Software developing small and medium enterprises (SMEs) play a crucial role as suppliers to larger corporations and public administration.It is therefore necessary for them to be able to demonstrate that their products meet certain security criteria, both to gain trust of their customers and to comply to standards that demand such a demonstration.In this study we have investigated ways for SMEs to demonstrate their security when operating in a business-tobusiness model, conducting semi-structured interviews (𝑁 = 16) with practitioners from different SMEs in Denmark and validating our findings in a follow-up workshop (𝑁 = 6).Our findings indicate five distinctive security demonstration approaches, namely: Certifications, Reports, Questionnaires, Interactive Sessions and Social Proof.We discuss the challenges, benefits, and recommendations related to these approaches, concluding that none of them is a one-size-fits all solution and that more research into relative advantages of these approaches and their combinations is needed. CCS Concepts• Security and privacy → Social aspects of security and privacy.

We present a precise correspondence between separation logic and a simple notion of predicate BI, extending the earlier correspondence given between part of separation logic and propositional BI. Moreover, we introduce the notion of a BI hyperdoctrine, show that it soundly models classical and intuitionistic first- and higher-order predicate BI, and use it to show that we may easily extend separation logic to higher-order . We also demonstrate that this extension is important for program proving, since it provides sound reasoning principles for data abstraction in the presence of aliasing.