AppSec maturity in SMBs: why SAMM 0→3 takes 9 months (not 3 years)
OWASP SAMM measures AppSec maturity on a 0-3 scale per practice. Conventional wisdom says companies take years to climb each level. In SMB practice, with method and focus, the jump from 0-1 to 3 on critical practices fits in 9-12 months.
SAMM measures five practices: Governance, Design, Implementation, Verification, Operations. Each has three sub-practices and each sub-practice has three levels (1, 2, 3). Maturity 0 means the practice doesn't exist formally.
Companies of 20-200 people typically start between 0 and 1 across the five practices. The path we usually see: 0-3 in Implementation (CI/CD with gates) first, then 0-2 in Design (default threat model) and Verification (continuous SAST + DAST), then 0-2 in Governance (versioned policies) and lastly Operations (monitoring + IR).
Accelerators: clear time-to-value per sprint, automation where possible (Semgrep, Trivy, OWASP ZAP in pipeline), internal Security Champions, continuous hand-off. Blockers: trying to fix everything at once, buying a tool without pipeline integration, treating AppSec as an isolated security project.
Maturity isn't a function of company size — it's a function of method and prioritization. A focused SMB outpaces an enterprise with no method.