TheOnlySecurity
Secure SDLC services · for SaaS teams on AWS

9 services across the 7 stages of the secure development lifecycle, from the first requirement to the incident you hope never comes.

Explore servicesTake the self-check
  • 7 stages
  • 9 services
  • 21-question self-check
Aligned withOWASP SAMM v2.2NIST SSDF v1.1OWASP ASVS 5.0SLSA v1.2ISO/IEC 27001:2022NIST SP 800-61r3

Services × SSDLC

9 services mapped to the 7 stages of the secure development lifecycle. Pick a stage, a service, a single cell, or a regulation.

Regulation lens
9 services · 7 stages
·································

Ways to work together

Most clients start with a fixed-scope sprint, then decide what to keep.

  1. 01 · Start

    Fixed-scope sprint

    The SSDLC Baseline, or any single service, time-boxed with set deliverables.

    Typically 2–6 weeks
  2. 02 · Build

    Implementation

    Hands-on build-out of roadmap items: pipeline gates, SBOMs, champions, runbooks.

    Sprint by sprint
  3. 03 · Keep

    Fractional AppSec lead

    A monthly retainer: I own the roadmap, review designs, answer security questionnaires and re-score SAMM every quarter.

    Monthly

Large or recurring penetration tests and certification audits are delivered with vetted partners: I scope, coordinate and triage.

SSDLC self-check

21 questions across 7 stages, about 6 minutes. Graded answers, so partial progress counts. Your answers stay in your browser.

Aligned with OWASP SAMM v2.2 and NIST SSDF v1.1. A self-check, not a formal SAMM assessment.

Contact

Tell me where your lifecycle hurts.

Design reviews, pipeline gates, cloud posture or audit readiness: describe the situation and I'll reply within two working days with a suggested next step. Enquiries are welcome; there's no obligation.

Prefer email? hello@theonlysecurity.com · or LinkedIn ↗

Security issue in this site? See the disclosure policy.

I'll use your details only to reply to this message. They're sent to me by email and not stored on this site.

The Library · field notesGuides · playbooks · checklistsUpdated 23 Oct 2026

Field notes, filed.

I have
Browse the library →
GuideGovernance & ISO 27001

Who Actually Owns Security in the SDLC?

Security cannot become everyone's responsibility unless the organization defines what that responsibility actually means.

  • Security cannot become everyone's responsibility unless the organization defines what that responsibility actually means.
  • Separate four decisions: who defines expectations, who implements, who verifies, and who accepts residual risk.
  • Risk acceptance is a controlled management decision, not a convenient way to bypass security requirements.
  • A Security Champions program should distribute security capability, not distribute blame.
  • Security is a shared responsibility. Accountability for a specific decision should never be ambiguous.
23 Oct 2026 · 20 min read
Services and writing by Dimitar Kokotanekov, who runs product security at a SaaS company.