Why assess cybersecurity maturity?
Cyber threats change constantly, but most serious incidents still exploit the same weaknesses: unclear ownership, unmanaged access, unpatched systems, limited visibility, and people who don't know what to do when something looks wrong. A cybersecurity maturity assessment shows whether your defences are reactive and dependent on a few people, or structured, tested and improving.
The models in this domain are original and written in plain language, so they're usable by security teams and by the leaders and boards who oversee them. They complement, rather than replace, detailed control frameworks and standards. Each model page lists related frameworks you can use to go deeper once you know where your gaps are.
Where to start
- For an organisation-wide view, start with Enterprise Security. It covers governance, identity, detection, incident response, data protection and culture at a level suitable for leadership discussion.
- For the most common attack paths, follow up with Identity & Access Management and Human Behaviour Security.
- For security teams, use Security Operations to assess detection, Vulnerability Management to assess how weaknesses are found and fixed, and DevSecOps to assess security in software delivery.
- To prepare for the worst, Incident Response & Cyber Resilience assesses whether you could respond to and recover from a serious attack such as ransomware.
- For specific environments, choose Cloud Security, Zero Trust Security, Third-Party Security, AI Security or ICS / OT Security.
Answer for what is actually in place and working across the organisation today, not for what is planned or documented. In security, the gap between the two is often where the risk lies.