SSDLC with SAMMcentric: create transparency, prioritize measures, strengthen your SSDLC sustainably

You develop software – but how secure is your process really? Whether you've already introduced DevSecOps practices or are just getting started: without a clear baseline assessment, the full picture is missing. SAMMcentric measures your secure software development life cycle – from governance to operations.

Illustration: Person mit Lupe untersucht PC mit Loch + Fußspuren im Vordergrund, in Gedankenblase 2 Sicherheitsexperten.

Where does your secure SDLC stand today – and where are the concrete security gaps?

Many teams don't know where they stand on security or what's actually relevant in their market. Checking off compliance checklists isn't enough. Without a clear baseline, orientation is missing: which measures deliver real value? Where are the blind spots?

With SAMMcentric, based on the OWASP SAMM 2.0 model, we make your software security measurable – from governance through design to operations.

Baseline assessment with a practical perspective and risk-based solutions

We don't just evaluate from an ivory tower – we dive in. With SAMMcentric, we check all areas of your software development: governance, design, implementation, verification, and operations. We don't just look at documents – we experience your processes live. Through shadowing and workshops, we understand how you really work.

The result: an honest baseline assessment plus concrete measures that fit your market and your reality.

Why SAMMcentric is worth it

A structured SSDLC directly contributes to your cyber resilience. Here's what you get in concrete terms:

Your path to secure software – we guide you every step of the way

Secure software development needs more than checklists – it needs an understanding of your processes and your market. As experienced developers and security experts, we combine OWASP SAMM 2.0 with a genuine practical perspective. We don't just evaluate – we help you implement the right measures. Let's take your software security to the next level together!

SAMMcentric: from analysis to roadmap in three phases

Frequently asked questions about SSDLC

What is an OWASP SAMM assessment?

A structured fitness check for your software development. We assess your security practices across all areas – from governance through design and implementation to verification and operations. The basis is OWASP SAMM 2.0, the leading standard for software security maturity.

Is this a classic IT security audit?

Not exactly. A classic IT security audit typically checks against a fixed set of criteria and delivers a pass/fail result. Our SSDLC assessment based on SAMM instead evaluates your maturity level across all business functions and shows you a prioritized path forward – rather than just a snapshot in time.

What sets your assessment apart from a classic security review?

We don't stay on the surface. Through shadowing, we experience your processes live and understand how you really work – not just what's written in documents. And: we don't just evaluate, we help directly with implementation.

Which companies is the assessment suitable for?

For anyone who develops software and wants to professionalize their security processes. Whether startup, mid-sized company, or enterprise – if you have your own development team, we can help you increase your security maturity.

What is OWASP SAMM 2.0?

The Software Assurance Maturity Model is an open-source framework for assessing and improving software security. It covers the complete software lifecycle and is technology- and process-agnostic. SAMM 2.0 is the industry standard for measurable software security.

How does an OWASP SAMM assessment work?

In three clear phases: first we check governance and conduct an initial assessment (phase 1). Then we dive deep into design, implementation, verification, and operations – including shadowing (phase 2). Finally, we develop solutions together and prioritize measures (phase 3).

Do we need the assessment even if we already have security measures in place?

Especially then! Many teams have implemented individual measures but lack an overall picture. SAMM helps you understand where you really stand, which gaps still exist, and where to best invest your energy.

What happens after the assessment?

You receive a clear action plan with prioritized measures. And if you'd like, we stay by your side: thanks to our development experience, we can support you directly with implementation – from security training through process optimization to tool integration.

How long does the entire assessment take?

A total of 5 days on-site, spread across three phases. In between, there is time for our analysis and your preparation. From kick-off to final presentation, plan for approximately 4–6 weeks, depending on your availability.

OWASP SAMM vs. BSIMM – what is the difference?

Both assess software security, but in different ways: BSIMM shows what other companies are doing – a descriptive industry mirror based on 130+ firms. OWASP SAMM provides concrete recommendations on how to improve – prescriptive and implementation-oriented. SAMM is open source, flexible, and free. BSIMM is commercial and less accessible. Our preference: SAMM – because it doesn't just show you where others stand, but points you toward a clear path forward.

Do you really know where your SSDLC stands?

We'll show you – in 5 days. With a clear baseline assessment, prioritized measures, and a roadmap that fits your business.

Marc Lenze

IT-Security Business Development Lead

Marc Lenze

IT-Security Business Development Lead