The Effects of Cybersecurity Training For Software Development Organizations

Background: This study examines the perspectives of developers and managers on software development organizations regarding the effectiveness of cyber security training in their everyday coding procedures. Purpose: The purpose of this study is to investigate how management’s expectations of up‑skilling and re‑skilling through cybersecurity‑awareness training, align with the skill gains that software developers themselves perceive. The research questions addressed in the study are: How do software engineers perceive cybersecurity training in relation to up-skilling and re-skilling? How does an organization's management perceive cybersecurity training? Method: A qualitative approach using semi-structured interviews with 6 managers and 8 developers from three different organizations were conducted. The selected companies are from Sweden and Greece, with one public sector agency and two private sector companies. The method of choice was based on the theory of innovation diffusion by Rogers. Empirical findings and analysis: From the analysis of all five characteristics of the innovation diffusion model, we see indications of high alignment between management and system development contexts on how cybersecurity training contributes to both up-skilling and re-skilling. This is especially observed in the view of compatibility, complexity, and relative advantage. However, partial alignment and misalignment were found in the remaining characteristics: observability, trialability. Conclusions: The study suggests that while developers experience cybersecurity training as practical and growth-oriented, management requires clearer evidence of return and observable impact to support sustained investment. It is observed that management is lacking pre-investment analysis. Recommendations for future research: We propose for future research to focus on comprehensive data that includes more companies within the sector. Furthermore, combinations of quantitative and qualitative methods to extract useful data that helps in remediating the various misalignments between developers and managers could be conducted.