Introducing Initiatives: Group Guidelines and Repos to Programs.
Image All articles Product Updates

Introducing Initiatives: Group Guidelines and Repos to Programs.

Initiatives group any guidelines and any repos you choose under a program you define, whether that’s OWASP Top 10, SOC 2 Type II, an internal architecture standard, or something entirely your own…

July 8, 2026

TL;DR: Initiatives group any guidelines and any repos you choose under a program you define, whether that’s OWASP Top 10, SOC 2 Type II, an internal architecture standard, or something entirely your own. There’s no fixed list of programs Pandorian ships with. Each Initiative shows a live compliance percentage that updates automatically as scans run.

Ask what “OWASP Top 10” and “get every service off the deprecated RestTemplate pattern by Q3” have in common. On paper, nothing. One’s an industry security benchmark. The other’s a deadline from a planning meeting. In Pandorian, they can be the exact same kind of thing: an Initiative.

An Initiative isn’t a preset list of compliance frameworks Pandorian ships with. It’s a container you define yourself: pick any guidelines, attach any repos, name it whatever the business calls it, and get a live score for it.

OWASP Top 10 and SOC 2 Type II show up naturally because they’re common programs engineering leaders track. They aren’t the limit. If your org cares about it, and it can be described as a set of guidelines applied to a set of repos, it can be an Initiative.

An Initiative was never Pandorian’s category. It’s the one you’d have written on a whiteboard anyway.

An Initiative Is Whatever You Say It Is

An Initiative is a named container for any set of guidelines and any set of repos, not a preset compliance template.

Pandorian’s own homepage shows Initiatives like SOC 2 Type II, OWASP Top 10, API Standards, and Performance SLAs side by side. None of those are the same kind of thing. One’s a certified compliance framework. One’s a security benchmark. One’s an internal architecture standard. One’s an SLA commitment to the business. Pandorian doesn’t treat any of them as a special case; they’re all just an Initiative: a name, a set of guidelines, a set of repos, a score.

That means the actual list of things you can track isn’t “the compliance programs Pandorian shipped support for.” It’s everything your org has ever wanted a straight answer about: a migration, a security push, a performance commitment, a standard one team is rolling out to the rest of the org.

Pick the Guidelines. Any of Them.

Guidelines attached to an Initiative can come from Pandorian’s catalog, your own imported standards, or anything written from scratch in plain English.

An OWASP Top 10 Initiative might pull ready-made security guidelines straight from the catalog. An Initiative for “get every service off the deprecated RestTemplate pattern” is guidelines your own architects wrote last quarter, imported or typed in directly. The Initiative doesn’t care where the guidelines came from. It only needs to know which ones count toward this specific program.

Attach the Repos That Actually Matter

Repos attached to an Initiative should be the ones the program actually applies to, whatever the program is.

An OWASP Top 10 or SOC 2 Initiative probably only needs the services that touch customer data, like payments-service and auth-service. A performance SLA Initiative might need a completely different set: whatever’s user-facing and latency-sensitive. An Initiative scoped to a single legacy service might need exactly one repo. The point isn’t which repos belong. It’s that the Initiative only measures what you attached.

One Percentage, Whatever You’re Measuring

Every Initiative shows a live percentage calculated from its own attached guidelines and repos, refreshed automatically as scans run, regardless of what the Initiative is tracking.

For SOC 2 Type II, that means attaching the encryption, access, and logging guidelines the audit tests, and getting a live view across the observation window instead of a scramble before fieldwork. For an internal migration or a performance push, it’s the same mechanism: a number leadership can check without pinging three teams for a status update.

One Place to Define, Scope, and Track Any Program

Every example above comes back to the same idea: an Initiative is a general-purpose way to group guidelines and repos, not a template for one kind of program.

  • Any guidelines: Pull from the catalog, your own imports, or write new ones from scratch, whatever the Initiative needs.
  • Any repos: Attach only the repositories that actually belong to this specific program.
  • A live compliance percentage: Every scan recalculates the score automatically, for audits and for everything else.
  • One place, any answer: Whether the question is about OWASP compliance, migration progress, or an internal standard, there’s a single screen that answers it.

An Initiative Was Never Pandorian’s List. It Was Always Yours.

OWASP Top 10 and SOC 2 Type II are useful examples because most engineering orgs already track them. They were never the ceiling. Anything you can describe as “these guidelines, on these repos” gets the same live score, the same visibility, the same answer on demand.

Common Questions

What is an Initiative in Pandorian?

An Initiative is a container for any guidelines and any repos you choose, grouped under a program you define. It isn’t limited to a fixed list of compliance frameworks. Common examples include OWASP Top 10 and SOC 2 Type II, but an Initiative can just as easily track an API standard, a migration, or any goal specific to your org.

Is Initiatives limited to OWASP Top 10 and SOC 2 Type II?

No. Those are two common examples, not a fixed list. An Initiative can group any guidelines, from the catalog, imports, or custom writing, with any repos, under any name: an architecture standard, a performance SLA, a migration effort, or anything else you want to track with a live score.

How do I track OWASP Top 10 compliance across my codebase?

Create an Initiative for OWASP Top 10, add the relevant security guidelines (parameterized queries, output encoding, rate limiting, and similar controls), then attach the repositories in scope, such as your payments or authentication services. Pandorian calculates a live compliance percentage from that point forward, updated automatically as scans run.

How is an Initiative different from just tagging guidelines by category?

A category, like Security, groups guidelines by type, not by program. An Initiative groups a specific subset of guidelines and repos into one trackable unit with its own score, regardless of category.

How do I attach a specific repo to an Initiative?

From the Initiative, add the repositories that should be measured against it. Only attached repos count toward that Initiative’s compliance percentage. A repository can belong to more than one Initiative at once, since a single service can fall under OWASP Top 10, SOC 2, and an internal API standard simultaneously.

Doesn’t this just duplicate what the guidelines catalog already shows?

No. The catalog shows every guideline across the org. An Initiative isolates whatever guidelines and repos make up one specific program, compliance audit or otherwise, and reports on that scope alone.

Written by Amit Kochman, GTM Operations Director at Pandorian

Book a Demo with Pandorian

Related Reading

More articles to read