Selected research reports, interactive ebooks, white papers, and executive insights illustrating our work across sectors and regulatory domains.
The State of Threat Modeling 2026: AI Code Security
In 2026, AI is writing a growing share of enterprise code, and security practice is working to keep up. This study commissioned by Security Compass is of 200 senior security and engineering leaders at large enterprises in North America and Europe. It establishing that more than three-quarters have adopted AI coding tools broadly or made them the default (77%), and the typical organization runs three of them, with no standard tool stack. Yet AI-assisted code carries serious security defects more often than code written without AI, and the gap widens as AI does more of the work.
2025 State of Secure Development and ATO in U.S. Government Agencies
Golfdale partnered with Security Compass to gather input from senior managers and leaders across major US agencies, including Homeland Security, Health and Human Services, Veterans Affairs, and Defense. Their insights highlight the pressure to modernize secure development and ATO workflows, the gaps that slow progress and where agencies are concentrating investment.
The 2025 State of Application Security Training
Software building companies in the U.S., Canada, and the UK are raising their focus on application security training in response to evolving threats. This Security Compass commissioned study finds compliance demands and emerging AI risks are pushing most organizations to invest more in both formal and on-the-job security training.
The State of Security by Design and Threat Modeling in 2025
Security Compass commissioned a US and Canada survey of security practitioners in medium-to large-scale software organizations. Most view threat modeling as a top priority. Across the software development lifecycle, success hinges on automation, investing in specialized training, improving toolchain interoperability, and defining clear metrics to demonstrate return on investment.