Quantifying developers' adoption of security tools

Security tools could help developers find critical vulnera-bilities, yet such tools remain underused. We surveyed de-velopers from 14 companies and 5 mailing lists about their reasons for using and not using security tools. The resulting thirty-nine predictors of security tool use provide both ex-pected and unexpected insights. As we expected, developers who perceive security to be important are more likely to use security tools than those who do not. But that was not the strongest predictor of security tool use, it was instead devel-opers ’ ability to observe their peers using security tools.