1. [Home](https://www.g2.com/)
2. ...
3. [Other GRC Tools](https://www.g2.com/categories/other-grc-tools)
4. [SAMMY Discussions](https://www.g2.com/products/sammy/discuss)

[
 ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/large_detail/large_detail_21a40de80ed976546da2eb548b25967d/sammy.png "Product Avatar Image")
](/products/sammy/reviews)

[

SAMMY

](/products/sammy/reviews)

(6)4.9/5

SAMMY is an application security management platform that helps organizations run application security assessments, track maturity, and plan measurable improvements using industry frameworks. It is designed for application security leaders, security program managers, engineering leaders, and teams that need a structured way to evaluate current practices, identify gaps, and coordinate improvement work across one or more teams or scopes. SAMMY supports assessments against maturity, program, and control frameworks such as OWASP SAMM, OWASP DSOMM, BSIMM, NIST SSDF, ISO 27001, NIST CSF, and OWASP ASVS, plus other standards. To reduce duplicate effort, SAMMY includes framework mapping capabilities that can carry results from one framework to another, including OpenCRE mappings and direct mappings, with options that can generate a new assessment based on a mapping. • Multi framework assessments for different assessment types, including self assessments, top down, bottom up, external, and M & A assessments, to support different evaluation contexts. • Framework mappings to reuse results across frameworks and reduce redundant evaluation work when multiple standards are in scope. • Improvement roadmaps with assignments and deadlines, plus targets and objectives guidance, to turn assessment findings into planned work items for teams. • Live dashboards and internal reporting to track maturity scores, progress toward targets, and comparisons across teams, including gap analysis exports to Excel. • External reporting that generates formatted PDF reports to support audits and certifications using assessment results and validation data. SAMMY can also be used to create a repeatable assessment and governance cadence that keeps security improvement work visible, prioritized, and aligned with both engineering delivery and compliance expectations over time.

Show More

When users leave SAMMY reviews, G2 also collects common questions about the day-to-day use of SAMMY. These questions are then answered by our community of 850k professionals. Submit your question below and join in on the G2 Discussion.

* * *

### 100.0

Nps Score

### All SAMMY Discussions

Search

Most CommentedMost HelpfulCommon QuestionsNewest

All DiscussionsDiscussions with CommentsCommon QuestionsDiscussions without Comments

FilterFilter

Filter byExpand/Collapse 

Sort by

Most Commented

Most Helpful

Common Questions

Newest

Filter by

All Discussions

Discussions with Comments

Common Questions

Discussions without Comments

Sorry...

There are no questions about SAMMY yet.

## Start a New Software Discussion

Have a software question?

Get answers from real users and experts

[Start A Discussion](/products/sammy/discussions/new?entry_point=discussions%23product)

* * *

 ![Product Avatar Image](https://images.g2crowd.com/uploads/product/hd_favicon/1c565b07953345a522a30e8e48de7adc/sammy.svg "Product Avatar Image")

### Have you used SAMMY before?

Answer a few questions to help the SAMMY community

[
Yes
](javascript:void(0))[
Yes
](https://www.g2.com/login?context=product_review&return_to=https%3A%2F%2Fwww.g2.com%2Fproducts%2Fsammy%2Fdiscuss%3Fsmall_ask%3Dsammy)
No