scadastrangelove/asamm

Agentic SAMM

An OWASP SAMM Extension for AI-Driven Development

This document extends OWASP SAMM to systems where software is no longer the only actor.

Abstract

The security industry spent thirty years teaching developers not to trust user input. Reasonable advice. Then it handed them systems that trust everything — documents, issues, tool descriptions, retrieved web pages, CI logs — as long as it arrives through an authorized channel.

This is where classical SAMM ends and the problem begins.

Agentic systems are not simply software with an AI layer. They are systems where context is part of the control plane, tool calls are security boundaries, and the development workflow itself is an attack surface. A completed threat model, a clean DAST report, and a passed penetration test will all stay green while the real exposure sits untouched in the tool registry, the MCP server, and the autonomy window between checkpoints. The dashboard is healthy. The system is not.

Agentic SAMM extends OWASP SAMM to cover what classical lifecycle thinking cannot: the assurance surface that begins where code ends. It introduces a threat taxonomy organized around entry points rather than consequences, a two-path adoption model for teams migrating from existing programs and teams building from scratch, twenty-one controls across five SAMM function families with evidence-based maturity levels, and a structured audit methodology with three audit tracks.

There is also the question of gravity. In agentic systems, gravity is what happens to every unreviewed action in a long autonomy window — it accelerates, compounds, and lands somewhere nobody planned. The framework is structured around not letting that happen.

Sergey Gordeychik, CyberOK, 2026

---

[![Status](https://img.shields.io/badge/status-draft