Application security maturity · DevSecOps and secure coding
Your development chain assessed, from code to deployment, and translated into a roadmap.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
Application security maturity · DevSecOps and secure coding
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One DevSecOps and application security maturity framework (inspired by OWASP SAMM and BSIMM) assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism, a level, the level above, and the action that connects the two, that turns a finding into a trajectory.
Are vulnerabilities detected by automated scans fixed within defined timelines?
- N1
Scan results are not acted upon. No fix timelines are defined and no one is assigned to deal with findings.
- N2
A few teams address critical vulnerabilities when they happen to notice them. Timelines vary with availability and current workload.
- N3
Fix timelines by severity level are defined and known. Vulnerabilities are assigned an owner and tracked through to closure.
- N4
Timelines are met and measured per team. Breaches require a tracked, approved waiver, and security debt is managed as planned workload.
- N5
Thresholds and timelines are reviewed periodically in light of incidents and the evolving application portfolio, with a documented record of revisions and their effects.
Action to move from L2 to L3
Publish a table of fix timelines by severity level, automatically raise a ticket assigned to the owning team whenever a finding is detected, and review open tickets during the sprint review.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon DEV SECOPS.
What this framework covers
Application security covers the full set of practices that reduce exploitable flaws in software, from design through to operation. DevSecOps is its organisational translation: embedding security controls into the continuous delivery chain rather than bolting them on at the end. This calls for secure coding rules, tooled static and dynamic analysis, dependency and secrets management, upstream threat modelling, and development teams that are trained accordingly. It is not a product to install but a set of practices to embed in teams’ daily work.
In practice, this is a hard subject to steer because it is distributed. Application security belongs to product teams, platform teams and the security function all at once, with no one holding the complete picture. The same practical questions keep coming back: do code scans run on every repository, or only on the ones a motivated team bothered to configure? Are detected vulnerabilities fixed, or do they pile up on a dashboard no one opens any more? Is the security review a real gate, or a box ticked before release to production?
One frequent confusion is worth clearing up: having the tools is not the same as being in control. Many organisations run a software composition scanner, a static analyser and a secrets vault, without any of these being tied to a remediation policy, blocking thresholds or a named owner. The rise of AI-assisted coding sharpens the point: the volume of code produced is increasing, and review and dependency awareness need to keep up. The question is no longer about acquiring tools, but about measuring what the chain actually does with their output.
An audit checks whether a control exists and concludes with a gap. The maturity assessment asks a different question: what level your practices sit at, team by team, and what precise action moves you to the next one. On a subject this uneven from one product to another, this granularity changes how you steer it. The score per theme lets you compare business units against each other and track progress from one cycle to the next, rather than settling for a single snapshot with no trajectory.
The framework is available and ready to use in Datamensio straight away. You can adapt it to your organisation: the AI can adjust the themes, rephrase the questions and refine the levels using the CMMI method, or build a version derived from your own development policies and internal standards.
Reference standard: DevSecOps and application security maturity framework (inspired by OWASP SAMM and BSIMM)
The themes assessed
Application security governance
Secure development policy, security roles and champions embedded in product teams, exception arbitration, indicators tracked by leadership.
Requirements and design
Security requirements formalised in specifications, threat modelling, architecture reviews, choice of building blocks and design patterns.
Secure coding and review
Coding standards, peer review including a security dimension, input validation rules, error handling and logging.
Dependency and software supply chain management
Inventory of third-party components, software bill of materials, monitoring of published vulnerabilities, patching policy, artefact signing.
Automated security testing
Static analysis, dynamic analysis, composition testing, repository coverage, blocking thresholds in integration pipelines.
CI/CD chain security
Access control over repositories and runners, secrets management, pipeline integrity, environment separation, deployment traceability.
Vulnerability management and remediation
Qualification and prioritisation of findings, fix timelines by severity level, tracking through to closure, security debt management.
Penetration testing and external validation
Scope and frequency of tests, disclosure or bug bounty programme, feeding findings back into development standards.
Skills and culture
Secure coding training, upskilling of champions, awareness of AI-assisted coding usage, sharing of incident lessons learned.
Operations and continuous improvement
Security of production configurations, application monitoring, post-incident lessons learned, periodic review of standards and thresholds.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment lead to a certification?
No. Application security has no certifying body of its own. Datamensio measures the maturity of your practices and produces the associated action plan. The results can, however, feed into a client submission or a broader security management approach.
How is this different from a code audit or a penetration test?
A code audit or penetration test looks for flaws in a given application at a given point in time. The assessment evaluates your organisation’s ability to avoid those flaws and fix them repeatably. The two complement each other: technical findings feed into the evaluation of practices.
How long does the assessment take?
The short version takes 20 to 30 minutes for a lead who knows the development chain. The full version, run collaboratively with product and platform teams, typically spans one to two weeks, most of the time going into data collection.
Can the framework be adapted to our organisation?
Yes. The themes, questions and levels can all be changed. The AI can rephrase the whole framework based on your development policies, coding standards or actual tooling, or produce a version tailored to a single product line.
How can several development teams be compared?
The same framework is rolled out to each team or business unit. Scores per theme can be compared across entities and over time. A cross-entity roadmap then consolidates the action plans, so the same tooling project doesn’t get funded ten times over.
Do you need to be a developer to answer the questions?
The questions cover practices and controls, not precise configurations. An engineering lead or security champion can answer them. The collaborative mode lets tooling questions go to the platform team and design questions go to architects.
Is the use of generative AI to write code taken into account?
Yes. The framework assesses how these uses are governed: usage rules, review of the code produced, control of introduced dependencies and developer training. These points can be adjusted if your internal policy is more detailed.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.