We all know the tenet "write the test first" - but what if the developer has insufficient knowledge of software security? Our study of software development in public organisations showed that both when developers perform their own tests, and when there is a dedicated QA testing crew, practically all tests are functional with no particular security focus.
