BlackDuck-BSIMM16-2026.md

## Executive Summary BSIMM16 (2026) is an observational software security maturity report from Black Duck presenting findings from assessments of 111 organizations. It documents the BSIMM software security framework (128 activities across Governance, Intelligence, SSDL Touchpoints, and Deployment), top observed activities, fast-growing controls, and trends — notably AI/ML adoption, regulatory pressures (SBOMs and EU CRA), evolving training (just-in-time and champions), and increased automation — and provides practical guidance and scorecard methodology for building, maturing, and scaling software security initiatives.