Application security is increasingly influencing purchasing decisions within the software industry, according to Checkmarx’s annual report. Nearly 49% of chief information security officers (CISOs) across various industries and regions confirmed that buyers frequently consider security as part of their decision-making process, with a quarter saying it is always a factor.

This trend is particularly strong in Europe, where regulatory frameworks like DORA have made security a critical consideration, with 58% of respondents reporting that security is always a factor in purchasing decisions. In contrast, only 33% of respondents in the Asia Pacific region and just 8% in North America shared the same view.

The report reveals a significant shift in responsibility for application security. In nearly half of software product companies, security oversight has moved beyond the CISO’s office, with development teams now taking on greater responsibility for ensuring secure and scalable delivery. This change has led to a growing trend of developers managing application security decisions and budgets, embedding security earlier and more efficiently in the development process.

Jonathan Rende, chief product officer at Checkmarx, highlighted that “AppSec is now a competitive differentiator, a budget priority, and a boardroom issue.” As development teams assume more responsibility, CISOs are shifting their focus to governance, strategy, and collaboration to ensure security outcomes remain on track.

However, the report also points to challenges in maintaining consistent security coverage across applications. Many organizations are experiencing fragmented security practices, with only 40% of business operations running on secure applications. Furthermore, 70% of organizations said that at least half of their applications lack robust security measures.

On a positive note, the report indicates that budgets for application security are on the rise, with 78% of respondents reporting an increase in spending last year. A significant 40% of them saw substantial budget growth, and more than 70% expect this trend to continue into the next year.

Despite these positive developments, the report reveals communication issues at the executive level. While 62% of CISOs report application security metrics to their boards, the focus remains primarily on vulnerability counts, with only a quarter linking those metrics to critical business outcomes like brand reputation or regulatory exposure. Moreover, nearly 20% of CISOs admitted that they do not report on application security risks at all.

The report concludes that CISOs must redefine their role, moving from direct control to governance. They need to foster a culture of shared responsibility by incorporating feedback from developers and aligning security with business objectives. As security responsibility shifts toward development teams, CISOs must lead with influence, establishing frameworks rather than creating roadblocks to progress.