SAMMY UI is optimized for resolutions with a width 1024px and higher.
Maturity Level 2
Maturity Level 3
Maturity Level 4
Number of vulnerabilities/severity
T-KPI-2-1: Number of vulnerabilities/severity
  • Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs. This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. At least quarterly.
Description

Communication can be performed in a simple way, e.g. text based during the build process. This activity depends on at least one security testing implementation.

Risk: Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings.

Number of vulnerabilities/severity/layer
T-KPI-2-2: Number of vulnerabilities/severity/layer
  • Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly.
Description

Communication can be performed in a simple way, e.g. text based during the build process. This activity depends on at least one security testing implementation. Layers to consider (SCA):

  • Cloud provider (if insights are possible)
  • Runtimes, e.g. Kubernetes nodes
  • Base images and container images
  • Application

Layers to consider SAST/DAST:

  • Cloud provider
  • Runtime, e.g. Kubernetes
  • Base images and container images
  • Application

Risk: Failing to convey the number of vulnerabilities by severity and layer (app/infra) might undermine the effectiveness of product teams. This might lead to ignorance of findings.

Patching mean time to resolution via PR
T-KPI-2-3: Patching mean time to resolution via PR
  • Measurement and communication of vulnerabilities per severity for components like applications and split it depending on the layer (e.g. app/infra). At least quarterly.
Description

Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss.

Risk: Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss.