Factors influencing the adoption of secure software engineering practices in pre-adoption and post-adoption phases

Abstract Secure software engineering (SSE) is inevitably linked to DevSecOps which aims to embed security at every phase of the software development life cycle. The adoption of SSE practices is however poorly understood, especially in various adoption phases. This study aims to address this gap by exploring what motivates individuals to adopt SSE practices, and investigating how this differs between the pre-adoption and the post-adoption phase. A survey of people working in software development (N=463) recruited through the Prolific platform was conducted to investigate the determinants of behavioral intention to practice SSE. The measurement instrument was validated with a confirmatory factor analysis. Covariance-based structural equation modeling (CB-SEM) was used to determine associations between constructs based on the theory of planned behavior (TPB), technology acceptance model (TAM), and awareness of security risks to developed software and the newest SSE practices. The results indicate that TPB, TAM and awareness explain adoption of SSE practices well. They also indicate major differences between the pre-adoption and post-adoption phases as none of the meaningful associations overlapped between the phases. In the pre-adoption phase, associations of behavioral intention with subjective norm and both awareness constructs have the meaningful effect sizes. Additionally, a non-significant association with perceived usefulness has a small effect size. In the post-adoption phase, behavioral intention was associated with attitude toward SSE and ease of use. Key implications of this study stem from the detected differences between adoption phases which should be considered both in future studies on this topic, and in practical settings in which SSE and thus DevSecOps is being implemented.