Skip to content
case study Technology / Marketing Automation

A Leading Marketing Automation Company Takes Secure Coding Best Practice To Another Level

How one hour a month of offensive and defensive training kept developers so engaged they finished lessons ahead of schedule.
Industry
Marketing Automation
Customers
1,000+ retailers and brands
Training Time
1 hour per month
Program
12-month training plan
01 · The Company

Protecting customer data for 1,000+ brands

This best-in-class company is an established leader in cross-channel marketing. It works with more than 1,000 retailers and brands, providing SMS, email, identity resolution, and behavioral marketing solutions.

The company treats secure applications as essential to protecting its customers’ data.

02 · The Challenge

Developers needed to think like attackers

Many of the company’s developers hadn’t had much exposure to the offensive side of secure coding. Leadership wanted training that taught how exploits are executed as well as how to prevent them.

After exploring their options, they chose Security Journey because it met an extensive list of requirements.
training-search --require offense, defense
offensive_contenttrivial elsewhere
hands_onrequired
plan_length12 months
resultSecurity Journey
03 · The Requirements

A year of training that wouldn’t get redundant

The company wanted a truly hands-on approach with enough relevant content to plan a 12-month program that wouldn’t be redundant or boring.

Offensive and defensive training. Teaching how exploits work and how to prevent them is more memorable than teaching fixes alone.

Hands-on means hands-on. Developers actually write secure code.

Digestible lessons. Brief, focused lessons let developers cover multiple topics each month.

Capture-the-flag events. Their Customer Success Manager built a training plan that led into a mid-year hacking challenge.

Security Journey made it easy to set up and run the hackathon. Our customer success manager gave us a roadmap that matched the hacking challenge to the lessons developers had already completed.

Director of Information Security, Marketing Automation Company
04 · The Solution

Immediate ROI: developers fixed past code on their own

Zoom tracks key risk indicators (KRIs) across its software pipeline. Since rollout, engineers have given positive feedback and find the content contemporary and well-presented.

The return was immediate: developers proactively went back to previously completed code and addressed potential vulnerabilities based on what they learned.

training-plan --month current
time_budget60 min
lesson_length20–30 min
lessons_per_month2–3
statusahead of schedule
05 · The Results

A program developers don’t want to leave

Secure coding training was a hard sell at first. Some developers worried their scores would affect their growth. Leaders made the objective clear (improve security knowledge), which eased those fears.

Because the content teaches practical skills, developers became absorbed in the program and learned new tactics to apply to their applications. Repeating last year’s topics will help them retain it long-term.

Next, the company is considering integrating its SAST and DAST tools to create adaptive training focused on its own vulnerabilities.

Your content is worthwhile, and we see that you’ve already added to it since we started. We have no reason to look anywhere else.

Director of Information Security, Marketing Automation Company
The Program by the Numbers

Small time budget, lasting skills

1 hr

Training time per developer, per month

2–3

Lessons completed each month, 20–30 min each

12

Months of themed, non-repeating training

Download the Case Study

See the full training playbook