Measure your real AppSec maturity.
OWASP SAMM v2 maturity assessment: 5 business functions, 15 practices and 90 guided questions, with a live scorecard, maturity radar, prioritized roadmap and a 9-page PDF report ready for the board. Bilingual, with local persistence and operable by AI agents.
OWASP SAMM v2 · 90 perguntas · PDF de 9 páginas · MCP + ACP
“Are we secure?” is not an answer
When the enterprise customer sends the compliance questionnaire, or the board asks where you stand, opinion isn't enough. You need a defensible number, with a public method behind it and evidence of how it was computed.
OWASP SAMM is that method — and Okami Maturity is the tool that makes it executable in an afternoon, instead of becoming one more spreadsheet nobody updates.
What Okami Maturity does
90 guided questions with interview notes
The 90 OWASP SAMM v2 questions across two streams (A/B), levels 1 to 3, with room for an interview note per question — the qualitative evidence a number alone doesn't carry.
Live maturity, per function and practice
Overall maturity, per-function and per-practice scores, a maturity radar and on-target KPIs — updated while the assessment happens, not only at the end.
Gap and next level per practice
For each practice: current level, gap to target and the next level to reach, with recommended actions derived from SAMM's own criteria — no AI required.
9-page PDF ready for the board
Cover, contents, executive summary, methodology, maturity by function, prioritized roadmap, evolution (when snapshots exist), conclusion and an appendix with the interview notes.
Snapshots and comparison over time
Save snapshots and track maturity evolution between them — that's how you prove progress in an audit, instead of asserting you improved.
AI-operable over MCP and ACP
Agents read and operate the system over MCP (HTTP + stdio) and both ACP protocols: create assessments, answer questions, score, plan and report.
Okami Maturity specs
When to use Okami Maturity
Answering an enterprise customer questionnaire
Show up with a defensible number and a public method behind it, instead of answering “yes, we do that” with no evidence to survive the next audit.
Initial consulting diagnosis
It's the same tool we use in Discovery: it measures current maturity and produces the prioritized roadmap that guides the following months.
Tracking quarterly evolution
Quarterly snapshots turn “we think we improved” into a maturity curve with dates, method and evidence.
Okami Maturity FAQ
Do I need AI to generate the roadmap?+
No. The recommended actions derive from OWASP SAMM's own criteria and guidance. AI-tailored suggestions are an optional add-on, appearing as a report appendix when used.
Where does the data live?+
In SQLite on the server where you run the application. You can save client assessments, list them, reload and re-report — with no external SaaS dependency.
Is it for SMBs or only large companies?+
It's built for SMBs. SAMM scales with the scope you define, and lesson 3.2.2 in Okami Mentor explains why completing level 1 first beats attempting everything at once.
Want Okami Maturity running in your context?
The product is open and you can run it yourself. Rolling it out in your environment, with integration and a documented hand-off, is the consulting.