SAMMY Reviews & Product Details

At Conquest Security, our GRC practice focuses on designing, implementing, and sustaining Information Security Management Systems (ISMS) that help organizations manage risk, demonstrate compliance, and continuously improve their cybersecurity maturity. We use SAMMY as a core platform to support NIST CSF–based programs, ISO/IEC 27001 implementations, and CMMC Level 1 and Level 2 readiness as a CMMC Registered Practitioner Organization (RPO).

ISO/IEC 27001 and CMMC both require more than documented controls. They require operational discipline, defined responsibilities, and evidence of sustained execution. SAMMY provides a practical platform for documenting control implementation, assigning ownership, tracking risk treatment actions, and maintaining evidence over time. For our CMMC Level 1 and Level 2 readiness work, this is critical. We can clearly show how practices are implemented, monitored, and sustained rather than assembled as one-time compliance artifacts.

SAMMY brings together assessments, control libraries, and evidence tracking in a single system. This integration is particularly valuable for organizations that align enterprise risk management, NIST CSF outcomes, ISO/IEC 27001, and CMMC practices. It reduces duplication, improves traceability, and supports consistent results across internal reviews, readiness assessments, and external audits. From an ISMS perspective, this directly supports continuous monitoring and management review activities.

The Codific team demonstrates a strong practical understanding of cybersecurity frameworks and real-world GRC implementation challenges. Their support reflects how organizations actually build and operate CSF-aligned programs, implement ISO/IEC 27001, and prepare for CMMC assessments. This domain expertise accelerates onboarding and improves long-term adoption, particularly for small and mid-sized organizations without dedicated internal GRC teams. Review collected by and hosted on G2.com.

SAMMY is designed to support structured, framework-driven cybersecurity programs, so organizations get the most value when they approach it with an Information Security Management System mindset. Teams that are early in their GRC maturity may need some initial guidance to fully align their processes, roles, and documentation with the platform. In our experience, when SAMMY is implemented alongside clear governance and advisory support, this upfront alignment quickly turns into a long-term strength. Review collected by and hosted on G2.com.

SAMMY’s strongest quality is its principled alignment with OWASP SAMM, delivered through a clear, guided interview workflow and automatic scoring. The structured questionnaires, embedded calculations and scorecards streamline workshops and keep assessments consistent across teams. In practice, this reduces preparation time and helps stakeholders focus on evidence and decisions rather than mechanics. The ability to export results in a benchmark‑friendly format is particularly helpful when we collaborate on maturity baselines and share anonymized insights with community initiatives.

We also appreciate the secure, role‑based access and multi‑factor onboarding, which supports our compliance mindset while keeping the tool accessible to non‑specialists. Coordinating licenses and invitations for new analysts has been straightforward and allows us to spin up working sessions quickly.

Overall, SAMMY offers a well‑balanced combination of methodology fidelity, operational efficiency, and pragmatic outputs that are easy to discuss with engineering and management alike. Its consistent structure helps us compare teams fairly, prioritize improvements, and connect assessment findings to actionable roadmaps without losing traceability.

Also, the team is very reactive and several times I've seen features that I requested being implemented in a few weeks! Review collected by and hosted on G2.com.

While SAMMY is effective, there are a few areas that could improve the user experience. Account lifecycle flows can be fragile at times (rarely to be honnest), which interrupts onboarding for busy project teams.

From a reporting perspective, the standardized scorecard is useful, but the layout and customization options feel limited for some audiences, richer templating (configurable narratives, visualizations, risk groupings,...) would help tailor deliverables to different stakeholders without post‑processing.

None of these points are blockers, and they do not diminish the value of the core product. Addressing them would simply make SAMMY more resilient in complex enterprise environments and further accelerate our facilitation during assessments Review collected by and hosted on G2.com.

It's the best commercially supported tool for rolling out SAMM, and scales well from a single scope to complex multinational organizations. It really shines when teams are empowered to take charge of their own improvement roadmap, as it creates a central hub for all stakeholders to keep tab on progress.

The pace of development is fast and the codific team is always ready to listen to feedback and incorporate suggested improvements if they believe it benefits the wider usebase. The tool has evolved from a SAMM tool to a more generic maturity management suite with coverage for several widely used frameworks in the GRC and product security space. Review collected by and hosted on G2.com.

The tool is still evolving and at times, functions or layouts change. On the other hand, it is a sign of continuous development. Review collected by and hosted on G2.com.

SAMMY helps bring the Software Assurance Maturity Model to life. It provides an intuitive interface to capture the current state of answers in SAMM and goes beyond by offering goal-setting for targets and project planning. The integrations with numerous complementary frameworks is invaluable for compliance or understanding coverage. SAMMY supports multiple teams or business lines so the entire organization can be represented. The dashboards and reports are clear and provide good insight into the current status and progress being made. The UI is responsive and smooth. The team has provided amazing support when needed. Review collected by and hosted on G2.com.

I don't really have any dislikes about SAMMY at the moment. I appreciate that it's focused on providing a solid management tool for software assurance at a good price, without trying to be everything to everyone. Review collected by and hosted on G2.com.

Turned a painful confusing process into an achievable one. And my support interaction with them was first class. Review collected by and hosted on G2.com.

I don't really have any complaints. I had some initially but I gave them feedback and they fixed everything the next day. Review collected by and hosted on G2.com.