Skip to content
Developer Insights

Understand Your Developers.
Deliver Smarter Security Training.

Real security improvement requires visibility into both code risk and developer capability. By pairing live risk signals with learner profiles and assessments, organizations can prioritize training that measurably reduces risk—without slowing engineering teams.

Learner Profile

Provide a personalized approach to training by leveraging a learner's specific experience.

Developer Security Knowledge Assessments

Evidence-based insights into a team's proficiency ensuring training is focused on relevant needs.

Aspen: Adapt

Automates personalized secure coding training, allowing teams to prioritize and assign targeted lessons based on actual risks.

Learner Profile

Train learners based on who they are and what they build.

Use learner context to move beyond generic training and align learning with real-world environments.

Learner Profiles help you account for: 

  • Experience and background

  • Languages, frameworks, and platforms

  • Responsibilities, tools, and security exposure

This ensures training is practical, targeted, and applied where it matters.

Security Journey Developer Insights Intro

Developer Security Knowledge Assessments

Understand what developers know and where training is needed.

Establish a clear baseline of security knowledge across your development team, from foundational risks to advanced attack techniques and emerging areas like AI/LLM security. Assessments provide objective insight into strengths, gaps, and progress, so training decisions are based on evidence rather than assumptions.

Developer Security Knowledge Assessments help you:

  • Establish a security knowledge baseline and identify gaps across individuals and teams across multiple topic areas
  • Measure progress over time to understand where training is making an impact with individual scores, proficiency levels, team-level dashboards, and exportable data to track progress and guide training decisions.
  • Streamline the learning experience by allowing developers to test out of content they already know
This insight helps ensure training is focused, relevant, and aligned with real needs.
Try the Assessment
SJ_Assessment_web
Four Key Areas

Assess Knowledge Across Four Key Areas

Assesses the ability to identify and mitigate code vulnerabilities through questions targeting specific issues from the OWASP Top 10 and CWE Top 25 across different programming languages.

Topics Assessed:

  • CWE Top 25
  • OWASP Top 10

There are three types of interactive coding questions in Secure Coding Assessments:

  1. Identify the line of code that will secure the vulnerable line

  2. Identify the block of code that creates a vulnerability

  3. Identify which line of code makes the code vulnerable

Security Journey Assessment Question

Use real code activity to drive targeted security training

Connect Security Journey to GitHub to identify security weaknesses as they’re introduced in real code, and align training directly to the risks developers are actually creating.
Schedule a Demo

Aspen: Adapt

Turn real security findings into targeted secure coding training

Aspen: Adapt transforms real vulnerability signals into focused, role‑relevant secure coding training. By ingesting CWE‑based findings from development and security tooling, Aspen: Adapt ensures training aligns with the risks teams are actually introducing across codebases, pipelines, and workflows.

Whether findings come from CI/CD pipelines, security scanners, or GitHub activity, Aspen: Adapt creates a direct connection between real‑world risk and meaningful skill reinforcement.
SJ_AspenAdapt_web

Ingest findings from anywhere

Send CWE‑based security findings directly to Aspen: Adapt using the Adapt API. Teams can integrate from any CI/CD system, security scanner, or custom workflow, giving complete flexibility in how and where real code risk is identified.

Key capabilities include support for multiple tools and pipelines, no requirement for source‑control integrations, and compatibility with customized or enterprise‑scale workflows.

GitHub integration available out of the box

For teams that prefer a turnkey option, Aspen: Adapt continues to support the GitHub Adapt Action. This integration analyzes commit activity to identify introduced CWEs without requiring custom setup or pipeline changes.

Prioritize what actually matters

Aggregate findings across tools, repositories, and teams to create a consolidated, evidence‑based view of emerging security weaknesses. Aspen: Adapt helps AppSec and engineering leaders focus on the highest‑impact risks with confidence rather than assumptions.

Assign targeted training in minutes

Map CWE findings directly to Security Journey lessons and learning paths. Training assignments reflect real development behavior and are delivered without disrupting developer workflows or slowing delivery.

Built for modern AppSec programs

Aspen: Adapt is API‑driven for flexibility, supports multiple tools and environments, provides centralized visibility across teams, and ensures secure coding training is guided by evidence instead of intuition.

Frequently Asked Questions

What does Aspen Adapt do?
Integrates with customers’ existing scanning tools to ingest CWE codes.
How does Security Journey detect issues?
Security Journey ingests security findings from your existing development and application security tools across your engineering environment. These findings may originate from source code management platforms (such as GitHub) as well as other security scanning and analysis tools. Security Journey analyzes these signals to identify risk patterns and developer skill gaps, which then drive targeted training and remediation guidance. 
What kind of training does the integration trigger?
Admins can assign Security Journey modules mapped directly to the CWE through Security Journey’s CWE filtering, enabling right-topic, right-moment learning.
Does the integration disrupt developer workflows?
No. Findings appear in the platform for admin review, without PR spam or mid-flow interruptions to the developer.
What data does Aspen Adapt review?
It analyzes commit metadata and vulnerability-related CWE patterns; it does not require raw source code to be sent to Security Journey. 
How does Aspen Adapt support training relevance?
It continuously trains developers on CWEs actively being committed, ensuring training aligns with observed behaviors, not generic assumptions.
What is required to connect GitHub?
The connection requires generation of a Security Journey API key configured as a repository secret. 
Does Aspen Adapt work with existing developer learning paths?
Yes. While the GitHub integration does not currently recommend training automatically, it adds CWE findings to the platform, allowing admins to use that information when assigning training within existing role-based, compliance-based, or topic-based learning paths. 
How does the integration help admins prioritize?
The platform consolidates all CWE occurrences across repositories, giving admins a prioritized view of emerging weaknesses and where to focus training. 
Is assignment creation automated?
Today, assignment mapping is performed by admins; automation is planned for future phases.
What problems does Aspen Adapt solve for organizations?
Aspen Adapt helps organizations identify which developers introduced specific CWE findings. It centralizes these CWE occurrences in the Security Journey platform. It provides clearer visibility into weaknesses and what needs reinforcement.
How does Aspen Adapt relate to broader secure development practices?
Aspen Adapt is designed to complement and extend broader secure development practices by integrating with the tools teams already use to build and manage software. Instead of treating security as a separate, downstream activity, Aspen Adapt helps organizations surface and address security issues as part of everyday development workflows—reinforcing secure coding principles and reducing risk earlier in the lifecycle.