Fuzz testing is an industry-standard technique for locating unknown vulnerabilities in software. Fuzz testing is mandatory portion of many modern secure software development life cycles (SDLCs), such as those used at Adobe, Cisco Systems and Microsoft. This document provides a framework to assess the maturity of your processes, software, systems and devices. At the heart of this document is a vendor-agnostic maturity model for fuzz testing that maps metrics and procedures of effective fuzz testing to maturity levels. The maturity model is a lingua franca for talking about fuzzing, allowing different organizations to communicate effectively about fuzzing without being tied to specific tools. The Fuzz Testing Maturity Model (FTMM) gives builders and buyers a set of standard levels for communicating about fuzz testing. This session provides an overview of FTMM and outlines the challenges involved in measuring fuzzing. Builders, for example, can promote a product by stating the specific FTMM level achieved. This level would be applied both to the software developed by the builder as well as the software components acquired by the builder. A buyer asking for a particular piece of software could require a specific FTMM level from vendors. This gives the buyer assurance that the software submitted by vendors has a well-defined baseline of robustness and security. In addition, a buyer could decide to verify and validate incoming software and devices to a specific FTMM level. From a process standpoint, this implies a specific level of risk awareness for the organization. In addition to builders and buyers, other members of the software ecosystem can also benefit from FTMM. For example, regulatory agencies wishing to improve software quality in a particular industry can require a minimum FTMM level for products from builder organizations. Such a requirement benefits all involved. Buyers get better products and builders save money by creating better products. Ultimately, consumers—ordinary people—benefit by getting better products and services.