Caracterização de Práticas de AppSec e da Adoção de Ferramentas Automatizadas de Segurança: Um Questionário Abrangente com Desenvolvedores Brasileiros

Abstract

The adoption of Application Security (AppSec) practices is essential to protect software systems against vulnerabilities and cyber threats. However, the effectiveness of these practices strongly depends on their consistent adoption and on developers’ perceptions regarding their ease of use, perceived effectiveness, essentiality, and applicability within the software development context. This study aims to characterize a set of AppSec practices in terms of frequency of use, ease of application, perceived effectiveness, and perceived essentiality in software development. In addition, it seeks to analyze how automated security tools are being incorporated into the development process and to identify the main challenges faced by Brazilian developers in their adoption. To achieve these objectives, we first conducted a survey of related work in the scientific literature, from which an initial and comprehensive set of software security practices was identified and cataloged. This initial set then underwent an iterative process of filtering, refinement, and grouping, carried out by experts in Software Engineering and Software Security, intending to reduce redundancy, harmonize terminology, and ensure both conceptual and practical relevance. As a result, a final set of 16 AppSec practices was defined. Subsequently, a questionnaire was designed and administered to software developers working in Brazil, yielding a total of 83 valid participants. The questionnaire collected information about participants’ profiles, their experience with software security, their adoption and perceptions of AppSec practices, and their use of automated security tools. The results reveal a heterogeneous landscape of AppSec practice adoption, with significant variations across practices in terms of frequency of use, ease of application, perceived effectiveness, and perceived essentiality. Practices such as code review and the use of static analysis tools show widespread adoption, whereas others, such as threat modeling and penetration testing, exhibit lower applicability. Moreover, although automated security tools are widely perceived as valuable, developers report recurring challenges related to learning curves, false positives, and integration into existing development workflows. The findings contribute to a deeper understanding of the actual use of security practices and tools in software development within the Brazilian context. The results are expected to inform educational initiatives and organizational strategies aimed at strengthening developers’ security culture and promoting a more consistent and effective adoption of AppSec practices.