Measure your real AppSec maturity.
OWASP SAMM v2 maturity assessment: 5 business functions, 15 practices and 90 guided questions, with a live scorecard, maturity radar, prioritized roadmap and a 9-page PDF report ready for the board. Bilingual, with local persistence and operable by AI agents.
- FrameworkOWASP SAMM v2
- Scope5 funções · 15 práticas · 90 perguntas
- LanguagesEN · PT-BRUI e relatório
- PersistenceSQLiteservidor
“Are we secure?” is not an answer
When the enterprise customer sends the compliance questionnaire, or the board asks where you stand, opinion isn't enough. You need a defensible number, with a public method behind it and evidence of how it was computed.
OWASP SAMM is that method — and Okami Maturity is the tool that makes it executable in an afternoon, instead of becoming one more spreadsheet nobody updates.
What Okami Maturity does
90 guided questions with interview notes
The 90 OWASP SAMM v2 questions across two streams (A/B), levels 1 to 3, with room for an interview note per question — the qualitative evidence a number alone doesn't carry.
Live maturity, per function and practice
Overall maturity, per-function and per-practice scores, a maturity radar and on-target KPIs — updated while the assessment happens, not only at the end.
Gap and next level per practice
For each practice: current level, gap to target and the next level to reach, with recommended actions derived from SAMM's own criteria — no AI required.
9-page PDF ready for the board
Cover, contents, executive summary, methodology, maturity by function, prioritized roadmap, evolution (when snapshots exist), conclusion and an appendix with the interview notes.
Snapshots and comparison over time
Save snapshots and track maturity evolution between them — that's how you prove progress in an audit, instead of asserting you improved.
AI-operable over MCP and ACP
Agents read and operate the system over MCP (HTTP + stdio) and both ACP protocols: create assessments, answer questions, score, plan and report.
Spec sheet and when to use it
- Framework
- OWASP SAMM v2
- Scope
- 5 funções · 15 práticas · 90 perguntas
- Languages
- EN · PT-BR (UI e relatório)
- Persistence
- SQLite (servidor)
- Report
- PDF · 9 páginas · marca Okami
- Integration
- MCP (HTTP + stdio) · ACP
Answering an enterprise customer questionnaire
Show up with a defensible number and a public method behind it, instead of answering “yes, we do that” with no evidence to survive the next audit.
Initial consulting diagnosis
It's the same tool we use in Discovery: it measures current maturity and produces the prioritized roadmap that guides the following months.
Tracking quarterly evolution
Quarterly snapshots turn “we think we improved” into a maturity curve with dates, method and evidence.
Okami Maturity FAQ
Do I need AI to generate the roadmap?
No. The recommended actions derive from OWASP SAMM's own criteria and guidance. AI-tailored suggestions are an optional add-on, appearing as a report appendix when used.
Where does the data live?
In SQLite on the server where you run the application. You can save client assessments, list them, reload and re-report — with no external SaaS dependency.
Is it for SMBs or only large companies?
It's built for SMBs. SAMM scales with the scope you define, and lesson 3.2.2 in Okami Mentor explains why completing level 1 first beats attempting everything at once.
The products that carry the consulting
Okami Agent
Sovereign AI coding agent: capability parity across LLMs, self-improvement (skills, persona, memory) and mandatory design-system adherence. In the terminal, on Telegram, wherever you want.
Okami Monitor
Mission control for multi-agent environments: usage and cost per period, sessions, Kanban, logs, API keys and external runtime connections — in one cockpit.
OkamiCode
Local-first desktop cockpit for AI coding CLIs: folder-bound projects, native sessions per provider, chat, email, Kanban, usage/cost analytics and durable memory — without paying a second API bill.
Okami Tally
An iPhone panel for your AI subscription quotas — Claude, Codex, Grok, Cursor, Minimax, MiMo and any service with a JSON endpoint. In the app, in widgets, on the Lock Screen and in the Dynamic Island. No backend, no telemetry.
Okami Sentinel
Local workbench for OpenAI Codex Security scans: run, inspect, compare up to six runs and gate changes with versioned guardrails — evidence, cost and context preserved in a local workspace.
OkTally
Every AI coding subscription quota in your macOS menu bar — Claude Code, Codex, Cursor, OpenRouter and more. Colored pins, a popover with the full picture and a notification before you hit the limit. All local, no telemetry.
OkamiUNI
Email and calendar together on the Mac. Unified inbox, macOS calendars and AI to summarize threads, draft replies and turn emails into appointments. Local data, your choice of AI provider.
Want Okami Maturity running in your context?
The product is open and you can run it yourself. Rolling it out in your environment, with design-system integration and a documented hand-off, is the consulting.