Your AppSec program is working if you can answer five questions with evidence: what do we run, who owns it, how fast do we fix severe issues, what stops a bad release, and can we prove it. Any question you answer with "I think so" marks the next thing to fix.
The five questions
| Question | Good answer looks like |
|---|---|
| 1. What software do we run? | A current inventory with owners and exposure |
| 2. Who owns each system? | Every repository maps to a team and a contact |
| 3. How fast do we fix severe issues? | You can show ages and trends from your own data |
| 4. What stops a risky change? | Gates and review rules, with a logged exception route |
| 5. Can we prove it? | Evidence collected routinely, not rebuilt before an audit |
How to score yourself
For each question, choose one of three answers: yes with evidence, yes but from memory, or no. Do it as a group with engineering and security present, and write down the evidence for each yes. People are often more confident than the data supports.
What each gap suggests
- Gap in 1 or 2: run discovery and assign owners before buying more tools.
- Gap in 3: check triage, targets and fix effort. Reachability and exploit context can reduce the pile.
- Gap in 4: introduce gates in stages. See rolling out gates.
- Gap in 5: automate evidence collection and keep a dated record.
Compare with a model
A structured model gives a wider view. OWASP SAMM breaks software security into Governance, Design, Implementation, Verification and Operations, with three practices in each. The five questions above sit mostly in Governance, Implementation and Verification, so also ask whether Design and Operations are covered. Read what SAMM is.
Repeat it
Run the check each quarter. The point is the trend. If an answer improves from "from memory" to "with evidence", the program is moving.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how the view stays current without a manual refresh. Questions three and five depend on data like this.
Quick check
How often should we run the check?
Every quarter is enough for most teams.
What if we fail most questions?
That is a normal starting point. Fix questions one and two first, since the others depend on them.
Safeguard provides asset discovery, continuous monitoring, policies and gates, and compliance and evidence automation, which map to the five questions. You can start with a free scan.
Sources
- OWASP SAMM model page. Paraphrased.
Last reviewed: 19 October 2026.
