What Codific does

Codific BV is a Belgian private limited company headquartered in Heverlee (Leuven), founded in 2010, operating in application security and secure software development with a stated focus on medical and educational spheres. The company operates two product lines under one roof: (i) a cybersecurity SaaS and services business built around SAMMY, an end-to-end Product Risk and Compliance (PRC) management tool that natively supports five frameworks — OWASP SAMM, NIST SSDF, OWASP ASVS, OWASP DSOMM and the Secure Controls Framework — together with threat modeling, supply chain risk management, Jira and OpenCRE integrations; and (ii) an EdTech portfolio comprising Videolab (GDPR-by-design secure video sharing used by university hospitals to record and review patient interactions), Attendance Radar (scalable automated student attendance tracking) and SARA (survey analysis automation).

The business model blends three revenue streams: SAMMY SaaS subscriptions (freemium community tier plus paid tiers, pricing not publicly disclosed), OWASP SAMM professional services — Assessments, Training and Guidance — delivered to mid-market and enterprise clients and extended through an Implementation Partners Program, and institutional licensing of Videolab and Attendance Radar to universities and university hospitals. Codific is bootstrapped in practice, having raised only a single insider round of approximately $108,097 from Flachet Holdings in January 2018.

Go-to-market is multi-motion: community-led through deep OWASP involvement (the CEO is a core OWASP SAMM contributor and the firm's LINDDUN privacy work is incorporated into ISO and NIST standards), product-led growth via SAMMY's free community registration, direct sales for professional services and EdTech institutional licenses, and channel-led expansion through Implementation and Academic partner programs. Customers span 17+ named organizations across EMEA and beyond, including Zebra Technologies, Sigma Software Group, BDO, RSM and a cluster of Belgian and Dutch university hospitals (RadboudUMC, Amsterdam UMC/VUmc, Maastricht University, KU Leuven, U Gent, U Antwerp, VUB). Codific is ISO 27001 certified.

Name

Codific

Legal name

Codific BV

Website

https://codific.com

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

11–50 employees

Short description

Codific BV is a Belgian cybersecurity and secure-software firm that sells the SAMMY Product Risk and Compliance platform, OWASP SAMM professional services, and EdTech products (Videolab, Attendance Radar, SARA) to enterprises, universities and university hospitals across EMEA and beyond.

Ownership category

akta.pro rank

Product category

Application Security Management Software

NAICS

Software Publishers (51321), Custom Computer Programming Services (541511), Advertising, Public Relations, and Related Services (5418)

SIC

Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Programming Services (7371)

akta.pro primary industry

Software Asset Management (SAM) & License Compliance (BPAEAOAB)

Keywords

• Application security management
• Product risk compliance
• Secure video sharing
• OWASP SAMM software
• Secure software development

Headquarters

HQ city

Leuven

HQ country

Belgium

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SAMMY subscription (SaaS): SaaS subscription for the SAMMY PRC management tool, with a free community registration tier and presumably paid tiers for enterprise / premium usage; self-serve onboarding at sammy.codific.com with structured assessment workflows, dashboards, and reporting.
2. OWASP SAMM professional services: Professional services revenue from OWASP SAMM Assessments, OWASP SAMM Training, and OWASP SAMM Guidance delivered to enterprises and SMEs; includes an Implementation Partners Program that extends delivery capacity.
3. Videolab and Attendance Radar institutional licenses: Institutional licensing of the Videolab secure video platform and Attendance Radar to universities and university hospitals worldwide, supporting academic and medical-education use cases.

Pricing tiers

Go-to-market motion5 records

Distribution channels1 record

Marketing channels8 records

Core offering

Codific develops and sells SAMMY, an end-to-end Product Risk and Compliance (PRC) management tool that supports application security assessments, threat modeling, and supply chain risk management across multiple frameworks (OWASP SAMM, NIST SSDF, OWASP ASVS, OWASP DSOMM, SCF). It complements this with EdTech products — Videolab (GDPR-compliant secure video sharing), Attendance Radar (automated attendance tracking), and SARA (survey analysis automation) — and delivers professional services including OWASP SAMM Assessments, Training, and Guidance to enterprises, SMEs, and academic medical institutions.

Differentiator

Problem solved

Functional benefit

Brands

• SAMMY: Codific's end-to-end PRC (Product Risk and Compliance) management tool, covering maturity, control and compliance frameworks and integrating product risk assessments and supply chain management. Hosted at sammy.codific.com.
• Videolab
• Attendance Radar
• SARA

Products and services

• SAMMY End-to-end Product Risk and Compliance (PRC) management tool that supports application security assessments, threat modeling, and supply chain risk management across multiple frameworks (OWASP SAMM, NIST SSDF, OWASP ASVS, OWASP DSOMM, SCF), with maturity scoring, evidence capture, improvement plans, dashboards, and maturity reports. Targeted at enterprises and SMEs that need to embed security into the SDLC.
• Videolab Privacy-by-design secure video sharing platform used by top universities and university hospitals worldwide to record patient interactions and share them with domain experts and trainers, with GDPR-compliant recording-to-feedback workflows, tagging, and annotation for fast feedback loops. Targeted at medical schools and university hospitals.
• Attendance Radar Automated student attendance tracking application designed for high scalability across universities, used by professors for easy and fast attendance tracking.
• SARA Survey Analysis Automation tool listed among Codific's Ed-Tech and HR-Tech solutions.
• OWASP SAMM Assessments Professional service conducting structured OWASP SAMM-based maturity assessments for enterprises and SMEs, delivered as a paid engagement.
• OWASP SAMM Training Professional training service on the OWASP SAMM framework, delivered to enterprises and SMEs to build internal application security maturity capability.
• OWASP SAMM Guidance Professional advisory service providing expert guidance on implementing OWASP SAMM and broader product risk and compliance practices for enterprises and SMEs.

Quantifiable outcome

• More than 50 in-depth application security assessments conducted with Brian Glas across Fortune 500 companies and beyond
• +3 more outcomes

Named customers22 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

Feature6 records

Partnerships

Three partnerships are on record, tiered flagship and core.

• OWASP (Open Worldwide Application Security Project)flagshipStrategic or Co-development PartnerCodific is deeply embedded in the OWASP SAMM project: founder/CEO Aram Hovsepyan is a core contributing member, and Codific created SAMMY as the globally recognised OWASP SAMM tool in Leuven, Belgium. The company maintains a dedicated 'Codific @ OWASP' and 'Codific @ OWASP Global AppSec Washington D.C. 2025' presence and runs an Implementation Partners Program around SAMMY.
• PXL University of Applied Sciences and ArtscoreStrategic or Co-development PartnerResearch partnership in which PXL's Cyber Security Research Coordinator Dr. Koen Gilissen and researcher Savannah Eggers conducted an application security maturity assessment of Flemish SMEs using Codific's SAMMY tool and the OWASP SAMM framework, producing publicly published findings.
• DistriNet KU Leuven (research group)coreStrategic or Co-development PartnerAram Hovsepyan, founder and CEO of Codific, holds a PhD in application security from DistriNet KU Leuven, providing Codific with deep ties to KU Leuven's security research group and access to security talent.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Emerging players

• Apptega: Apptega is a cybersecurity compliance management platform helping organizations build, manage and report on security frameworks and maturity programs. It targets the same framework-driven compliance buyer as SAMMY but with a stronger MSSP/partner-led motion.
• MedBridge: MedBridge is a healthcare-focused education and training platform used by hospitals and clinicians for video-based continuing education and competency assessment. It addresses the same academic-medical-center video training buyer as Codific's Videolab, though with a broader clinical-education portfolio.

Direct peers

• Hyperproof: Hyperproof is a SaaS compliance and security assurance operations platform for managing controls, evidence and audits across multiple frameworks. It overlaps with SAMMY's multi-framework (OWASP SAMM, NIST SSDF, ASVS, DSOMM, SCF) PRC workflow.
• Secureframe: Secureframe automates compliance for SOC 2, ISO 27001, HIPAA, PCI and NIST frameworks with continuous monitoring and policy generation. It is a direct competitor to SAMMY in the compliance automation category Codific serves.
• Panopto: Panopto is a secure video and lecture-capture platform widely used by universities and academic medical centers for recording, sharing and analyzing video. It is the closest direct competitor to Codific's Videolab in the medical-education and higher-ed video evaluation niche.
• Drata: Drata is a compliance automation platform that streamlines SOC 2, ISO 27001, HIPAA, PCI and similar audits via continuous control monitoring. Like SAMMY, it targets security and compliance leaders formalizing maturity programs; the two compete for overlapping framework-coverage budget.
• Vanta: Vanta is a leading automated compliance and trust management platform covering SOC 2, ISO 27001, NIST, HIPAA and adjacent frameworks with continuous evidence collection. It competes directly with Codific's SAMMY for the same GRC/CISO budget that drives OWASP SAMM, ISO 27001 and NIST SSDF programs.
• GoReact: GoReact is a video-based assessment and feedback platform used in higher education and clinical training to record performances, tag moments and deliver timestamped feedback. It overlaps directly with Videolab's core use case of secure video evaluation for medical trainees.

Broad incumbents

• OneTrust: OneTrust is a broad privacy, security and GRC platform offering GRC, ethics, ESG and consent management with deep enterprise penetration. It competes with SAMMY at the upper end of the framework-driven GRC market, though it does not specialize in OWASP SAMM.
• Snyk: Snyk is a broad developer security platform spanning SAST, SCA, IaC and container security, with deep SDLC integration. It competes with SAMMY for the same application security program budget at enterprises like Zebra Technologies, but at a different (scanning) layer of the AppSec stack.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• YouTubeyoutube.com/@codificcom
• LinkedInlinkedin.com/company/codific
• Xx.com/codific_eu
• Facebookfacebook.com/codific.be

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Codific