The Building Security In Maturity Model (BSIMM) is a study of existing software security initiatives used by 95 companies of varying size across six verticals. The BSIMM is the measuring stick I’ve pitched to management as the tool we should use to evaluate where our AppSec program stands. While the BSIMM serves as a good measuring stick, it doesn’t provide much guidance for implementing the activities we may not currently perform or that we underperform.