OWASP Security Culture
This project aims to help organizations tailor their security efforts so developers can consistently build secure software. Version 2 introduces SECUR-E, an open framework based on COM-B and DASP research, to identify whether barriers to secure development stem from capability, opportunity, or motivation. Users can then select targeted interventions. Features include self-assessment, scoring, persona guidance, team visualizations, playbooks, and progress tracking to support better security culture. Personas reflect current conditions, not fixed identities. Results should never be used for hiring, performance, or disciplinary decisions. The framework is under expert review and community testing.
Starting question
“Can we run this safely, what will it cost and what will we learn?”
Run a bounded pilot with explicit data and safety commitments.
Choose a 4-week team path or a 3–6 month organizational path. Success is a completed learning cycle with zero confidentiality incidents—not a guaranteed score increase.
In 30 minutes: Read the pilot overview, leadership FAQ and three data-handling options.
In one week: Name the sponsor, facilitator and volunteer team; agree the confidentiality model.
In one month: Prepare, assess, interpret and launch one intervention.
Keep in mind: No raw individual data is shared with OWASP. Maintainer support is confirmed during intake and depends on availability.
A four-week path from preparation to a launched intervention
Suitable for one volunteer team with a willing facilitator, a sponsor who signs the responsible-use statement and enough capacity to act on what the assessment reveals.
(Week 1) Prepare: Confirm roles, data handling, voluntariness, non-evaluation commitment and facilitator readiness.
(Week 2) Assess: Provide protected time, score responses, record confidence and prepare aggregate views.
(Week 3) Interpret: Run triggers, hold the workshop and select one intervention adapted to the actual pattern.
(Week 4) Launch: Start the intervention, complete the retrospective and calendar the reassessment.
Success means:
At least 80% of the volunteer team participates
The workshop is completed
One action has an owner and review date
The action launches within four weeks
A retrospective is submitted
Zero confidentiality incidents
A score increase is intentionally not a pilot success criterion. Honest learning is.
A 3–6 month learning cycle across one to three teams
For organizations ready to support longitudinal reassessment and make environmental changes—not merely collect profiles.
Who should participate
One to three volunteer teams, usually 4–15 developers each
A sponsor with authority to unblock Opportunity interventions
A trained facilitator and security support contact
Leadership willing to sign the responsible-use statement
Teams not currently in crisis or reorganization
What your organization receives
Aggregate CAP/OPP/MOT team profiles
Persona-pattern distribution where safe
Fired insight triggers
A prioritized intervention plan
Longitudinal tracking setup
Maintainer support as confirmed at intake
Choose a data-handling model
A · Individual-held: Developers keep results; only self-reported aggregates flow to the facilitator. Maximum trust, coarser data.
B · Facilitator-held: Pseudonymous responses are held under a written confidentiality agreement. Standard operational option.
C · Research-partnered: Option B plus separate consent for anonymized research data under an approved research protocol.
OWASP never receives raw individual data. Retrospectives contain no scores; case studies and aggregate research data are optional and separately consented.
Download the pilot kit
Contact project maintainers
Do not run SECUR-E if leadership will not protect the process.
A sponsor’s signature on the non-evaluation commitment is a precondition, not paperwork. If the organization wants individual rankings, refuses voluntary participation or cannot act on environmental findings, pause the assessment.
Ready when…
Participation is voluntary
Individual data ownership is explicit
Aggregation rules are agreed
A facilitator has practiced scoring
Leadership can fund at least one change
Retention and deletion dates are set
A learning archive, not a testimonial page.
Case studies may be anonymous and are expected to document what failed, what surprised the team and what remains uncertain. No published examples were included in the source package, so this launch site does not imply that case evidence already exists.
Download the case study template
Project Resources
Project Information
Slack