[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Fsamm":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","samm","SAMM","OWASP Software Assurance Maturity Model (SAMM)",19,"OWASP Foundation","**What it covers.** SAMM is an OWASP model for assessing and improving an organisation's software security practices. Version 2 is organised into five business functions, Governance, Design, Implementation, Verification and Operations, each containing three security practices with maturity levels from one to three. It is technology and process neutral, so it can be applied to agile, waterfall or mixed environments.\n\n**In practice.** Organisations assess their current maturity across the practices, set realistic targets based on risk and business priorities and build a phased roadmap. Assessments are repeated to track progress. Evidence includes scored assessments, a roadmap with owners, and artefacts behind each practice, such as threat models, security requirements, test results and incident handling records.\n\n**Common gaps.** Assessments are sometimes scored generously by interview without checking artefacts. Targets are also often set at the highest level everywhere instead of according to risk.",null,"https:\u002F\u002Fowasp.org\u002Fwww-project-samm\u002F","Read it at OWASP","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-powered-vulnerability-discovery-surfaces-129000-flaws-organizations-must-prioritize-remediation-a","AI-Powered Vulnerability Discovery Surfaces 129,000 Flaws — Organizations Must Prioritize Remediation at Scale","2026-10-07T10:20:55.118+00:00",{"slug":23,"title":24,"published_at":25},"ai-lowers-the-bar-for-attackers-defenders-must-raise-the-cost-of-exploitation","AI Lowers the Bar for Attackers — Defenders Must Raise the Cost of Exploitation","2026-09-30T12:20:39.857+00:00",{"slug":27,"title":28,"published_at":29},"ai-coding-environments-need-embedded-security-scanning","AI Coding Environments Need Embedded Security Scanning","2026-09-02T18:21:23.906+00:00",{"slug":31,"title":32,"published_at":33},"ai-generated-patches-fail-more-than-half-the-time-human-oversight-is-still-essential","AI-Generated Patches Fail More Than Half the Time — Human Oversight Is Still Essential","2026-08-07T18:20:19.098+00:00",{"slug":35,"title":36,"published_at":37},"ciscos-ai-powered-slms-aim-to-make-source-code-vulnerability-detection-accessible","Cisco's AI-Powered SLMs Aim to Make Source Code Vulnerability Detection Accessible","2026-07-21T18:20:23.071+00:00",{"slug":39,"title":40,"published_at":41},"ai-enhanced-sast-and-cra-compliance-reshape-secure-development-practices","AI-Enhanced SAST and CRA Compliance Reshape Secure Development Practices","2026-07-16T00:20:21.313+00:00",{"slug":43,"title":44,"published_at":45},"choosing-the-right-sast-tool-for-polyglot-monorepos-is-critical-to-secure-platform-engineering","Choosing the Right SAST Tool for Polyglot Monorepos Is Critical to Secure Platform Engineering","2026-06-26T22:20:23.363+00:00",{"slug":47,"title":48,"published_at":49},"ai-driven-vulnerability-discovery-outpaces-human-patching-capacity","AI-Driven Vulnerability Discovery Outpaces Human Patching Capacity","2026-06-23T12:20:58.129+00:00",{"slug":51,"title":52,"published_at":53},"ai-powered-tools-aim-to-close-the-vulnerability-patching-gap","AI-Powered Tools Aim to Close the Vulnerability Patching Gap","2026-06-23T06:20:22.721+00:00",{"slug":55,"title":56,"published_at":57},"ai-powered-vulnerability-detection-reshapes-security-at-scale","AI-Powered Vulnerability Detection Reshapes Security at Scale","2026-06-17T22:20:53.357+00:00",{"slug":59,"title":60,"published_at":61},"critical-sap-vulnerabilities-expose-enterprise-systems-to-authentication-bypass-and-data-access","Critical SAP Vulnerabilities Expose Enterprise Systems to Authentication Bypass and Data Access","2026-06-09T14:21:18.971+00:00",{"slug":63,"title":64,"published_at":65},"ai-generated-code-creates-new-security-vulnerabilities","AI-Generated Code Creates New Security Vulnerabilities","2026-06-09T14:20:46.226+00:00",[67,72,77,81,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",13,{"slug":73,"name":74,"problem":75,"stories":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":78,"name":79,"problem":80,"stories":76},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":82,"name":83,"problem":84,"stories":85},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",5,{"slug":87,"name":88,"problem":89,"stories":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":92,"name":93,"problem":94,"stories":90},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[96,102,106,112,118,122,126,130],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","7","Control 7","Continuous Vulnerability Management",11,{"family":97,"item":103,"code":104,"title":105,"together":101},"16","Control 16","Application Software Security",{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-sp","800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",9,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-800-53","ra-5","RA-5","Vulnerability Monitoring and Scanning",7,{"family":107,"item":119,"code":120,"title":121,"together":85},"800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",{"family":113,"item":123,"code":124,"title":125,"together":85},"si-2","SI-2","Flaw Remediation",{"family":113,"item":127,"code":128,"title":129,"together":85},"sa-11","SA-11","Developer Testing and Evaluation",{"family":131,"item":132,"code":133,"title":134,"together":135},"nist-csf","id-ra","ID.RA-1","Risk Assessment",4]