I'm wondering if anyone has seen any case-studies or references from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved.
Obviously each development department is likely to be a unique case, but that doesn't tend to stop management asking roughly what the costs of a programme would be before spending a lot of time on scoping, so any information would be useful.
Edit: To start answering my own question I found this recent article which links to this aberdeen group which looks to have some interesting numbers (although frustratingly little data on the size of companies reviewed)
Edit2: Another reference here. It's a bit academic and formula heavy, but some interesting information