min | No |
| AI security for everyone | Shadow AI, prompt injection and unknown code packages | 30 min | No |
| Security awareness essentials | The stages of an attack and core habits | 35 min | Yes (US covered financial institutions) |
| Phishing & social engineering | Red flags, verification and reporting | 30 min | No |
| Passwords, passkeys and multi-factor authentication | Safe sign-ins, MFA, passkeys and recovery | 30 min | No |
| Social engineering, fraud and deepfakes | Phone, payment and impersonation scams | 35 min | No |
Only the security awareness course sits on a US federal rule, and only for some organisations: the FTC Safeguards Rule says covered financial institutions must provide security awareness training to their personnel. It does not set a course for everyone else.
Secure and safe development
Secure AI-assisted software development: coding assistants and agents without the risk
This 45-minute course opens with a hallucinated package that becomes an attack, then covers six ways coding assistants and agents fail, the secure AI coding loop (prompt, inspect, test, disclose), the grey areas of customer data, shell commands and untested pull requests, and approved tools with AI-use labels on pull requests. It ends with a 12-question final check at 80% to pass. The "spot the flaw" round works well as a Pick Answer slide. For the review side, see our guide to AI-generated code review training.
Memory-safe C and C++ to CERT and MISRA standards
Memory-safety flaws are a well-known class of vulnerability in C and C++. This 45-minute course starts with a crash from one stray pointer, then covers stack, heap and lifetimes, pointers and arrays, common flaws such as use after free, coding rules in practice and static analysis in review. A "name the flaw" question is a natural Pick Answer round for a team code review session.
Concurrency safety: threads, locks and race conditions
Race conditions cause bugs that pass every test until production. This 40-minute course follows a counter that was wrong every tenth run, then covers threads, processes and async, locks, mutexes and semaphores, race conditions and deadlock, patterns by language and a review checklist. The "pick the tool" scenario, mutex or semaphore, gives back-end developers a quick check of what they know.
Enterprise platform developer onboarding: your first safe change to a business platform
New developers on a configurable business platform often break things with their first change. This 45-minute course covers that first change to a live configuration, platform concepts, reports and processing, extensions and the configuration repository, change control and writing a hand-over note. Use it in a new starter's first week, before they touch a vendor object.
Our pick: Secure AI-assisted software development. Many teams now ship assistant-written code, and this course gives them one loop to follow before they merge it.
Data and AI tool security
Data classification & handling
Developers copy production data into test systems and share logs in chat. This 25-minute course covers why classification exists, the company's levels, what is allowed and not allowed when you label, store, share and dispose of data, red flags and how to escalate. It ends with a 10-question final check at 80% to pass. "Where should Confidential data be stored?" makes a fast Pick Answer question.
AI security for everyone: shadow AI, prompt injection and manipulated outputs
Prompt injection and unknown code packages affect coding assistants directly. This 30-minute course covers shadow AI and a compromised chatbot, prompt injection and poisoned content, hidden instructions in PDFs and emails, free AI extensions and unknown code packages, and how to report an incident or request an approved tool. A Word Cloud on "which AI tools are in your editor today?" shows what your policy needs to cover.
Our pick: Data classification & handling. A stack trace pasted into a chatbot is a data leak, and this short course makes the levels clear before it happens.
Account and phishing defence
Security awareness essentials
Developers hold source code, secrets and pipeline access, so the baseline matters more for them. This 35-minute course covers why people are targeted, the anatomy of an attack, red flags, how to protect yourself and how to respond and report, with a 12-question final check at 80% to pass. For covered financial institutions it is a ready-made way to meet the FTC Safeguards Rule's security awareness training requirement, though the rule names no course.
Phishing & social engineering
Developers are phished for repository and cloud credentials. This 30-minute course explains how attacks are built, the red flags, how to protect yourself and how to report, with a 12-question final check at 80% to pass. Add an example of a fake code-hosting sign-in page to the live deck. Your SOC triages what developers report: see our SOC analyst training list.
Passwords, passkeys and multi-factor authentication for staff
Developer accounts protect code and pipelines, so they need strong authentication. This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. A Rating Scale on "how many of your accounts use MFA?" starts an honest conversation.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Impersonation scams target engineers who can approve access or deploys. This 35-minute course follows a convincing request, covers the tactics, verification by a known number, faked voice and video, and why seniority and secrecy are pressure, not proof. A "would you grant this access?" scenario works as a Pick Answer round.
Our pick: Passwords, passkeys and multi-factor authentication for staff. One stolen developer login can reach the whole pipeline, and passkeys resist phishing, so a stolen password alone no longer opens it.
How to roll the plan out
Start where the flaws are most common. With broken access control found in every application OWASP's data tested, pair the secure coding courses with review habits, not slides alone.
- In a new developer's first week: security awareness essentials, passwords, passkeys and MFA, data classification, and the platform onboarding course if your team builds on one.
- Within the first month: secure AI-assisted development, AI security for everyone, and the memory-safety or concurrency course for the languages your team uses.
- Each year: a refresher quiz on each course, plus the AI courses whenever a new assistant or agent is approved.
- When it applies: if you are a covered financial institution, keep security awareness training current as the FTC Safeguards Rule describes, and ask your counsel what else applies in your country or state.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: show a code snippet from the course and ask which flaw it hides.
- Word Cloud: ask "What do you check before you merge assistant-written code?" and compare the answers with the secure AI coding loop.
- Rating Scale: before and after, ask "How confident are you spotting a race condition in review?" from 1 to 5.
- Open Ended: collect anonymous near-misses from the last sprint at the end of a live session.
FAQ
What security training do developers need?
Developers need secure coding, dependency and secrets handling, and safe use of AI coding tools. The courses above cover those, plus the awareness basics every employee needs.
Is AI-generated code secure?
Not by default. It needs the same review, testing and scanning as any other code, and a check that every suggested package exists and is approved.
What is memory safety?
Memory safety is the prevention of errors such as buffer overflows and use after free that attackers exploit. C and C++ need rules and static analysis to get there.
How often should developers retrain on security?
Once a year, with short updates when frameworks, tools or threats change.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
