Engineering owns the security risk of the software it builds and ships. Security owns the standards, the tooling, the visibility and the advice. Leadership owns risk acceptance. When each group understands this split, findings get fixed instead of passed back and forth.
Why the argument happens
Security finds the issue. Engineering has the code and the deadline. If nobody has written down who decides, each side assumes the other is responsible. CISA's Secure by Design guidance addresses a similar idea at vendor level, asking producers to take ownership of customer security outcomes and leaders to drive from the top. The same logic applies inside a company.
A responsibility table
| Decision or task | Engineering | Security | Leadership |
|---|---|---|---|
| Write secure code and fix defects | Owns | Advises | Informed |
| Choose scanners and rules | Consulted | Owns | Informed |
| Set fix targets | Consulted | Proposes | Approves |
| Triage a new finding | Owns first response | Supports | Informed |
| Accept a risk past its target | Requests | Reviews | Approves |
| Report to the board | Provides input | Owns reporting | Receives |
Adjust the cells to your organization, but write them down and publish them.
How to apply it
- Assign every repository to a team with a named contact.
- Route findings to that contact automatically, not to a shared inbox.
- Set exceptions with an expiry and a named approver outside the requesting team.
- Report by team so owners can see their data.
- Escalate by rule. If a severe finding passes its target, it moves to the next manager automatically.
When security should step in
Security should do more than advise in three cases: an active incident, a systemic weakness that crosses teams, and a team that lacks skills. In each, agree on a time limit so the intervention does not become permanent ownership.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a finding is assigned and tracked. Clear assignment is the practical form of the table.
Quick check
Who fixes a vulnerability in a shared library?
The team that owns the library. Teams that consume it update when a fix is available.
Can security accept risk for engineering?
Security can recommend, but risk acceptance should rest with a business leader who can weigh the trade-off.
Safeguard supports this with asset discovery, policies and gates, and evidence automation that records who decided what. Try a free scan.
Sources
- CISA Secure by Design principles. Paraphrased.
Last reviewed: 19 October 2026.
