OWASP SAMM treats education as a practice called Education and Guidance with two streams. At level 1 it expects security awareness for everyone building software and a named security champion in each development team. Levels 2 and 3 add role and technology guidance, then internal, developer-led programs.
What the practice is for
SAMM describes Education and Guidance as giving people involved in the software lifecycle the knowledge and resources to build and deploy secure software. It leans on training, and also on cultural change that encourages teams to work together. It sits under Governance in the model.
The ladder at a glance
| Level | Stream A: Training and Awareness | Stream B: Organization and Culture |
|---|---|---|
| 1 | Awareness training for everyone working on software development | A security champion in each development team |
| 2 | Technology and role specific guidance, including language and platform considerations | A secure software center of excellence |
| 3 | Standardized internal guidance aligned with your secure development standards | A secure software community that includes everyone involved |
Reading level 1 honestly
Level 1 is modest on purpose. It does not ask for a catalogue of courses. It asks that people have access to resources and that every team has a named person who connects it to the security group. The Stream B detail says that champion gets protected weekly time for security work, joins periodic briefings, receives extra training, and helps verify and prioritize security defects and take part in risk, threat and architecture reviews.
If you already have the named person but not the protected time, you have not met the intent. The time is the point.
Level 2: guidance that is specific
Generic awareness runs out quickly. Level 2 asks for guidance specific to each technology and role: what a Go service owner needs differs from what a mobile developer needs. For many teams this is the jump that matters, because it ties training to the code people actually ship.
The Stream B level 2 activity is a chartered group of architects and senior developers from across business units and technology stacks. They set standards and good practice, support product champions who help teams adopt tooling, evaluate security tools and review significant architectural changes.
Level 3: owned by developers
At level 3 the program is run by developers from different teams, with a shared platform for knowledge sharing organized around technologies and roles. It recognizes active contributors and can surface future champions.
How to use this
- Score yourself with SAMM's own answer scale for each level.
- Close level 1 gaps first: awareness for all, and a champion with protected time per team.
- Choose one technology stack for level 2 guidance and write it up before attempting every stack.
- Revisit once a year.
SAMM does not publish a list of success metrics for this practice on the pages we read. It gives quality criteria per level instead. Treat any "SAMM says track X" claim with suspicion unless it points to the criteria.
Where Safeguard fits
Safeguard provides compliance and evidence automation, so records from your education program can sit beside scan and policy evidence. A free scan is a quick way to see your own baseline.
Quick check
Is SAMM a certification?
No. It is an open maturity model you use to assess and plan. No one issues a SAMM certificate that we know of from the pages reviewed.
Do we need all three levels?
No. Pick the level that matches your risk and size, and move up when the lower level is working.
Sources
Last reviewed: 19 October 2026.
