Codific Academy

What Codific Academy does

Codific is a Belgian private limited company (Codific BV) headquartered in Heverlee, Belgium, operating at the intersection of application security and EdTech. Founded by Aram Hovsepyan (CEO, PhD in application security from DistriNet KU Leuven and core OWASP SAMM contributor) and co-founder Dag Flachet (Chief Growth Officer), the company has been active in the OWASP community for over a decade. Codific is bootstrapped and founder-controlled, with no disclosed external funding, and holds ISO 27001 certification.

The company's core technology is SAMMY, a Product Risk and Compliance (PRC) management platform that operationalizes OWASP SAMM and DSOMM alongside EU regulatory frameworks (CRA, NIS2, DORA), ISO 27001, and NIST SSDF. SAMMY bundles maturity tracking, threat modeling (STRIDE-based), supply chain risk management, and framework cross-mapping into a SaaS application, with SSO via Google, GitHub, GitLab, and Microsoft, plus a Jira integration for remediation tasks. Codific complements SAMMY with three EdTech/HR-Tech products: Videolab, a GDPR-compliant secure video platform used by top universities and university hospitals for medical training; Attendance Radar, an automated attendance tracking application for universities; and SARA, a survey analysis automation tool. The company also delivers professional services — OWASP SAMM Assessments, Training, and Guidance.

Codific generates revenue through three streams: SAMMY SaaS subscriptions (quote-based, annual billing, no public pricing tiers), EdTech product licenses for Videolab/Attendance Radar, and OWASP SAMM professional services. The go-to-market is hybrid — sales-led direct engagement with enterprise security teams, event-driven activity at OWASP conferences, and community-led content marketing via blog, podcast, YouTube, and the Academic Application Security Program. Named customers include Zebra Technologies (Fortune 500), Sigma Software Group, Kiloverse, Approach Cyber, Sign In Solutions, and a broad set of European universities and university hospitals (Radboud UMC, KU Leuven, U Gent, U Antwerp, VUB, Maastricht University, Amsterdam UMC). Operating geographies are concentrated in Europe (Belgium, Netherlands, Germany), with growing outreach to US OWASP audiences.

Name

Codific Academy

Legal name

Codific BV

Website

https://codific.com

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

11–50 employees

Short description

Codific is a bootstrapped Belgian firm building SAMMY, an OWASP SAMM-aligned product risk and compliance management platform for enterprise security teams, alongside Videolab, Attendance Radar, and SARA for university medical education and HR-Tech customers.

Ownership category

akta.pro rank

Headquarters

HQ city

Leuven

HQ country

Belgium

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. SAMMY SaaS Subscription: SAMMY is offered as a SaaS platform for PRC management. Organizations pay subscription fees to access the platform for maturity assessments, threat modeling, supply chain risk management, and compliance tracking. Pricing likely follows per-seat or organization-level subscription tiers.
2. OWASP SAMM Professional Services: Assessment, training, and guidance services for OWASP SAMM implementation. Includes OWASP SAMM Assessments, OWASP SAMM Training, and OWASP SAMM Guidance offerings.
3. Ed-Tech Product Licenses: Secure video sharing (Videolab) and attendance tracking (Attendance Radar) products for universities and medical institutions. Videolab is used by top universities and university hospitals worldwide for medical education.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels7 records

Core offering

Codific develops and sells the SAMMY SaaS platform for Product Risk and Compliance (PRC) management, supporting application security assessments, threat modeling, and supply chain risk management aligned with OWASP SAMM, OWASP DSOMM, and EU regulatory frameworks (CRA, NIS2, DORA). It also sells EdTech products (Videolab for GDPR-compliant video sharing, Attendance Radar for university attendance, SARA for survey automation) and delivers professional services including OWASP SAMM Assessments, Training, and Guidance.

Product overview

Codific offers a portfolio of secure software development solutions centered around its core PRC (Product Risk and Compliance) management platform SAMMY, complemented by Ed-Tech/HR-Tech products (Videolab, Attendance Radar, SARA) and professional services (OWASP SAMM Assessments, Training, and Guidance). SAMMY serves as the unified platform for application security management, threat modeling, and supply chain risk management, while Videolab and Attendance Radar address secure video sharing and attendance tracking for educational institutions respectively.

Differentiator

Problem solved

Functional benefit

Brands

• SAMMY: PRC (Product Risk and Compliance) management tool that facilitates application security assessments, threat modeling, and supply chain risk management. It supports OWASP SAMM implementation and end-to-end product risk and compliance management.
• Videolab
• Attendance Radar
• SARA

Products and services

• SAMMY SAMMY is Codific's end-to-end Product Risk and Compliance (PRC) management SaaS platform that facilitates application security assessments, threat modeling, and supply chain risk management. It enables organizations to implement OWASP SAMM and track security maturity across frameworks including CRA, NIS2, DORA, and ISO 27001, and is used by enterprise security teams and product security groups.
• Videolab Videolab is a secure video sharing platform used by top universities and university hospitals worldwide to securely record patient interactions and share them with domain experts and trainers. It is GDPR-compliant from recording to feedback, offers fast and safe exchange of recordings, and supports tagging moments in recordings and annotating feedback for medical trainees and residents.
• Attendance Radar Attendance Radar is an automated attendance tracking application for universities. It provides easy and fast attendance tracking with high scalability, designed to handle large student populations in lectures and courses.
• SARA (Survey Analysis Automation) SARA is a survey analysis automation tool designed for Ed-Tech and HR-Tech applications, automating the analysis of survey data for organizations.
• OWASP SAMM Assessments Professional services for assessing organizational software security maturity using the OWASP Software Assurance Maturity Model (SAMM) framework, delivered to enterprise and mid-market organizations.
• OWASP SAMM Training Training services for organizations to learn and implement OWASP SAMM security practices across their software development lifecycles.
• OWASP SAMM Guidance Consulting and advisory services to guide organizations through OWASP SAMM implementation and compliance requirements, delivered alongside the SAMMY platform and assessment services.

Quantifiable outcome

• 58% of OWASP ASVS requirements can be automatically verified using unit, integration, and acceptance tests (37% unit tests, 20% integration tests, 1% acceptance tests)
• +2 more outcomes

Named customers9 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration5 records

Feature7 records

Partnerships

Six partnerships are on record, tiered core and key account.

• PXL University of Applied Sciences and ArtscoreStrategic or Co-development PartnerResearch collaboration on application security maturity assessment of SMEs using OWASP SAMM. Researchers Dr. Koen Gilissen and Savannah Eggers conducted comprehensive study of Flemish software SMEs security posture using the SAMMY tool, with findings published on Codific's blog.
• Radboud University Medical CentercoreOthersLong-term customer using Videolab for improving medical education with GDPR-compliant video recording and feedback system. Customer testimonial highlights system suitability for large groups of interns and residents.
• KU Leuven, U Gent, U Antwerp & VUBcoreOthersBelgian universities using Videolab for general practitioner training. Customer selected Codific based on satisfaction with prior applications including online testing platform and Videolab.
• OWASP FoundationcoreStrategic or Co-development PartnerCodific is deeply involved in OWASP community. Founder Aram Hovsepyan is a core contributing member of OWASP SAMM project. Company actively participates in OWASP events and created the globally recognized SAMMY tool for OWASP SAMM implementation.
• Zebra Technologieskey accountOthersEnterprise customer using SAMMY to implement OWASP SAMM. Case study demonstrates Codific's ability to pivot to customer needs and function as extension of customer's team.
• Sigma Software Groupkey accountOthersEnterprise customer case study focused on building security into software development lifecycle using Codific's solutions.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• IriusRisk: IriusRisk is a threat modeling and secure-by-design platform that helps teams design and track security controls during software development. It is closely comparable to SAMMY's integrated threat modeling (STRIDE) and product risk management features for enterprise AppSec teams.
• Drata: Drata is a compliance automation platform that continuously monitors controls across SOC 2, ISO 27001, HIPAA, and other frameworks. It competes directly with SAMMY in the recurring compliance SaaS category serving enterprise security buyers with automated evidence collection and audit-ready reporting.
• Vanta: Vanta is a leading compliance automation SaaS platform that helps organizations achieve and monitor frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. It is directly comparable to Codific's SAMMY as both sell subscription-based compliance/assurance management software to enterprise security teams with framework cross-mapping capabilities.
• Security Compass: Security Compass sells SD Elements, a platform for secure software development and application security compliance management, including threat modeling and regulatory mapping. It is a direct analog to SAMMY for organizations implementing structured AppSec programs aligned with OWASP/NIST frameworks.
• Secureframe: Secureframe provides compliance automation across SOC 2, ISO 27001, HIPAA, and PCI, with similar subscription pricing and enterprise security buyer focus. It overlaps with SAMMY's value proposition of streamlining framework adherence and audit preparation.
• Hyperproof: Hyperproof is a compliance operations platform that centralizes controls, evidence, and framework management across multiple standards. It competes with SAMMY in the multi-framework compliance tracking category for enterprise governance and security teams.
• Panopto: Panopto is a leading video platform for education and healthcare that supports secure recording, sharing, and management of training videos. It is directly comparable to Codific's Videolab product serving university medical centers for secure video-based training and feedback workflows.

Broad incumbents

• OneTrust: OneTrust is a broad privacy, security, and governance management platform covering consent, GRC, and regulatory compliance across global frameworks. It overlaps with SAMMY's compliance management capabilities as part of a much wider product portfolio serving similar enterprise buyers.
• Veracode: Veracode is an established application security testing vendor offering SAST, DAST, and SCA alongside policy and governance features. As an incumbent in the AppSec market, it serves similar enterprise security buyers as Codific but with a broader portfolio beyond OWASP SAMM-centric programs.
• Snyk: Snyk is a broad developer security platform spanning SAST, SCA, container, and IaC scanning, addressing application security at scale across enterprise developer teams. While broader than SAMMY, it overlaps in the AppSec tooling category where Codific's PRC and threat modeling capabilities also compete.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• YouTubeyoutube.com/@codificcom
• LinkedInlinkedin.com/company/codific

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Codific Academy