Abstract
In this session, we’ll present the latest findings from the OWASP SAMM Benchmarking Project, including key statistics, trends, and lessons learned from the most recent dataset. Attendees will gain a data-driven perspective on how organizations are performing across SAMM’s five business functions, where the most common strengths and weaknesses lie, and what these patterns reveal about the evolving landscape of software assurance. We’ll discuss the practical implications of these insights for AppSec leaders, highlight areas ripe for improvement, and share how organizations can participate in and benefit from the ongoing benchmarking initiative. Whether you’re new to SAMM or looking to take your security program to the next level, this talk will empower you with actionable intelligence and peer-driven context.
Speaker Bio
Brian has worked in IT for 25 years and Information/Application Security for the last twenty. He started as an Enterprise Java Developer; then transitioned to helping build an Application Security program as both tech lead and manager. Brian later played the role of Enterprise Architect and did a little incident response and reverse engineering malware for fun. Then spent a number of years as a consultant helping clients build AppSec Programs, perform SAMM Assessments, create/update SDLCs, and other related initiatives. He worked on the Trustworthy Computing team at Microsoft for a period, and recently completed work as Chair and Assistant Professor of Computer Science teaching Computer Science and Cybersecurity. Brian has been one of the project leads and active contributor to SAMM v1.1-2.0+ and OWASP Top 10 2017, 2021, & 2025.