נבדק לאחרונה ב-4 בנובמבר 2026 על פי המקורות המקושרים בפוסט זה.
The pull request looks tidy. The coding assistant wrote most of it, the tests pass, and it adds a library nobody on the team has heard of. Merge it, and you may ship a package that did not exist last week or an endpoint that skips an access check. That is the gap security training for developers has to close. OWASP's Top 10:2025 puts broken access control first and reports that 100% of the applications tested had some form of broken access control.
This list is for engineering managers and security champions. You get 10 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an הבחירה שלנוהנקודה המשפטית האחת מתארת כלל פדרלי אמריקאי, לכן יש להשתמש בזה כסילבוס, לא כפסיקה.
כל 10 הקורסים במבט חטוף
| קורס | מה זה מכסה | אורך | החוק מאחורי זה? |
|---|---|---|---|
| Secure AI-assisted software development | Coding assistants, agents and the secure AI coding loop | 45 דקות | לא |
| Memory-safe C and C++ to CERT and MISRA standards | Lifetimes, pointers, common flaws and static analysis | 45 דקות | לא |
| Concurrency safety | Threads, locks, race conditions and deadlock | 40 דקות | לא |
| Enterprise platform developer onboarding | A first safe change, extensions and change control | 45 דקות | לא |
| סיווג וטיפול בנתונים | Levels, storing, sharing and disposing of data | 25 דקות | לא |
| אבטחת בינה מלאכותית לכולם | Shadow AI, prompt injection and unknown code packages | 30 דקות | לא |
| יסודות מודעות לאבטחה | The stages of an attack and core habits | 35 דקות | Yes (US covered financial institutions) |
| פישינג והנדסה חברתית | דגלים אדומים, אימות ודיווח | 30 דקות | לא |
| Passwords, passkeys and multi-factor authentication | Safe sign-ins, MFA, passkeys and recovery | 30 דקות | לא |
| הנדסה חברתית, הונאות וזיופים עמוקים | הונאות טלפון, תשלום והתחזות | 35 דקות | לא |
רק קורס המודעות לאבטחה מבוסס על כלל פדרלי אמריקאי, ורק עבור ארגונים מסוימים: כלל אמצעי הבטיחות של ה-FTC קובע כי מוסדות פיננסיים מכוסים חייבים לספק הכשרת מודעות ביטחונית לעובדיהםזה לא קובע מסלול עבור כולם.
Secure and safe development
Secure AI-assisted software development: coding assistants and agents without the risk
This 45-minute course opens with a hallucinated package that becomes an attack, then covers six ways coding assistants and agents fail, the secure AI coding loop (prompt, inspect, test, disclose), the grey areas of customer data, shell commands and untested pull requests, and approved tools with AI-use labels on pull requests. It ends with a 12-question final check at 80% to pass. The "spot the flaw" round works well as a Pick Answer slide. For the review side, see our guide to AI-generated code review training.
Memory-safe C and C++ to CERT and MISRA standards
Memory-safety flaws are a well-known class of vulnerability in C and C++. This 45-minute course starts with a crash from one stray pointer, then covers stack, heap and lifetimes, pointers and arrays, common flaws such as use after free, coding rules in practice and static analysis in review. A "name the flaw" question is a natural Pick Answer round for a team code review session.
Concurrency safety: threads, locks and race conditions
Race conditions cause bugs that pass every test until production. This 40-minute course follows a counter that was wrong every tenth run, then covers threads, processes and async, locks, mutexes and semaphores, race conditions and deadlock, patterns by language and a review checklist. The "pick the tool" scenario, mutex or semaphore, gives back-end developers a quick check of what they know.
Enterprise platform developer onboarding: your first safe change to a business platform
New developers on a configurable business platform often break things with their first change. This 45-minute course covers that first change to a live configuration, platform concepts, reports and processing, extensions and the configuration repository, change control and writing a hand-over note. Use it in a new starter's first week, before they touch a vendor object.
Our pick: Secure AI-assisted software development. Many teams now ship assistant-written code, and this course gives them one loop to follow before they merge it.
Data and AI tool security
סיווג וטיפול בנתונים
Developers copy production data into test systems and share logs in chat. This 25-minute course covers why classification exists, the company's levels, what is allowed and not allowed when you label, store, share and dispose of data, red flags and how to escalate. It ends with a 10-question final check at 80% to pass. "Where should Confidential data be stored?" makes a fast Pick Answer question.
אבטחת בינה מלאכותית לכולם: בינה מלאכותית בצל, הזרקה מהירה ופלט מניפולטיבי
Prompt injection and unknown code packages affect coding assistants directly. This 30-minute course covers shadow AI and a compromised chatbot, prompt injection and poisoned content, hidden instructions in PDFs and emails, free AI extensions and unknown code packages, and how to report an incident or request an approved tool. A Word Cloud on "which AI tools are in your editor today?" shows what your policy needs to cover.
הבחירה שלנו: סיווג וטיפול בנתונים. A stack trace pasted into a chatbot is a data leak, and this short course makes the levels clear before it happens.
Account and phishing defence
יסודות מודעות לאבטחה
Developers hold source code, secrets and pipeline access, so the baseline matters more for them. This 35-minute course covers why people are targeted, the anatomy of an attack, red flags, how to protect yourself and how to respond and report, with a 12-question final check at 80% to pass. For covered financial institutions it is a ready-made way to meet the FTC Safeguards Rule's security awareness training requirement, though the rule names no course.
פישינג והנדסה חברתית
Developers are phished for repository and cloud credentials. This 30-minute course explains how attacks are built, the red flags, how to protect yourself and how to report, with a 12-question final check at 80% to pass. Add an example of a fake code-hosting sign-in page to the live deck. Your SOC triages what developers report: see our SOC analyst training list.
סיסמאות, מפתחות גישה ואימות רב-גורמי לצוות
Developer accounts protect code and pipelines, so they need strong authentication. This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. A Rating Scale on "how many of your accounts use MFA?" starts an honest conversation.
הנדסה חברתית, הונאות וזיופים עמוקים: הונאות טלפון, תשלום והתחזות
Impersonation scams target engineers who can approve access or deploys. This 35-minute course follows a convincing request, covers the tactics, verification by a known number, faked voice and video, and why seniority and secrecy are pressure, not proof. A "would you grant this access?" scenario works as a Pick Answer round.
הבחירה שלנו: סיסמאות, מפתחות גישה ואימות רב-גורמי לצוות. One stolen developer login can reach the whole pipeline, and passkeys resist phishing, so a stolen password alone no longer opens it.
כיצד ליישם את התוכנית
Start where the flaws are most common. With broken access control found in every application OWASP's data tested, pair the secure coding courses with review habits, not slides alone.
- In a new developer's first week: security awareness essentials, passwords, passkeys and MFA, data classification, and the platform onboarding course if your team builds on one.
- בתוך החודש הראשון: secure AI-assisted development, AI security for everyone, and the memory-safety or concurrency course for the languages your team uses.
- בכל שנה: a refresher quiz on each course, plus the AI courses whenever a new assistant or agent is approved.
- מתי זה חל: אם אתם מוסד פיננסי מכוסה, שמרו על עדכניות הכשרת המודעות לאבטחה כפי שמתואר בכללי הבטיחות של ה-FTC, ושאלו את עורך הדין שלכם מה עוד חל במדינתכם.
דרכים להפעיל את הקורסים האלה AhaSlides
ניתן לבנות כל אחד מאלה כקורס בקצב עצמי עם AhaSlides יוצר הקורסים, להפעיל אותם כמפגשי שאלות ותשובות בזמן אמת, או את שניהם, עם סקר לאחר הקורס ובדיקה תוך 30 יום כדי לראות מה השתנה.
- בחר תשובה: show a code snippet from the course and ask which flaw it hides.
- ענן מילים: ask "What do you check before you merge assistant-written code?" and compare the answers with the secure AI coding loop.
- סולם דירוג: before and after, ask "How confident are you spotting a race condition in review?" from 1 to 5.
- פתוח: collect anonymous near-misses from the last sprint at the end of a live session.
שאלות נפוצות
What security training do developers need?
Developers need secure coding, dependency and secrets handling, and safe use of AI coding tools. The courses above cover those, plus the awareness basics every employee needs.
האם קוד שנוצר על ידי בינה מלאכותית מאובטח?
Not by default. It needs the same review, testing and scanning as any other code, and a check that every suggested package exists and is approved.
What is memory safety?
Memory safety is the prevention of errors such as buffer overflows and use after free that attackers exploit. C and C++ need rules and static analysis to get there.
How often should developers retrain on security?
Once a year, with short updates when frameworks, tools or threats change.
פוסט זה הוא מידע כללי, לא ייעוץ משפטי. לקבלת החלטה בנוגע למקום העבודה שלך, פנה לעורך דין מוסמך או לרשות הרגולטור.
