0 / 24

Model 44 of 74 · Cybersecurity

Security Operations Maturity Assessment

Assess SOC capability across detection, response, threat intelligence, and automation.

Pillars & areas

Prepare

Build the foundation

  1. 01SOC Structure & Staffing
  2. 02Log Management & Telemetry

Detect

Find the threats

  1. 03Threat Detection & Alerting
  2. 04Threat Intelligence & Hunting

Respond

Act decisively

  1. 05Incident Response & Forensics
  2. 06Automation & Orchestration

Levels

  1. 1Alert-DrivenReactive & unstructured
  2. 2OperationalisedDefined & consistent
  3. 3Intelligence-LedProactive & automated

01 SOC Structure & Staffing

Is the security operations function properly organised, staffed, and sustained to deliver consistent capability?

0/4 answered

SS-1How is your security operations function structured and resourced?

Think about whether there is a dedicated team, or whether monitoring is handled as an add-on to other IT roles.

SS-2How does your organisation ensure adequate monitoring coverage hours?

Consider whether threats that occur outside business hours would be detected and responded to promptly.

SS-3How does your organisation develop and retain security operations talent?

Think about whether analysts have clear career paths, training budgets, and opportunities to develop their skills.

SS-4How does your organisation manage analyst workload and prevent burnout?

Consider whether alert volumes are sustainable, whether analysts are constantly firefighting, and whether workload is monitored.

02 Log Management & Telemetry

Does the organisation collect the right data, from the right sources, with sufficient quality and retention to support detection and investigation?

0/4 answered

LT-1How comprehensive is your organisation's log collection across its environment?

Think about whether logs are collected from all critical sources — endpoints, network, cloud, identity, and applications — or whether significant gaps exist.

LT-2How does your organisation normalise and enrich log data for analysis?

Consider whether logs from different sources use consistent formats and fields, or whether analysts spend time translating between different log formats during investigations.

LT-3How does your organisation manage log retention and storage?

Think about whether you could investigate an incident that started six months ago, or whether those logs have already been deleted.

LT-4How does your organisation ensure the quality and reliability of its telemetry?

Consider whether you would notice if a critical log source stopped sending data, or if log timestamps drifted out of sync.

03 Threat Detection & Alerting

Does the organisation engineer, maintain, and measure its detection capability to keep pace with evolving threats?

0/4 answered

TD-1How does your organisation develop and maintain detection rules?

Think about whether detection logic is created methodically and kept current, or whether rules were written once and never updated.

TD-2How does your organisation manage false positive rates and alert quality?

Consider whether analysts trust the alerts they receive, or whether the majority of their time is spent closing false positives.

TD-3How does your organisation measure the coverage of its detection capability?

Think about whether you know which attack techniques your detection rules can and cannot catch.

TD-4How does your organisation handle alert triage and prioritisation?

Consider whether alerts are investigated in the order they arrive, or whether there is a structured method for deciding what matters most.

04 Threat Intelligence & Hunting

Does the organisation consume, operationalise, and act on threat intelligence — and does it actively hunt for threats that evade automated detection?

0/4 answered

TH-1How does your organisation consume and manage threat intelligence?

Think about whether threat intelligence is a feed that nobody looks at, or whether it actively informs security decisions.

TH-2How does your organisation manage and operationalise indicators of compromise?

Consider whether indicators from intelligence feeds are automatically checked against your environment, or whether they sit in a spreadsheet.

TH-3How does your organisation conduct proactive threat hunting?

Think about whether anyone in your team actively looks for threats that have not triggered an alert, or whether all detection is alert-dependent.

TH-4How does your organisation validate its defences through collaborative testing?

Consider whether the SOC and offensive security teams (internal or external) work together to test and improve detection and response.

05 Incident Response & Forensics

Can the organisation respond effectively to security incidents and conduct forensic investigations with the rigour needed to support remediation and, when necessary, legal proceedings?

0/4 answered

IR-1How mature is your organisation's incident response process?

Think about whether there are documented, practised procedures for handling incidents, or whether the response is different every time.

IR-2How does your organisation use playbooks to guide incident response?

Consider whether responders have step-by-step guidance for common incident types, or whether they work from memory and experience each time.

IR-3How does your organisation handle digital forensic investigations?

Think about whether your team can collect, preserve, and analyse digital evidence in a way that would withstand legal or regulatory scrutiny.

IR-4How effectively does your organisation learn from security incidents and near-misses?

Consider whether post-incident reviews produce real changes, or whether the same types of incidents keep recurring.

06 Automation & Orchestration

Does the organisation use automation effectively to reduce analyst toil, accelerate response, and improve operational consistency?

0/4 answered

AO-1How does your organisation automate alert enrichment and context gathering?

Think about whether analysts manually look up information about each alert (IP reputation, asset ownership, user details), or whether this is done automatically.

AO-2How does your organisation automate routine response actions?

Consider whether common containment actions (blocking an IP, disabling an account, isolating a host) require manual steps across multiple consoles.

AO-3How does your organisation manage and maintain its security automation playbooks?

Think about whether automated workflows are documented, tested, and maintained, or whether they were built once by someone who has since left.

AO-4How does your organisation measure the impact of automation on security operations?

Consider whether you can demonstrate that automation has actually improved response times, reduced toil, or increased analyst capacity.

Self-assessment report

Security Operations

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Security Operations maturity model

Security operations is where strategy meets reality. Every policy, control, and architecture decision ultimately depends on whether someone — or something — is watching, detecting, and responding when threats materialise. A well-funded security programme with poor operational execution is a programme that discovers breaches from newspapers. Security operations maturity is measured not by the tools deployed but by how quickly and effectively the organisation detects, investigates, and contains threats in a live environment.

This model goes beyond the surface-level detection and incident response questions found in general cybersecurity assessments. It examines the operational depth of your security function: how your SOC is structured and staffed, whether your telemetry actually covers your attack surface, how detection logic is engineered and maintained, whether threat intelligence drives real decisions, how forensic evidence is handled, and how much of the repetitive operational burden has been automated. These are the questions that separate organisations running a monitoring tool from organisations running a security operation.

The best security operations centres are not defined by their size or budget. They are defined by their discipline — structured processes, continuous tuning, relentless improvement, and the ability to act decisively under pressure. This model is designed to help organisations at any scale understand where their operational capability genuinely stands and where the gaps will hurt them most.

The Security Operations maturity model assesses 24 questions across 6 areas that together cover the full lifecycle of operational security — from building the team and collecting the right data, through detecting and hunting for threats, to responding to incidents and automating repetitive workflows. It is designed for organisations that already have some security monitoring in place and want to understand how to mature their operational capability.

Each question describes three levels of maturity through concrete, observable behaviours. The assessment produces area-level and overall scores that highlight where operational capability is strong and where investment in people, process, or technology will have the greatest impact on the organisation's ability to detect and respond to real threats.

Who this assessment is for

  • SOC managers and security operations leads benchmarking their team's maturity
  • CISOs and security directors evaluating operational capability and identifying investment priorities
  • Incident response and threat intelligence teams assessing process maturity
  • Security engineers and analysts seeking a structured view of operational gaps
  • Managed security service providers (MSSPs) baselining client SOC capability
  • IT leaders in organisations building or scaling a security operations function for the first time

The three maturity levels

  • Level 1 — Alert-Driven: Security operations are reactive and alert-driven. There is no formal SOC structure — monitoring is handled alongside other IT duties, alerts are investigated one at a time with no prioritisation framework, and most activity is triggered by tool-generated notifications rather than deliberate detection strategy. Logs are incomplete, retention is ad hoc, and incident response is improvised. The team is constantly firefighting, and there is no capacity for proactive work.
  • Level 2 — Operationalised: A defined security operations function exists with documented processes, dedicated staff, and structured workflows. Log collection is comprehensive, detection rules are actively maintained, and incidents are handled through a formal response process with playbooks. Threat intelligence is consumed and applied to detection, and basic automation reduces manual toil. The team operates with consistency and can handle routine incidents reliably, though capacity for advanced analysis and proactive hunting is limited.
  • Level 3 — Intelligence-Led: Security operations are intelligence-driven, proactive, and continuously improving. Detection engineering is mapped to threat frameworks, hypothesis-driven hunting is a regular activity, and forensic capability supports deep investigation. Automation handles enrichment, triage, and routine response actions, freeing analysts for high-value work. Metrics drive decisions about staffing, tooling, and detection coverage. The SOC anticipates threats rather than waiting for alerts, and every incident makes the operation stronger.

The 6 areas assessed

1. SOC Structure & Staffing

How the security operations function is organised, staffed, and sustained. This area examines whether there is a dedicated team, whether coverage matches the organisation's risk profile, whether analysts have the skills and career paths to remain effective, and whether burnout is actively managed. A SOC that cannot retain its people cannot retain its capability.

2. Log Management & Telemetry

Whether the organisation collects the right data from the right sources with sufficient quality and retention. This area covers collection breadth, data normalisation, storage and retention policies, and telemetry quality. Detection is only as good as the data it operates on — gaps in log collection are gaps in visibility.

3. Threat Detection & Alerting

How the organisation engineers, maintains, and measures its detection capability. This area assesses detection rule quality, coverage against known attack techniques, false positive management, and whether detection logic evolves in response to new threats. An alert that nobody trusts is worse than no alert at all.

4. Threat Intelligence & Hunting

Whether threat intelligence is consumed, contextualised, and operationalised — and whether the team actively hunts for threats that evade automated detection. This area covers intelligence programme maturity, indicator management, hypothesis-driven hunting, and collaboration with offensive security teams through purple teaming.

5. Incident Response & Forensics

How incidents are managed from initial triage through containment, eradication, and recovery — and whether the organisation can conduct forensic investigations when needed. This area goes deeper than general IR planning to assess playbook quality, forensic evidence handling, chain-of-custody practices, and the feedback loop from incidents back into detection and prevention.

6. Automation & Orchestration

How effectively the organisation uses automation to reduce analyst toil, accelerate response, and improve consistency. This area covers SOAR platform adoption, playbook automation, alert enrichment, and the degree to which routine response actions are automated while keeping humans in the loop for critical decisions.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • SOC-CMM (SOC Capability Maturity Model) — a detailed maturity model specifically designed for evaluating security operations centre capabilities
  • MITRE ATT&CK — a knowledge base of adversary tactics and techniques used to map detection coverage and structure threat hunting
  • NIST SP 800-61 (Computer Security Incident Handling Guide) — guidance on building and maturing incident response capabilities
  • CREST guidance on security operations — guidance from CREST for building and buying SOC services
  • MITRE D3FEND — a knowledge graph of defensive cybersecurity countermeasures mapped to ATT&CK techniques
  • PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) — a widely used incident response lifecycle model

Frequently asked questions

What is the Security Operations maturity model?

Assess SOC capability across detection, response, threat intelligence, and automation. It is an original, simplified model with three maturity levels (Alert-Driven, Operationalised and Intelligence-Led), assessed through 24 questions across 6 areas: SOC Structure & Staffing, Log Management & Telemetry, Threat Detection & Alerting, Threat Intelligence & Hunting, Incident Response & Forensics and Automation & Orchestration.

How long does the Security Operations assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Alert-Driven), 2 (Operationalised) or 3 (Intelligence-Led). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.