Key theses voiced together with colleagues from the financial industry during the discussion of secure development challenges:

• SSDL processes, roles and tools impact the time-to-market of a product, but it is possible to reduce the impact. For example, by automating the processes and, in some scenarios, by taking risks. In the latter case, it’s important to strike a balance between the risk appetite of the business owners (i.e. the financial and reputational losses that the business is willing to tolerate) and the requirements of the regulators. 
• The “platformisation” of development is a trend that needs to be considered by any organisation developing financial software. Bringing key skills together in a platform team and then scaling them out to dev teams allows expert resources to be retained as the scale of development grows. Also, this is the right way to implement Security Champions program.
• Integrating and supporting open source or buying a commercial solution for secure development – the answer to this question relies on the economics. Building an in-house dev team to adapt an open source solution to your existing SSDL processes is a high-risk investment. Instead of instruments, it’s better to invest in processes that are tool-independent and can be supported by any instrument.