Company: SecureFlag
Co-Founders: Andrea Scaduto (CEO) and Emilio Pinna (CTO)
Website: https://www.secureflag.com/
About SecureFlag
SecureFlag started in London in 2019. Our two founders, both security practitioners, kept seeing companies spend heavily on scanners and penetration tests to find vulnerabilities, only for the same flaws to come back in the next release. Finding problems was well funded, but preventing them was not.
The insight was that teams cared about security, but the systems they worked in made secure behavior difficult to sustain, especially as AI continued to accelerate software development.
Challenges
At the time, the industry was increasingly embracing shift left. In practice, it often meant running the same scanners earlier and handing developers a longer list of findings. SecureFlag set out to make shift left practical by embedding threat modeling and secure coding earlier into everyday development, including AI-assisted workflows.
Back then, secure coding training was videos and quizzes that developers sat through and then forgot. We built hands-on virtualised labs in real development environments where developers identify risks, model threats, and fix vulnerabilities using the same tools and technologies they use every day—including modern IDEs, pipelines, and, more recently, AI coding assistants. Maintaining realistic environments across a wide technology stack is far harder than producing slides. It is also why the learning carries over to production code.
Shift left only works if developers want to take part, but mandatory training often feels like a burden. To engage developers, we used points, awards, and tournaments so people joined in because they wanted to. Developers recommending us to each other became our main growth channel.
Secure coding starts too late if the design itself is flawed, so we moved earlier by launching ThreatCanvas, an automated threat modeling tool that generates complete threat models in seconds. This makes risks visible at the design stage, before any code reaches the repository. We also added continuous, audit-ready compliance reporting across ISO, SOC 2, PCI, HIPAA, and OWASP ASVS, so security leaders can demonstrate progress in managing risk. Training, threat modeling, and compliance now sit together in one Developer Security Enablement Platform.
Impact
SecureFlag turns shift left from a slogan into a working practice by helping teams move from finding problems after release to preventing them during design and coding. More than 350 enterprise teams in over 40 countries use our platform to make secure-by-design a measurable security control.
Organisations using SecureFlag see:
- 21% fewer new security tickets
- 27% faster vulnerability remediation
- 24% less time spent on security rework
- 2.4x ROI within 12 months
We found that the training developers want and the security enterprises need can be met with the same approach. The results suggest that organisations can also reduce vulnerabilities at scale, even as AI speeds up software delivery.
Want to find out what TechRound can do for your business?
