An application can pass a security assessment and change substantially before its next review. Dependencies are updated, vulnerabilities emerge and configurations evolve. Engineering teams must make decisions about the current application using evidence that may describe an earlier state.
Satya Sampreeth Boppudi addressed this gap through the Medallion Security Maturity Architecture, a framework he designed while working through Kingston Tech on an enterprise engagement with Marathon Petroleum. It continuously calculates application security tiers from engineering telemetry and connects those tiers to deployment permissions.
The approach gives security measurement an operational purpose: determining whether an application meets the requirements to advance through delivery workflows.
Turning Security Evidence Into Engineering Controls
Modern delivery systems generate extensive security information, but findings distributed across scanning platforms do not automatically produce a consistent decision.
Boppudi’s framework aggregates telemetry from SonarQube, Snyk, Rapid7 and GitHub Advanced Security, bringing source-code, dependency, dynamic-testing and repository-security signals into an application-level evaluation.
The resulting maturity tiers influence deployment permissions. This connects identified weaknesses to consequences within the delivery process and gives teams a clearer understanding of the conditions they must address.
Security maturity becomes an active engineering control rather than a score consulted during a periodic review.
Replacing Repetitive Assessment Work
The architecture replaced quarterly manual OWASP SAMM assessments requiring more than 200 person-hours per cycle. Over an 18-month rollout, it expanded across 150-plus applications and more than 1,000 CI/CD pipelines.
At that scale, repeatedly gathering evidence creates substantial overhead. Continuous evaluation allows measurable security conditions to be reassessed as engineering systems generate new information.
The framework establishes a shared basis for evaluating applications while reducing dependence on manually reconstructed assessment records. Comprehensive reviews still have a role, particularly for risks that operational telemetry cannot capture.
Measurable Changes Across the Portfolio
During the rollout, applications reaching Gold or Platinum maturity tiers increased from 12% to 67%. Mean critical-vulnerability remediation time fell from 45 days to seven days, while security-related deployment blocks declined from 23 to three per month.
These outcomes show stronger measured security alongside fewer recurring delivery interruptions. They also give the implementation significance beyond its technical design: the framework was applied across a substantial portfolio and accompanied observable changes in remediation and delivery.
The figures reflect results during implementation, rather than proof that any single control produced every improvement.
Keeping Enforcement Accountable
Binding security tiers to deployment permissions makes the accuracy of the evaluation consequential. Findings must be current, application mappings reliable and requirements understandable. Engineers need to know why a deployment was restricted and what must change before it can proceed.
Exceptions also require defined ownership, scope and expiry. Without those safeguards, informal bypasses can weaken an otherwise consistent control.
Boppudi’s broader platform work applies a similar principle through a ServiceNow integration that checks change compliance and rejects noncompliant deployments using policy-as-code. Governance operates within the workflow where the decision takes effect.
Preserving Judgment While Improving Assurance
Continuous measurement cannot capture every dimension of application risk. Architecture reviews, threat modeling and business-context analysis remain essential, especially for critical systems.
Its value lies in automating recurring evidence collection and enforcement so specialists can concentrate on decisions requiring expert judgment.
Boppudi’s Medallion architecture demonstrates how that balance can work at enterprise scale: maintain current security evidence, connect it to explicit delivery requirements and measure whether engineering outcomes improve.
