SecureFlag Reviews & Product Details

SecureFlag is a Developer Risk Management Platform that combines automated threat modeling with hands-on secure coding training to help organizations reduce application risk across the software development lifecycle (SDLC). Designed for enterprise engineering and application security teams, SecureFlag addresses two root causes of application risk: insecure design decisions made before code is written, and insufficient secure coding skills among development teams. The platform enables organizations to identify vulnerabilities at the design stage, build secure coding competency through practical training, and generate continuous, audit-ready evidence of security program effectiveness. Threat Modeling ThreatCanvas, SecureFlag's AI-powered threat modeling product, automates the creation of threat models at the design stage—making security risks visible before development begins. Teams can keep design decisions current as systems evolve, reducing reliance on manual processes and enabling more consistent security reviews across engineering. Secure Coding Training SecureFlag's training platform delivers hands-on labs in real, fully configured development environments, accessible via web browser and created on demand. Developers, DevOps, and QA engineers practice defensive programming in the same tools they use every day, with an engine that live-tests code changes and provides instant feedback. The platform includes learning paths, assessments, tournaments, and adaptive difficulty to support skill growth over time. Key features and capabilities include: - AI-powered automated threat modeling that generates threat models at the design stage, before code is written. - Hands-on secure coding labs in real development environments, replacing ineffective multiple-choice training. - Compliance mapping across frameworks including PCI DSS, ISO 27001, SOC 2, HIPAA, and ASVS, with exportable evidence packs for audits. - Integrations with developer workflows via Jira and GitHub, enabling remediation within existing engineering processes. - AppSec team dashboards providing continuous visibility into skill coverage, risk reduction, and training adoption across teams. SecureFlag supports measurable outcomes across security and engineering, including a 27% reduction in time required to fix vulnerabilities, a 21% reduction in new security tickets, and an average of 3,600 developer hours saved per 100 engineers annually. The platform is used by 300+ organizations across 30+ countries, spanning industries including software development, financial services, healthcare, and fintech. SecureFlag is an OWASP Partner and provides training for OWASP members alongside its enterprise offering.

Product Website

Seller

SecureFlag

Discussions

SecureFlag Community

Languages Supported

Danish, German, English, French, Italian, Japanese, Korean, Dutch, Norwegian, Polish, Portuguese, Romanian, Spanish, Chinese (Simplified)

Overview by

Andrea Scaduto

Value at a Glance

Averages based on real user reviews.

Time to Implement

3 months

View More Pricing Information

SecureFlag Media

Our user-friendly secure coding training platform utilizes gamification techniques to keep developers engaged.

Our labs offer hands-on secure coding training in real development environments.

Our learning paths combine labs with knowledge-base articles and videos.

Generate complete threat models in seconds from text, diagrams, and IaC files - or automate the process using our 'Code Repository to Threat Model' feature.

Simplify threat modeling using built-in risk templates, which are aligned with major compliance frameworks.

SecureFlag Demo - AI-Powered Threat Modeling

Refine the model, adjust assumptions, and select the risk frameworks most important to your organization.

Learn the most up-to-date secure coding practices across a range of languages, technologies, and services with SecureFlag's hands-on labs.

Official Downloads

(5)

edit

G2 reviews are authentic and verified.

Here's how.

Gizem S.

Senior Information Security Specialist

Small-Business (50 or fewer emp.)

9/16/2025

"Senior Information Security Specialist"

5/5

What do you like best about SecureFlag?

Customer Support, Ease of Use, Ease of Integration, Ease of Implementation, Number of Features. Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

the training content not being in Turkish, Frequency of Use. Review collected by and hosted on G2.com.

Verified User in Electrical/Electronic Manufacturing

Enterprise (> 1000 emp.)

9/11/2025

"Secureflag is a great an engaging tool which really benefits every developer."

5/5

What do you like best about SecureFlag?

The hands-on labs, where an unsafe situation can be "re-lived" by the developer and then mediated. Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

In seldom cases (usually code review labs) the criteria for a successful completion on the first try are hard to be met. But this is really very seldom. Review collected by and hosted on G2.com.

Michael T.

Head of R&D

Mid-Market (51-1000 emp.)

9/11/2025

"Managing a software development unit that uses SecureFlag as education platform for secure-coding"

4.5/5

What do you like best about SecureFlag?

ease of use

broad variety on programming languages and tech stacks Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

That it is user bound licensed only.

For my type of demand to buy a "number of education labs / points / ... whatever" for an undefined number of users would better match my requirements Review collected by and hosted on G2.com.

Verified User in Financial Services

Mid-Market (51-1000 emp.)

10/20/2025

"Great for Secure Coding, But Needs More Kotlin Labs"

5/5

What do you like best about SecureFlag?

Helps our developer improve on their secure coding skills Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

limited Kotlin training/labs for our developers Review collected by and hosted on G2.com.

Daniel R.

Cibersecurity Consultant

Computer & Network Security

Mid-Market (51-1000 emp.)

1/24/2024

"A great tool to strengthen security in our code!"

4.5/5

What do you like best about SecureFlag?

One of the greatest strengths of SecureFlag is the flexibility when programming the training paths and the continuous updating of the content of the different technologies it covers. Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

I think the reporting part with activity tracking still needs to develop the full potential it can offer. It is not very intuitive and sometimes it is difficult to obtain the data you are looking for. Review collected by and hosted on G2.com.

What problems is SecureFlag solving and how is that benefiting you?

Our main objective when using SecureFlag is to provide our developers with all the knowledge possible to develop software in the most secure way and, above all, to train new developers who join our company. Thanks to these trainings, we are observing a series of improvements in terms of security, allowing them to apply the knowledge obtained in the trainings to the final code. Review collected by and hosted on G2.com.

Simon T.

Selvstændig

Small-Business (50 or fewer emp.)

12/4/2024

"Quality security training for developers"

5/5

What do you like best about SecureFlag?

Has given all developers a new view on thinking security while developing software.

There is a ton of different languages to choose from, so you can find training that matches your everyday work.

Even for planning there is a tool for getting into security thinking, while planning new features. Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

Learning to use the tool as admin takes a bit of learning. Review collected by and hosted on G2.com.

Verified User in Insurance

Mid-Market (51-1000 emp.)

12/13/2024

"SecureFlag platform feedback"

5/5

What do you like best about SecureFlag?

I was looking for a secure code training platform that fits for various professionals (Project manager,Scrum master, Business analyst, developers,QA engineers, IT managers) with different skillset level (entry to advanced) .

I was looking for variety of technology in the platform. I also wanted option to customize training modules for my employees .I expected the training platform to be hands-on and keep upto date with technology and content. Secureflag met all these requirements and on top of it, they provided a dedicated customer support manager who helped us define the course path for entire IT development team .They helped us launch the training program and secure code tournament . Easy implementation, Labs simulating to real environments are few other factors to choose Secureflag.

They provide great support and the journey with Secureflag has been wonderful. Review collected by and hosted on G2.com.

What do you dislike about SecureFlag?

Most of my meetings with Secureflag had to be done in UK timezone .It will be great if they have resources available in US timezone . Review collected by and hosted on G2.com.