Health-data software company turns one secure-development assessment into two customer-facing attestations
A healthcare data-analytics software company. Outcome verified
The problem
A healthcare data-analytics software company had invested heavily in secure development tooling and process but had never had an outside party measure it against a recognized standard. Customers and prospects kept asking how secure the development process really was. Several competing standards exist, and the CTO also held the CISO role.
Why it mattered
The company handles sensitive health data. An unverified security story slows enterprise sales and questionnaire cycles, and hidden process gaps could surface as product vulnerabilities.
What we did
Vizius recommended skipping a lengthy standard-selection phase, assessing against OWASP SAMM and mapping the results to NIST SSDF so one effort could answer both. It scored all thirty SAMM streams from interviews, documents and recorded process walkthroughs, focusing on whether current practices would scale with growth rather than on checkbox gaps.
What changed
The company received a findings report and two customer-facing attestation letters (OWASP SAMM and NIST SSDF) stating it met or exceeded expectations in every risk-relevant stream, plus six prioritized recommendations covering privileged-credential management, security-champion training, threat modeling and separation of duties.
- Software and saas
- Midsize company
- NIST SSDF / OWASP SAMM