Make a small core of secure coding training mandatory for everyone who ships code, and keep deeper, role specific material opt in or manager assigned. A short required base sets a shared floor and supports audits. Optional depth builds enthusiasm without forcing people through topics they do not need.
The case for mandatory
Some things must reach everyone. If one developer does not know not to commit credentials, the whole team carries that risk. A required base also produces records. Several standards and customer reviews ask whether developers receive security training, and an optional program cannot show consistent coverage.
NIST SP 800-50 Rev. 1 describes a learning program as a lifecycle with metrics and evaluation, which assumes you know who was covered.
The case for opt in
Required training that feels irrelevant breeds resentment and clicking through. Developers on a data team do not need the same depth on browser security as a frontend team. Opt in material attracts people who care, and those people often become your champions.
A split that works
| Layer | Mandatory? | Content | Length |
|---|---|---|---|
| Core | Yes, at joining and yearly refresh | Credentials, input handling, authorization basics, reporting a problem | About an hour |
| Role track | Assigned by manager | API, mobile, platform, data or similar | Two to four hours spread out |
| Depth | Opt in | Threat modeling, code review, capture the flag, deep dives | Voluntary |
The numbers are a starting point, not a standard. Adjust to your teams.
Rules that reduce resentment
- Explain why. One paragraph on the real incidents or findings behind the requirement.
- Respect prior knowledge. Let experienced people test out of the core with a short assessment.
- Schedule it. Count it as work time, not evening homework.
- Keep it practical. Exercises on your own code beat slides.
- Make the deadline reasonable. Give a few weeks, not days.
What not to do
- Do not tie completion to punishment. Tying it to access creates gaming. If you must enforce, use a gentle reminder chain first.
- Do not make everything mandatory to look thorough. Volume without relevance lowers engagement.
- Do not leave contractors out. They write code too. See vendor and contractor training requirements.
How to tell if the split works
Look at completion of the core, uptake of the opt in layer and whether findings in trained areas fall. If almost nobody opts in, the material may be dull or hard to find. If core completion needs constant chasing, it may be too long.
Where Safeguard fits
Safeguard's compliance and evidence automation can help organise records for audits. It does not offer training courses. A free scan at gold.safeguard.sh/scan can supply real findings for your exercises.
Quick check
Is mandatory training required by law for developers?
It depends on the sector and the framework you are following. Check the specific obligations that apply to you with your compliance or legal contact.
Can experienced developers skip the core?
Reasonable programs allow it after a short assessment, which respects their time and still gives you a record.
Sources
- NIST SP 800-50 Rev. 1: csrc.nist.gov/pubs/sp/800/50/r1/final
Last reviewed: 19 October 2026.
