Service · 2–3 weeks · Fixed fee
Know where your application security stands, and what to fund next
I score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.
- 2–3 weeks
- Fixed fee
- OWASP SAMM v2
- NIST CSF 2.0
In short
An application security (AppSec) maturity assessment measures how well an organisation builds, tests and runs secure software. I score each practice in SAMM v2, the Software Assurance Maturity Model from OWASP (the Open Worldwide Application Security Project), against evidence, map results to NIST CSF 2.0 (the US National Institute of Standards and Technology Cybersecurity Framework), and deliver a scored baseline, targets and a 12–24 month roadmap.
This is for you if
- The board asks how secure the applications are and nobody can show a score
- Security spend goes on tools, but nobody can say which practices improved
- Most of the software is built or run by vendors
- A new CISO needs an evidence-based baseline in the first quarter
When to call me
The moments this engagement is built for.
- 01A new head of securityYou need an honest baseline before committing budget or promising the board a plan.
- 02An audit or regulator findingAn inspection asks for evidence of secure development and oversight, and the answers are scattered across teams.
- 03Budget and strategy seasonNext year’s security budget needs a case built on risk, not on the last vendor demo.
- 04Development moving to vendorsCore applications are being outsourced, and the contract needs security requirements you can check.
How it runs · 2–3 weeks
From kick-off to a plan you can act on.
- 01Scope and evidence request
- Agree business units and sample applications
- Send the evidence request before any interview
- Book interviews by SAMM business function
- 02Interviews and spot checks
- Interview design, build, test, ops and governance leads
- Check claims in WAF, scanner and SIEM consoles
- Score each stream only against evidence seen
- 03Calibration and targets
- Calibrate draft scores with stakeholders
- Set a target per practice with the risk owner
- 04Roadmap and board readout
- Group gaps into owned, costed initiatives
- Present the board summary and decisions needed
What you get
Deliverables, not a slide deck of opinions.
- SpreadsheetScored SAMM baselineA current score for all 15 SAMM practices, each linked to the evidence behind it.
- PDF reportGap analysis across six areasWhere practice falls short at the edge, in APIs, testing, monitoring, mobile and governance.
- Spreadsheet12–24 month roadmapInitiatives with owners, effort and cost ranges, sequenced by the risk each one removes.
- PDF reportNIST CSF 2.0 mappingResults expressed in CSF 2.0 Govern terms, so they slot into enterprise risk reporting.
- Slide deckBoard summaryOne page: current and target maturity, the top three risks, and the decisions and budget asked for.
What happens next
Afterwards, you can decide.
An assessment is only useful if it changes a decision. These are the ones this engagement is designed to unlock.
- 1Set a target maturity per practice that matches your risk appetite
- 2Fund the first two quarters of the roadmap and name an owner for each initiative
- 3Choose who delivers each initiative: your team, a partner or Innov8’s AppSec unit
- 4Book a reassessment in twelve months with the same scope and method
- 01
Assess
I audit your applications and the security you already have, across six areas. Evidence, not questionnaires.
- Findings with evidence
- Score per area
1–4 weeks
- 02
Recommend
A prioritised plan: what to fix first, what it costs, and what risk it removes.
- 30/90/365-day plan
- Board summary
With the assessment
- 03
Execute, case by case
If you want help delivering, I scope it by expertise, manpower and timeline. Your team, a partner or Innov8.
- Delivery options
- Independent oversight
Only where it makes sense
Method
Built on standards your auditors recognise.
- OWASP SAMM v2
- NIST CSF 2.0
Grounded in delivery
Where this experience comes from.
How long does an OWASP SAMM assessment take?
Ravindu Fernando, a Colombo-based application security consultant, usually completes one in two to three weeks for a defined scope: chosen business units and a representative sample of applications, including vendor-built ones. Week one covers scoping and evidence, week two interviews and spot checks, and week three calibration, targets and the roadmap. Separate scores per development team take longer.
How is a maturity assessment different from a penetration test?
A penetration test looks for exploitable flaws in specific systems at one point in time. A maturity assessment looks at the practices that produce those flaws: requirements, design, testing, defect handling, monitoring and ownership. Test findings tell you what to patch this month. Maturity gaps explain why similar findings keep coming back, and what to change so they stop.
What maturity score should we aim for?
There is no universal good score. I set targets per practice with the executive who owns the risk, based on how much software you build yourselves, how exposed your digital channels are and how sensitive your data is. A sensible first goal is level 1 across all fifteen practices in SAMM (the Software Assurance Maturity Model), then level 2 where risk is concentrated.
Does the assessment work if most of our software is outsourced?
Yes. SAMM (the Software Assurance Maturity Model) measures your organisation’s own practices, and most still apply when vendors write the code: security requirements in contracts, supplier oversight, testing of vendor deliveries, change control and monitoring. I score only what you can evidence. In heavily outsourced estates, supplier security is often where the largest gaps sit.
What happens after the assessment?
You own the roadmap and decide how to deliver it. Your own team can, a partner of your choice can, or Innov8’s Application Security Business Unit, which I head, can quote for specific initiatives, and that relationship is always disclosed. I can also provide independent oversight, or reassess in twelve months with the same method so progress is measured rather than claimed.
Other engagements
- Application architecture reviewThreat model, control coverage map, prioritised fixes
- WAAP & API protection assessmentCoverage gaps, bypass paths, migration or tuning plan
- Mobile app security assessmentMobile threat model, protection policy, MASVS test plan
- Exposure management (CTEM) assessmentPrioritisation model, validation approach, owner playbook, metrics
- Executive briefing or team workshopPlain-language risk briefing or hands-on workshop
- Fractional AppSec advisorRoadmap governance, vendor and design reviews, escalation support