Friends over at Cigital are starting a web BSIMM survey. While I do not generally endorse vendor studies, I do think the original BSIMM study a well-done investigation of how software security is practiced in some of the leading enterprises. If you belong in an organization that has a software security program, you may want to participate in this study. URL is here:
Chenxi Wang's blog 