A considerable change from the first Build Security In Maturity Model. Version 2 has more structure, but I'm not sure that the two-dimensional model adds much. It still isn't a "maturity" model as such. Still, anything that gets more app dev security advice out there ...