Software Developer Responsibility: Designers of Our World
Software developer responsibility grows as code shapes safety, fairness and daily life. Whoever designs the modern world has to weigh what they build.
Security, Regulation & Compliance
Security cannot be tested in at the end of a project, and regulatory demands keep growing, from the Cyber Resilience Act to standards such as IEC 62443. This hub connects security, regulation, and compliance with everyday quality work in development and testing.
The articles and podcast episodes cover secure by design, developing security requirements as a team, static analysis, fuzzing, penetration testing, and automated security checks. They also look at zero trust, using open source securely, legal questions in software contracts, and AI in regulated settings such as medical labs. They share one view: security is a job for the whole team.
Articles
Software Security Awareness: Security Is Everyone's Business
Software security awareness decides whether users trust digital services with sensitive data. Security requirements and tests alone won't get you there.
Static Analysis: Finding Security Flaws Before Testing
Static analysis security testing finds many flaws in Java code before dynamic testing starts. In one study it took 2 person-months, dynamic testing 12.
Agile Development for Medical Devices: Aligned with Standards
Agile development for medical devices can comply with ISO 13485 and IEC 62304. A manufacturer shows how: short iterations, daily meetings, reviews.
E-Government Platform: How Saxony Runs Acceptance Tests
Saxony's e-government platform relies on acceptance tests in a shared test center, run by test specialists and business testers, plus release tests.
Podcast Episodes
Dark Side of Testing: The Failures We Cause Ourselves
A test can leak data, expose code or bring down production. The dark side of testing begins with the setup, which needs a risk assessment of its own.
LLM Testing: A Second Model Acts as the Judge
LLM testing can be automated if you accept non-determinism: rubrics and acceptance ranges replace yes/no asserts, and a calibrated LLM judges outputs.
AI in Regulated Industries: Strategy First in a Medical Lab
AI in regulated industries starts with strategy: a medical lab mapped stakeholders, narrowed the scope and put compliance on one page with a bow tie.
Security Requirements: Assets First, Then Requirements
Security requirements stay abstract until a team defines what the system actually protects. CIA goals and threat modeling make it tangible.
Security Testing for AI: Checking Outputs Instead of Just Inputs
AI security testing covers the whole life cycle, from training data to live queries. Why output filters often beat input filters, and what OWASP offers.
IEC 62443-4-1: A Toolbox for the Cyber Resilience Act
IEC 62443-4-1 builds security into the process from the first design step and covers much of what the Cyber Resilience Act will require from 2027.
Mobile Security: From Unencrypted Calls to Overlay Attacks
From analog eavesdropping to overlay attacks on banking apps, mobile security has never stopped failing users in new ways.
AI-Generated Test Cases: Compliant Without Tool Validation
AI-generated test cases for medical devices: a RAG system retrieves in-house documents, a human reviews the results, so no tool validation is needed.
Software Contracts: Agile Teams Often Owe the Whole Backlog
Two missing sentences in a software contract can drive a company into bankruptcy. Why agile software projects end up as contracts for work.
Open-Source Software: Four Requirements for Vendors
Open source compliance starts once you ship software. Vendors need license checks and an S-BOM, which the Cyber Resilience Act makes mandatory.
Security by Design: Why Custom Encryption Adds Risk
Security by design starts with threat modeling any team can run, layered defenses and secure defaults. Security bolted on in the last 10% stays thin.
Custom Fuzz Testing: Random Data That Knows the Format
Custom fuzz testing pairs random inputs with knowledge of the format. Why a random IBAN rarely passes the checksum, and where LLMs fall short.
Nudging for Security: Making the Secure Choice the Easy One
Nudging for security starts where most attacks start: human error. Secure defaults, opt-out 2FA and password meters guide users without forcing them.
AI Test Description: Test Cases Structured Like Code
An AI test description makes AI systems testable: five capabilities and quality criteria like correctness and bias turn standards into concrete tests.
How Is Security Testing Integrated into the CI/CD Pipeline?
Automated security testing with OWASP ZAP and Nuclei in CI/CD catches standard flaws early and shrinks a 60-page pentest report to four or five pages.
Cyber Resilience Act: Connected Machines Are Affected Too
The Cyber Resilience Act covers connected machines, with risk assessments and reporting duties. Starting early secures consultants before rates rise.
Secure by Design: Security Starts at the Beginning
Secure by design means building security in from day one, not bolting it on later. What defense in depth, secure defaults and threat modeling look like.
Security Audits: A Baseline Instead of a Major Cleanup
Security audits work best as a habit: draw a baseline, run security checks in the pull request and fix a few findings whenever you touch the code.
Software Expert Witness: State of the Art Means Proven
A software expert witness checks whether software is state of the art, a legal term meaning proven, and judges its maturity by defect density.
Zero Trust at Telekom: From 30 to 3 Identity Providers
Zero trust implementation starts with a shared definition, or everyone talks past each other. Telekom uses six aspects, from network to monitoring.
Digital Accessibility: 57 Percent Can Be Tested Automatically
Automated tests catch only about 57 percent of digital accessibility issues. The rest needs manual testing and an early start in the style guide.
Automotive Testing: Standards Prescribe Testing Methods
In automotive testing, even a windshield wiper is safety-critical. Automotive SPICE and functional safety prescribe boundary value analysis and MC/DC.
Cybercrime: Organized Like a Startup
Cybercrime works like a start-up with a division of labor. Defenders should think like attackers, separate systems and not pay the ransom.