The board, square by square

No game, no dice, no turn to wait for. Open any of the 22 capability domains and read the whole model — the trust question an assessment opens with, why the domain matters, how it usually goes wrong, the incidents that prove it and the real maturity ladder underneath.

ReferenceRead from Gantry

Play the board instead

DevSecOpoly

Harden the supply chain before it is breached.

Cooperative · 2–4 players

Click any square to read what is behind it

The 22 capability domains

Eight lifecycle groups, in the order a change travels through them. These are the squares that carry a trust question, a five-rung maturity ladder and the incidents that prove why the domain exists.

Govern & Design

Decide the rules and design security in

Secure Code

Stop vulnerabilities and bad dependencies before they merge

Pipeline Foundations

Know your components, protect credentials and harden the pipeline

Source & Build Trust

Prove what was changed, built and published

Harden & Test

Harden what ships and test it like an attacker

Deploy & Protect

Protect APIs, clusters and clouds where software runs

Operate & Respond

Control access, suppliers and incidents

Exposure & AI

Secure AI and reduce real exposure

The rest of the ring

The other eighteen squares are the game’s machinery rather than capability domains, so they open on what they do instead of a ladder.

Delivery methodologies

Cloud platforms

Corners

Best Practices deck

Software Supply Chain deck

Taxes

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 797 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.