Building a Scalable AppSec Training Program

This document is a case study detailing the development of a scalable application security (AppSec) training program for a global hospitality and gaming enterprise. The organization faced significant challenges in meeting compliance audit requirements while ensuring software security across its development teams. Internal training methods were inconsistent and lacked depth, prompting the need for a formal, documented security training program. CMD+CTRL collaborated with the organization to create role-based learning paths tailored to the responsibilities of various stakeholders in the software development lifecycle (SDLC). The resulting program was designed to be audit-ready, providing structured reporting to satisfy compliance requirements. Key outcomes included meeting audit deadlines prior to rollout, high engagement and completion rates among learners, and plans for future program expansion. The partnership with CMD+CTRL enabled the organization to transform compliance pressures into opportunities for enhancing their software security training initiatives.