Turn software security maturity into a practical roadmap.
Understand where your software security practices stand, where the biggest gaps are and what to improve next.
A framework for improving software security.
OWASP SAMM is an open framework for assessing and improving software security practices. It structures software security across five business functions and provides a maturity model that organizations can use to understand where they stand and what to improve next.
Learn more on the OWASP SAMM websiteFive functions. The full software lifecycle.
Governance
Set direction through strategy, policy and security education.
Design
Address threats, security requirements and architecture decisions.
Implementation
Secure how software is built, deployed and corrected.
Verification
Check architecture, requirements and security through testing.
Operations
Manage incidents, environments and security in day-to-day operation.
Not every practice matures at the same pace.
Maturity is assessed across individual practices. A team can have structured build security and still be starting with threat assessment. The roadmap addresses those specific gaps.
- 0
Implicit
Practices are informal or absent.
- 1
Initial
Basic security activities are in place.
- 2
Structured
Practices are repeatable and more comprehensive.
- 3
Optimized
Practices are refined and improved over time.
How the assessment works.
- 01→
Discover
Interviews, current practices, policies and engineering workflows.
- 02→
Assess
Map current maturity against SAMM practices.
- 03
Prioritize
Turn gaps into a practical improvement roadmap.
A maturity score does not secure a product.Better engineering practices do.
Policies and reports only matter when they change how pull requests are reviewed, architecture decisions are made and releases are handled. Our goal is not to increase a score. It is to make software security measurably harder to break.
What you leave with
- Maturity overview by SAMM practice
- Structured gap analysis
- Prioritized improvement roadmap
- Executive summary for leadership
- Practical recommendations for engineering teams
| Practice | 0 | 1 | 2 | 3 |
|---|---|---|---|---|
| Threat assessment | 0: Current | 1: Gap to target | 2: — | 3: — |
| Secure build | 0: Current | 1: Current | 2: Current | 3: Gap to target |
| Security testing | 0: Current | 1: Current | 2: Gap to target | 3: — |
- NowMap critical threats
- NextStrengthen build controls
- LaterExpand security tests