OWASP Security Culture
This project aims to help organizations tailor their security efforts so developers can consistently build secure software. Version 2 introduces SECUR-E, an open framework based on COM-B and DASP research, to identify whether barriers to secure development stem from capability, opportunity, or motivation. Users can then select targeted interventions. Features include self-assessment, scoring, persona guidance, team visualizations, playbooks, and progress tracking to support better security culture. Personas reflect current conditions, not fixed identities. Results should never be used for hiring, performance, or disciplinary decisions. The framework is under expert review and community testing.
Our Slack channel is the easiest way to connect with the OWASP Security Culture community.
How to join:
If you already have an OWASP Slack account, join the #project-security-culture channel directly.
If you’re new to OWASP Slack, request an invitation first.
Project Resources
Project Information
Slack