To run a light OWASP SAMM assessment, gather three or four people, walk each security practice, score it honestly with a piece of evidence, then pick two or three gaps tied to your own risks and revisit the scores each quarter. Treat the result as a map of gaps, not a grade.
What SAMM is
OWASP describes the Software Assurance Maturity Model as an open framework that helps organizations formulate and implement a software security strategy tailored to their specific risks. It lists four uses: evaluating existing practices, building a balanced program in well defined iterations, demonstrating concrete improvements, and defining and measuring security activities across the lifecycle. The project page lists version 2.2.0 as the latest, and says SAMM is technology and process agnostic and risk driven, with no single recipe for all organizations.
For a company with 20 to 200 engineers, that tailoring is the point. You do not need to reach the top level in every practice.
Step by step
- Pick the scope. One product line or the whole company. A smaller scope keeps the session to half a day.
- Invite the right people. An engineering manager, a platform engineer, someone from product, and the named security owner.
- Walk each practice. For each, read the descriptions and decide which level your reality matches. Where people disagree, take the lower answer until someone shows evidence.
- Record evidence. A link, a screenshot, a settings export. No evidence, no score.
- Mark the gaps that matter. Which low scores create the most risk for your product and your customers?
- Choose two or three. Put them into the quarterly plan.
- Re-score after three months.
Reading the result
| Pattern | What it usually suggests |
|---|---|
| Low across the board | You are early; start with ownership, inventory and review |
| Strong in testing, weak in governance | Tools exist but nobody decides; add owner and policy |
| Strong in policy, weak in practice | Documents outrun reality; test and trim |
| Uneven between teams | Defaults and templates are missing |
Make the assessment honest
Self assessments drift upward. Counter that with three habits: score the lower level on a tie, ask for evidence, and let someone outside the group sample a few answers. If you later hire an external party, the evidence collected here makes their work faster and cheaper.
What to do with the output
Do not publish scores as a marketing claim. Use them to justify the plan. For buyers, a sentence such as "we assess our practices against OWASP SAMM and track improvements quarterly" is true if you do it, and carries no suggestion of a certification.
Keep it light
The mistake is to spend a quarter on assessment. A first pass should be a few hours. Perfect scoring is not the goal, because the value is in the two or three actions you commit to.
Safeguard helps close several gaps once you find them: dependency scanning and reachability analysis for verification practices, and policies and gates for enforcement. Start with the free scan.
Quick check
Do we need to reach the highest level in every practice?
No. SAMM is risk driven, so target the levels that match your risks and customers.
How often should we re-score?
Quarterly is enough for a first year, aligned with the plan review.
Sources
Last reviewed: 19 October 2026.
