Secure Software by Design 2026 Assets

Carnegie Mellon University's Software Engineering Institute (SEI) has been at the forefront of secure software development promoting a “shift left” approach to save time and money by addressing, preventing, or eliminating security weaknesses earlier in the software development cycle. Building on this approach, the third annual Secure Software by Design event promoted security as an integral aspect of the entire software lifecycle by following deliberate, intentional engineering processes rather than by addressing security as one-off activities.

Sessions included:

• Steven Lipner – Implementing Secure By Design, Principles, Practices and Assessments
• Bradley Lanford – Secure Software by Design and Program Production
• Alok Tibrewala – The Unverified Developer: Threat Modeling AI Coding Agents in Secure Software Pipelines
• Gorijala Hemanth – Secrets That Survive Everything: Five Design Decisions That Let Credentials Reach Production
• Will Klieber – Using LLMs for Adjudication of Static Analysis Alerts
• Nick Guertin – Tyranny of Innovation
• Sanat Pattanaik – Secure by Design for Enterprise AI: A Governance Framework for Agentic Systems at Scale
• Niharika P Pujari – Secure and Accessible by Construction: Engineering Guardrails for AI-Generated User Interfaces
• Rakia Finley – Secure By (Human) Design: Integrating Behavioral Architecture into Software Security
• Glenn Gasman – Threat-Informed Product Security for Critical Infrastructure
• Jai ChandraMouli Langoju – AI Assisted Semantic API Contract Validation for Resilient Microservices

This collection also includes a tool spotlight.