SAMMY turns OWASP SAMM and other security, risk, and compliance frameworks into clear, measurable actions. See where you stand, build SMART improvement plans, and demonstrate progress, all in one platform.
Free forever plan · No credit card required
What you can do with SAMMY
The same structure, scoring, and reporting run across every workflow, so a maturity assessment, a threat model, and a supplier audit all roll up into one view of your posture.
Maturity
Review, audit, and manage your security posture against industry standards, then demonstrate compliance with clear evidence.
Product risk
Run structured, repeatable threat analysis to understand where your product is exposed, and track how you address it.
Supply chain
Audit your suppliers and vendors against your own standards, and keep a live view of third-party risk across the organization.
Trusted to manage security, risk, and compliance programs at organizations of every size.
Years active
Organizations using SAMMY
Users on SAMMY
Assessments run with SAMMY
Latest in SAMMY
SAMMY MCP
Our MCP connector links SAMMY to any large language model, so you can push and pull your assessment data and put your AI tools to work on it: draft improvement plans, summarize gaps, generate reports, and answer questions about your posture in seconds.
Explore the MCP connector →Assessment data
Connector
Any model
CRA compliance
The EU Cyber Resilience Act is here. SAMMY walks you through the requirements, tracks your evidence as you go, and produces the documentation you need to show conformity.
Trusted by industry experts
Built by the key people behind OWASP SAMM
SAMMY grew out of OWASP SAMM as an assessment tool, and it is now the leading OWASP SAMM platform used by organizations across the world. OWASP SAMM is the preferred maturity framework for assessing software development. The Codific team doesn't just use these standards, we help build them, contributing to both OWASP SAMM and the OWASP Top 10.
OWASP EU Founding Board Member · OWASP SAMM Core Team
Founder and CEO, Codific · PhD, Application Security
OWASP Top 10 Project Leader · OWASP SAMM Core Team
Application Security Leader · VP of Consulting Services
SAMMY adapts to a wide range of security frameworks, maturity models, and quality management systems, with mappings that let you assess once and report across many.
* Subject to licensing limitations
Product Risk and Compliance
Product risk and compliance shouldn't live in scattered spreadsheets. SAMMY brings maturity assessments, threat modeling, supplier risk, and regulatory compliance into one place, so you can see your whole security posture, act on it, and prove it. One platform. One source of truth. Built by the people who help write the standards.
Free forever plan · No credit card required
