| Abstract: |
Database security is still evaluated largely through infrastructure checklists, while the software artefacts and engineering processes that produce databases remain weakly linked to measurable security outcomes. This paper reports an empirical study that measures the performance of database security using software engineering (SE) constructs. Data were collected over twenty-four months from 240 database instances operated by eight engineering teams in the Sultanate of Oman, spanning e-commerce, banking/fintech and healthcare, across five DBMS platforms. Ten process and code metrics, including security defect density, code churn, complexity, review and static-analysis coverage, patch latency, encryption coverage and compliance maturity, were instrumented, and a composite Security Performance Index (SPI) was built from six weighted dimensions. Analysis combined descriptive statistics, correlation, paired-samples t-tests with Cohen's d, and standardised regression (R-squared = 0.568, F(6, 233) = 51.1, p < 0.001). Security defect density correlated strongly with the number of disclosed vulnerabilities (r = 0.646, p < 0.001), while patch latency (beta = -0.413) and encryption coverage (beta = +0.369) were the strongest determinants of the SPI. After adoption of the SE-based framework, mean patch latency fell from 13.2 to 4.4 days (-66.7 percent, d = 2.19), security defect density fell from 0.80 to 0.35 defects per KLOC (-56.3 percent, d = 2.11), and the SPI rose from 0.651 to 0.869 (+33.5 percent, t = 65.61, p < 0.001), with 93.1 percent throughput retention and only 6.9 percent added query latency. Software engineering metrics are therefore valid, actionable predictors of database security performance, and measurable gains are obtainable without prohibitive runtime cost. The results are read against Oman's Personal Data Protection Law (Royal Decree 6/2022), enforceable since 5 February 2026, and the Central Bank of Oman's cyber security requireme |
