Skip to content
winfunc
Free AppSec self-assessment

Application security posture assessment

Review ten concrete controls across five domains. Identify the processes that need attention and download a practical action plan for your security and engineering teams.

Start the questionnaire

10 controls · 5 domains · Self-reported maturity · No email required

Security posture assessment progress0 / 10 answered

Your responses are processed in this browser. Downloads include your responses. No email is required to view or export your results.

01

Ownership & inventory

Can you identify every production application, repository, and accountable owner?
Are remediation targets defined and reviewed for critical and high findings?
02

Access & secrets

How is access to source control and production restricted?
How do you prevent and respond to exposed credentials?
03

Secure delivery

Are production changes reviewed and protected before merge?
Are code and dependency security checks part of your delivery workflow?
04

Validation & remediation

Are important scanner findings reviewed for reachability, context, and actual impact?
How do you confirm that a reported vulnerability has been fixed?
05

Operational readiness

Do production applications have security-relevant logs with an owner who reviews alerts?
Is there a tested process for responding to an application security incident?

Assessment in progress

Complete all ten controls for your result

10 controls remain unanswered. Unanswered controls are not counted as missing controls, and no overall score is issued until the questionnaire is complete.

Ownership & inventory

0/2 answered · incomplete

Access & secrets

0/2 answered · incomplete

Secure delivery

0/2 answered · incomplete

Validation & remediation

0/2 answered · incomplete

Operational readiness

0/2 answered · incomplete

Assess tooling coverage
Before you decide

Questions about the assessment

01What is a security posture questionnaire?

This questionnaire is a structured review of how your application security program operates. It asks about application ownership, access, secrets, delivery checks, contextual finding review, fix verification, logging, and incident readiness.

02How is the maturity score calculated?

Each of the ten controls receives zero points for an absent process, one for partial implementation, or two for a repeatable process. The complete score is total points divided by twenty, multiplied by one hundred. All controls carry equal weight. Unanswered controls remain unknown.

03Is this a security audit or compliance certification?

No. The score reflects your selected answers and does not verify technical control effectiveness, vulnerability exposure, or compliance with a specific framework. Use it to guide a review with your application owners and support answers with current evidence.

04What happens if I only answer some questions?

Your progress and complete domain scores are shown, but no overall score or final priorities are issued until all ten controls are answered. You can export an incomplete progress report and download a new report after finishing.