An organization that bears operational responsibility for deploying, maintaining, and evolving code-based systems that deliver value to end users, including systematic risk stewardship across all components in their value delivery chain—whether directly controlled or third-party.
SF²
Software Factory Security Framework - A strategic mental model for scaling security capabilities while improving business outcomes.
Managing security risks from all external dependencies and third-party components throughout their lifecycle. #1 priority due to adversary evolution to automated discovery.
Process Stewardship
Security embedded throughout development lifecycle with continuous validation and rapid feedback loops.
Runtime Stewardship
Maintaining security and reliability of systems in production with proactive monitoring and rapid response capabilities.
Third-Party Stewardship
Managing security risks from integrated services, platforms, and vendors throughout operational lifecycle.
Continuous Learning
Evolving security practices based on experience, incidents, and changing threat landscape while building organizational capability.
Manual security work that scales linearly with growth (security reviews, threat modeling, incident response). Should be deliberately constrained post-scaling crisis.
Scaling Investments
Capabilities that reduce manual effort exponentially (automation platforms, self-service capabilities, policy-as-code). Primary investment focus past crisis point.
Platform Effects
Benefits that serve both internal and customer software factories, creating multiplicative value.
Scaling Crisis
The inevitable moment when demand for security services grows exponentially while team capacity grows linearly.
Paved Roads
Secure templates and patterns that engineers can use without security review, reducing manual effort while maintaining security.
Catch and Store Principle
Security investments that capture organizational effort and store it in reusable capabilities serving future needs without additional manual work.
The evolution of adversary capabilities from targeted attacks to automated discovery at internet scale. High maturity creates existential gaps for manual defender processes.
Supply Chain Complexity
The interconnected risk created by multi-tier dependencies, critical single vendors, and geopolitical constraints.
Regulatory Constraints
Compliance requirements that affect security implementation by increasing BAU workload and constraining technology choices.
Crisis Events
Security incidents, compliance failures, or business disruptions that create windows for organizational change and transformation.
Change Capacity
Organizational ability to absorb transformation, affecting transition speed and scaling investment success probability.
Relationship Health
The quality of relationships between security and engineering teams, directly affecting adoption velocity.