Benchmark data
v24.1.1
In September 2024, we released an updated OWASP SAMM Benchmark. The number of data sets remains quite limited (30). The benchmark dataset remains skewed towards large organizations. The SAMM Core team was able to slice the data and provide more granular information. The benchmark data and its interpretations were presented during SAMM User Day in San Francisco.
Click here to view the SAMM Benchmark dataset v24.1.1 .
For further insights and interpretations of the v24.1.1 data we refer to this blog article.
v24.1.0
In June 2024, we released the very first OWASP SAMM Benchmark data. Despite the huge interest from the community to have a common benchmark, the number of submitted data sets has been very limited (25). The benchmark is heavily based on data provided by large organizations. The benchmark data and some of its interpretations were presented during SAMM User Days in Lisbon.
Click here to view the SAMM Benchmark dataset v24.1.0 .
Goals
How important is it for your organization to compare against peers?
This question got a 7 or higher reply from 69% of SAMM users during our 2022 questionnaire. Helping our users answer the critical questions “How am I doing?” and “What might be working for other similar organizations?” has been part of our roadmap for quite some time. Now, we’ve made it a priority. It is our goal to build a database for companies to measure the maturity of their security development practices against the industry based on variables such as verticals and company size. In turn, the information we collect can help the SAMM model evolve based on actual information from the field. As an added benefit, this project can facilitate research on secure development practices worldwide as universities and researchers analyze and interpret the information the community donates, providing valuable insights.
Roles
This initiative can only succeed with the help of the community of SAMM users and practitioners that surround the OWASP SAMM project.
SAMM users and Practitioners help organizations with SAMM assessments and serve as their benchmark data owner. They might be internal to the organization that is submitting data, or external consultants, performing SAMM assessment organizations according to the guidelines you can find in our Getting started page, Determining Scope blog post, and Fundamentals Course .
Submission process
There are 2 ways of submitting data
Uploading it to the Benchmark folder
Please, refer to this video for instructions.Sending it by email to benchmark@owaspsamm.org
The data is collected in an anonymous way and covered by the following terms and conditions. During the submission process we will ask for some metadata. The more information provided, the better the comparative analysis will be.
To help practitioners get permission from their clients or companies to submit datasets, we have created the following email template .
Tapping into the benchmark data
The end-goal of the benchmark initiative is for companies to use the data to measure themselves against their peers in the industry. Our main hurdle at this point is to gather a large enough dataset to guarantee accurate comparisons and maintain full anonymity for the contributing parties.
As an added benefit, we’ll use the data to prioritize the publication of guidance for streams and activities.
Updates
We will be updating this page and the process as the project progresses. If you have any questions, please send an email to benchmark@owaspsamm.org