Pentester here, ~10 years experience. My specialty is crystal-box security, as in, pentesting with the source code, so I've seen many codebases and I've seen many companies trying to secure their development process. In recent years more companies are trying to develop "secure by design", also called "shift-left" or "build-security-in". The main issue is that software is complex. If you have a simple CRUD API, you can actually make it very secure quite easily. But real systems are made up of many components, which are constantly developing. So even if you make a system that's secure today (you secure it by design), management is going to wake up tomorrow with some hip use case that doesn't fit your initial design, and you have to hack some stuff together to make it work. You never have the time to go back to the drawing board and build a perfect design around the new situation. It's just like building the right abstraction layers. It will be tight in the beginning, then you develop, and at some point you need to refactor to make it tight again. But there is only so much time you can spend on it, so you're behind on the facts. On top of that you have a landscape of applications that interact with each other, which are all developing, so most of the time there is no one that can oversee it all. Architects just draw abstractions; they don't understand the system on the code level. I don't agree with the statement that security costs more or slows the process. Proper security design should help you to create more structure and clarity. Better structure should allow for quicker development. Doing Threat Modeling helps you understand the application better. This in turn should help you restructure your code. If it's not an addition to your development process, you're not doing it right. Some awful trends are: just Googling "how do I do DevOps security" to just cram a bunch of tools in the pipeline. They buy some scan tool that scans for outdated packages and they dump a list of 1000 findings in the developer mailbox. They take bullshit governance-stuff from the policy documents and make a checklist from it, causing massive overhead while adding little to the actual security process. The list goes on and on. More on reddit.com

I have not seen any college classes about secure software development because the mentality is usually I need to make this work to finish this project. Who cares about best practices, ci/cd, sast/dast, etc... You can learn more about secure code in websites like https://www.securecodewarrior.com/ or https://pentesterlab.com/pro . I think it could be because professors are more research focused and lack industry experience unless he/she worked as security architect or product security roles before More on reddit.com