only 30 percent reported having established a security assurance program in
their own development process, while even fewer, only 25 percent, had adopted
a software security testing process using sophisticated tools. This despite the
fact that 82 percent of respondents’ firms develop software for use outside