Sample report. Entirely fictional data: “Example Company” does not exist, and no figure on this page comes from a customer.

Create a company account Try the demo

Shared document

Code review progress report

Example Company

Company-level aggregates — no personal data.

Period covered
November 2025 → October 2026
Generated on
13 October 2026
Document ID
DEMO-0000-0000

Scope

38
Developers enrolled
41
Declared headcount
93%
Coverage rate

The owner account is excluded: it does not hold a developer seat.

Engagement

31
Active participants
82%
Participation rate
412
Assessments completed
11
Median per active participant
median, not mean: one very active profile cannot skew it

Over the last three months: 26 active participants, 148 assessments.

Regularity

11/12
Active months in the period
6
Longest run of consecutive months
October 2026
Last activity
to the month

Regularity is what the texts literally ask for: training that is “ongoing” (DORA), “regular” (NIS2), “at least every twelve months” (PCI-DSS).

Progress

118
Progress index
+7.3
First / last third gap
74%
Participants improving
of 31 present in both periods
Average level over time, indexed to 100 From Nov 25 to Oct 26, the index reaches 118 from a base of 100. 100 118 Nov 25 Jan 26 Mar 26 May 26 Jul 26 Sept 26
Average level over time, indexed to 100
Month Index
Nov 25 100
Dec 25 103
Jan 26 101
Feb 26 106
Mar 26 109
Apr 26 no data
May 26 108
Jun 26 112
Jul 26 110
Aug 26 115
Sept 26 114
Oct 26 118

Months without publishable data appear as breaks: either no activity, or too few participants to publish an average.

The first month in the period with data is set to 100. Absolute levels are not published.

Families reviewed, out of ten

What the team reviewed, mapped to the ten OWASP Top 10:2025 families.

  • A01 Broken Access Control reviewed
  • A02 Security Misconfiguration reviewed
  • A03 Software Supply Chain Failures not reviewed
  • A04 Cryptographic Failures reviewed
  • A05 Injection reviewed
  • A06 Insecure Design reviewed
  • A07 Authentication Failures reviewed
  • A08 Software or Data Integrity Failures lightly reviewed
  • A09 Security Logging and Alerting Failures reviewed
  • A10 Mishandling of Exceptional Conditions not reviewed

This is coverage, not a pass rate: the block says which families were reviewed, never how well.

Regulatory mapping

This document is one piece of evidence among others. Each row also states what it does not establish.

Framework What it requires What this report provides What it does not provide
PCI-DSS 4.0 req. 6.2.2 Developers are trained at least every twelve months on software security relevant to their role, including secure design and coding. A dated record of training activity over a rolling twelve months, by OWASP family, with the team’s participation rate. The training itself, nor named proof that each developer was trained: the report is aggregated.
DORA (UE 2022/2554) art. 13(6) ICT security awareness programmes and digital operational resilience training, mandatory for staff. Evidence that a programme exists and is followed over time, with its regularity measured. The mandatory nature of the modules, nor coverage of all staff and management.
NIS2 (UE 2022/2555) art. 21(2)(g) Basic cyber hygiene practices and cybersecurity training. Evidence of cybersecurity training for development teams, dated and verifiable. Coverage of other populations, nor the nine other measures of Article 21.
ISO/IEC 27001:2022 A.6.3 · art. 7.2 A.6.3: awareness, education and training. Clause 7.2: competence, and retention of documented information as evidence. Documented information, dated and verifiable, ready for the audit file. The competence matrix, nor the effectiveness evaluation required by clause 7.2.

These references place the report within your obligations. NakamaCyber certifies no compliance: the assessment is your auditor’s.

OWASP SAMM maturity

Governance › Education & Guidance › Stream A (Training and Awareness)

  1. 1
    General awareness
  2. 2
    Role-specific training
  3. 3
    Measured effectiveness

Criteria met

  • At least half of those enrolled take part
  • Activity in at least six months
  • At least six OWASP families covered
  • At least 80% of those enrolled take part
  • Activity in at least ten months
  • Measurable progress (index ≥ 105)
  • At least four median assessments per participant

Criteria not met

  • At least nine OWASP families covered

OWASP SAMM covers fifteen practices; this report documents only one.

SAMM is a self-assessment model. NakamaCyber does not validate it.

How this document is produced

  • Assessments are taken online and repeated over time.
  • The measurement relies on repetition: twenty questions drawn at random for each assessment, never the same set, and progress tracked over several months.
  • The document attests to the engagement and progress of the company’s developers: security assessments taken regularly, against a recognised framework, with results that improve over time.
  • The document contains only company-level aggregates: no names, no email addresses, no individual results. Below 5 active participants, rates and the curve are not published.
  • The figures are computed automatically from platform data. The company triggers the sharing; it enters no figures.
  • The question bank is updated regularly, following our security watch; last addition on 17 September 2026.

Document ID: DEMO-0000-0000 · generated automatically by NakamaCyber

This report, for your team

Invite your developers, let them progress, and share a link with your customers when they ask for evidence.

Create a company account Back to the overview

Document ID DEMO-0000-0000 — sample, not verifiable.

In the print dialog, choose “Save as PDF” as the destination.