AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train for code review and for phishing, with honest limits.
Developers need two kinds of security training. First, secure coding training shows how to write safe code. Second, security awareness training shows how attackers target the developer as a person. Most programs offer the first as a yearly course and skip the second. AI makes both more urgent. It writes code that looks right and often is not, and it makes its users more sure than they should be.
Engineers hold the keys to a company’s most valuable systems. They can reach repositories, API tokens, cloud logins, and build pipelines. So a mistake in their code reaches production. And a stolen developer login can reach the whole supply chain.
Generic awareness content rarely fits that work. A lesson about a fake invoice means little to an engineer whose real risks are a bad package, an exposed token, or a fake pull request. Training that ignores the job gets closed in seconds, so practice built for the role works better.
Evidence on how training fades comes mostly from phishing studies. We found no study that tests secure coding the same way. Still, the design lessons are fair to borrow, because they come from the same human habits. Keep lessons short, hands-on, and repeated, and test whether they work.
AI coding tools raise two separate problems. First, the code can be less safe. Second, the developer can trust it too much. Attackers use AI tools too, so the gap runs both ways.
| Finding | What it showed | Why it matters for training |
|---|---|---|
| Veracode, 2025 | AI-generated code introduced security flaws in 45% of 80 coding tasks across more than 100 models | Never accept AI output without review |
| Stanford study, 2022 to 2023 | Users with an AI assistant wrote significantly less secure code, and felt more sure it was secure | Overconfidence is the hazard to train against |
Veracode’s 2025 GenAI Code Security Report also found Java failed security checks more than 70% of the time. Python, C#, and JavaScript failed between 38% and 45%. Veracode sells code-scanning tools, so read the report with that in mind. Even so, the direction is clear.
Meanwhile, the Stanford result is the one training should answer. In the study, people who trusted the AI less, and engaged more with their prompts, wrote less vulnerable code. In plain terms, doubt helped.
Discover how Threatcop protects your workforce from modern cyber threats.
So teach one rule first: treat AI output like code from an unknown contributor. Then give engineers a short review habit.
Attackers go after engineers because one stolen login can spread. The 2025 npm attack shows how.
CISA reported that a self-replicating worm known as Shai-Hulud hacked more than 500 npm packages. After it got in, the malware scanned the environment for sensitive logins, including GitHub access tokens and cloud API keys, and sent them to the attacker. GitHub said the worm spread through hacked maintainer accounts. This is credential harvesting at supply-chain scale.
| What attackers wanted | Why it matters | Control |
|---|---|---|
| Maintainer and developer logins | One account can publish to many users | Phishing-resistant MFA |
| GitHub and cloud tokens | A token can reach code and infrastructure | Short-lived tokens and rotation |
| Trust in popular packages | Updates install automatically | Dependency review and pinned versions |
CISA’s advice included requiring phishing-resistant MFA on all developer accounts, rotating credentials, and turning on secret scanning. Those are technical controls. However, people still decide whether to approve a prompt or trust an alert, so awareness training matters too.
So five principles make developer training stick.
The same ideas fit any team. Role, repetition, and measurement matter more than length.
Threatcop does not provide secure coding courses for specific languages or frameworks. Specialist developer-training platforms do that. Instead, Threatcop covers the other half: the attacks that target people, including developers.
Threatcop Security Awareness Training (TSAT) lets teams build role-based groups, so engineers get lures that match their work. Its simulations run across multiple attack vectors, and its Employee Vulnerability Score shows who acts on them. Repeat-offender identification points coaching at the people who need it.
Threatcop Learning Management System (TLMS) delivers security awareness lessons with role-appropriate content, quizzes, and gamified courses, so technical teams get short lessons that fit their risks. And Threatcop Phishing Incident Response (TPIR) gives engineers a one-click way to report a suspicious message, such as a fake registry alert, from email or WhatsApp.
If developers can only do a few things this quarter, start here.
Each item is small. Together, they cover both halves of secure coding training for developers: safer code, and safer logins.
Developer security has two halves, and most programs cover only one. Teach developers to treat AI-written code as untrusted, and to review it with a short habit. Teach them, too, that they are targets, because one stolen login can reach thousands of users. Protect their accounts with phishing-resistant MFA, short-lived tokens, and secret scanning. Then train in small pieces built for each role, and measure behavior, not attendance. The tools will keep changing, but a doubtful, well-practiced developer will keep catching what they miss. Start with one review habit and one phishing-resistant login this quarter, then build from there.
Secure coding training teaches developers to write code that resists attack. It covers checking input, handling secrets safely, and avoiding common flaws. It works best when it is short, hands-on, and tied to the tools the team uses.
Not reliably. Veracode found flaws in 45% of the AI-generated code it tested. A Stanford study found that people using an AI assistant wrote less secure code. So treat AI output as untrusted, and review and test it like any outside work.
Vibe coding means developers leaning on AI-generated code, often without stating security needs. It is risky because the code can look right while hiding flaws, and people may trust it too much. Review, testing, and clear security needs cut the risk.
Developers can reach code, tokens, cloud logins, and build pipelines. One stolen login can reach many systems. In 2025, a worm spread through hacked npm maintainer accounts and took over more than 500 packages, as CISA reported.
Use tests built for each role, such as fake package alerts. Require phishing-resistant MFA on developer accounts. Make reporting easy, and measure results. Learning to spot spear phishing helps engineers recognize targeted lures.
Sushant Kumar is the AVP – Technology at Threatcop, bringing over a decade of experience in technology leadership and product development. He has worked across technology-driven organizations, including Paytm, and focuses on building scalable solutions that address evolving business and cybersecurity challenges. His areas of interest include cybersecurity technology, AI-driven security, product innovation, and enterprise technology. He is passionate about using technology to solve complex security challenges.
Help desk impersonation, fake booking-site emails, and vendor risk drive travel cyber losses. See the patterns, the MGM figures,...
Teen-led groups hit M&S, Co-op, and Harrods through help desk calls. See why young people turn to hacking and...
NCA research found cyber suspects average 17 years old, and most start before 16. See why arrests do not...
