More and more, organizations’ security postures are defined by their growing application portfolios, shifting the emphasis away from more traditional security perimeters. The answer to virtually every business problem large or small is “There is an app for that”, and the nature of these apps range anywhere from simple workflow enablement tools through large enterprise-grade applications. Managing security across all applications is quickly becoming one of the biggest blind spots for organization’s security programs, making it difficult to measure and report metrics related to application security. Over the past year, Yan has been working on a new approach to manage and measure application security. By combining OWASP’s Software Assurance Maturity Model, traditional risk assessment methodologies, and experience developing security metrics, Yan developed a methodology that may be used to help organizations improve the way they manage and prioritize their application security initiatives. Once fully developed, this approach will be donated to OWASP either as an add-on to the existing SAMM project or as a new project intended to improve application security management. In this presentation, Yan will provide a detailed walk-through of the overall methodology. We will provide examples of the types of metrics and executive dashboards that can be generated by using this approach to managing application security and help highlight various ways this information can be used to further improve the overall maturity of application security programs.