Demo Organization

Start a free assessment Sign in

Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

Where each capability actually acts across the lifecycle. Select a cell for detail.

Capability	Plan	Design	Code	Build	Test	Release	Deploy	Operate	Monitor / Respond
Admission Control							33%
API Security Testing					0%			0%
Cloud Configuration Security							100%	33%
Code Review Security			67%
Container Security				100%
DAST					8%	0%
Drift Detection								50%
Fuzzing			0%		0%
IaC Security			50%	50%
Incident Response									100%
Kubernetes Security			0%	0%				0%
Network Security							50%	25%
Penetration Testing					33%			25%
Runtime Security								0%	0%
SAST			100%	100%
SCA			100%	100%		0%
Secrets Management				100%			100%	33%
Secret Scanning			67%
Secure Architecture		100%
Security Requirements	0%
SIEM									67%
Threat Modeling		50%
Vulnerability Management								100%	100%
Vulnerability Scanning							0%	33%
Workload Identity							100%	50%

Covered
Partially covered
Not covered
Not expected in this phase

Vulnerability Management · Operate

6 of 6 required weight is covered, across 6 scopes. Nothing is missing here.

Central Finding Routing
What it is
Findings from every source are routed into one place with a named owner, instead of staying in the tool that produced them.
Why it matters
Findings that stay in the tool that produced them are seen only by whoever opens that tool, and nobody can say what the whole backlog is.
You have it when
Findings from every source land in one system, each with an owning team, and a developer meets them where they already work rather than in a security console.
— recommended. Required by profile rule(s): BASELINE_UNIVERSAL
Finding SLA Tracking
What it is
Each finding carries a remediation deadline derived from its severity, and overdue findings are visible.
Why it matters
Without a deadline tied to severity, the order of remediation is decided by convenience and critical findings age quietly.
You have it when
A finding is given a due date from its severity when it is created, overdue findings are visible to the owning team and above it, and the ageing is reported.
— mandatory. Required by profile rule(s): CRITICAL_APPLICATION_ASSURANCE

Environment	Technology	Control point	Covered by
Development	any	Manual Review	DefectDojo as the finding destination
Test	any	Manual Review	DefectDojo as the finding destination
Production	any	Manual Review	DefectDojo as the finding destination
Development	any	Manual Review	DefectDojo SLA policy per severity
Test	any	Manual Review	DefectDojo SLA policy per severity
Production	any	Manual Review	DefectDojo SLA policy per severity

How good is what is in place?

DefectDojo as the finding destinationeffectiveness 50% · maturity 2 · Automated
- · Enforcement is informational.
- · Automation is automated.
- · No remediation deadline, so a finding can stay open indefinitely.
- · No exception process, so the control gets bypassed informally.
- · Next maturity level needs: It can stop a release, A remediation deadline exists, Exceptions go through a process.
- · Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.
DefectDojo SLA policy per severityeffectiveness 57% · maturity 2 · Automated
- · Enforcement is informational.
- · Automation is automated.
- · No exception process, so the control gets bypassed informally.
- · Next maturity level needs: It can stop a release, Exceptions go through a process.
- · Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.