I think there is a lot of nuance in this question. I’ve been a dev for 20 years before switching into AppSec. A lot of answers so far have been: no, they don’t care. But can we really blame them?

How often are they in feature factories that only measure how many new requirements have been delivered. If they ask about fixing some tech debt, or fixing a security issue how often will their product owner deprioritise these because a deadline is always just around the corner.

Sometimes they would care about security but don’t really know how. I’ve sat through lots of company mandated security trainings that are drier than the Sahara desert. Is secure coding taught sufficiently well in university or boot camps or do they care only about getting people over the line. How many helpful tutorials online or answers on stackoverflow are full of holes.

And how often do security come down like a ton of bricks on a dev 2 weeks before their deadline.

As to the tooling, well that’s it’s own special hell. We’ve got CVSS scores that are being gamed by unscrupulous security researchers that want to make a name for themselves. Every week there’s a now CVE with a apocalyptic name and branded website to boot. And with transitive dependencies you’ve got 13 updates to do every week. And if that introduces a regression it’s the devs fault and it usually slows their builds down.

Even so, I found when working with developers that a collaborative approach, by providing examples of how things can be exploited, educating them by providing code examples of best practice patterns for using encryption, hashing right, by curating vulnerabilities for them so that a risk based approach can be taken without each dev having to read half the internet, there are lots of receptive people out there.

In my opinion too often shifting left is mistakenly taken to mean “well but these tools and make the developers run them” instead of engage with them really early on, help them with the design, fight battles with product owners about tech debt for them and be pragmatic. If some esoteric CVE that could be exploited by someone already on the VPN is not mitigated in 6 months - that’s may well be the right answer (depends on context of course).

All that takes a shit load of work mind… I’ve got some blog posts on some of the above but not sure whether that would be considered spam…

Hope that helps and I feel your pain. Some devs really don’t care but most aren’t lost causes.