Engaging Company Developers in Security Research Studies: A Comprehensive Literature Review and Quantitative Survey

Abstract

Previous research demonstrated that company developers excel compared to freelancers and computer science students, with the corporate environment significantly influencing security and privacy behavior. Still, the challenge of recruiting a substantial number of company developers persists, primarily due to a lack of knowledge on how to motivate their participation in empirical research studies. To bridge this gap, we performed a literature review and identified a conspicuous absence of information regarding compensation and study length in the domain of security developer studies. To support researchers struggling with the recruitment of company developers, we conducted an extensive quantitative survey with 340 professionals. Our study revealed that 62.5% of developers prioritize security tasks over software engineering tasks, and 96.5% are willing to participate in security studies. Developers consistently ranked security higher than other barriers and motivators. However, repeat participants perceived security tasks as more challenging than first-time participants despite having 40% more general experience and 50% more security-related experience. Further, we discuss Qualtrics as a potential recruitment channel for engaging company developers, acknowledging various challenges. Based on our findings, we provide recommendations for recruiting a high number of company developers.