DirectDefense CSO outlines ten practices for lasting software security

Christopher Walcutt, the Chief Security Officer of DirectDefense, argues in this Dark Reading opinion piece that the security questions we faced with insecure software in the 1990s still apply, even as technology has evolved.

He frames the discussion around ten practices designed to make software trustworthy for the next 250 years, stressing that security must be embedded in architecture from the start, with secure defaults, approved patterns, clear trust boundaries and built‑in controls that resist insecure outcomes when placed early rather than tacked on later.

Walcutt also invites readers to consider governance questions such as ownership of risk and how to verify that a control works, noting that the exact technology stack in 2276 remains unknowable.

The article then outlines ten concrete practices.

These include maintaining an up‑to‑date inventory of applications, dependencies, tools and external services with clear ownership; verifying every line of code—whether written by a human, generated by an AI assistant, or obtained from a third party—backed by independent security testing; making the secure path the easiest path by integrating security into repositories,

pipelines and coding workflows; and matching security speed to development speed so automation handles repeatable tasks while humans focus on complex decisions. Walcutt underscores the need to control what enters the software supply chain, to pay down security debt (citing Veracode that 82% of organisations are affected), and to measure risk removal by indicators beyond mere vulnerability counts.

He also urges threat modelling of the entire AI system and preserving human accountability, stressing that, even as machines write code, people must retain understanding to challenge output and demonstrate prudent safeguards.