Security Operations Maturity Assessment

About this model

About this assessment

About the Security Operations maturity model

Security operations is where strategy meets reality. Every policy, control, and architecture decision ultimately depends on whether someone — or something — is watching, detecting, and responding when threats materialise. A well-funded security programme with poor operational execution is a programme that discovers breaches from newspapers. Security operations maturity is measured not by the tools deployed but by how quickly and effectively the organisation detects, investigates, and contains threats in a live environment.

This model goes beyond the surface-level detection and incident response questions found in general cybersecurity assessments. It examines the operational depth of your security function: how your SOC is structured and staffed, whether your telemetry actually covers your attack surface, how detection logic is engineered and maintained, whether threat intelligence drives real decisions, how forensic evidence is handled, and how much of the repetitive operational burden has been automated. These are the questions that separate organisations running a monitoring tool from organisations running a security operation.

The best security operations centres are not defined by their size or budget. They are defined by their discipline — structured processes, continuous tuning, relentless improvement, and the ability to act decisively under pressure. This model is designed to help organisations at any scale understand where their operational capability genuinely stands and where the gaps will hurt them most.

The Security Operations maturity model assesses 24 questions across 6 areas that together cover the full lifecycle of operational security — from building the team and collecting the right data, through detecting and hunting for threats, to responding to incidents and automating repetitive workflows. It is designed for organisations that already have some security monitoring in place and want to understand how to mature their operational capability.

Each question describes three levels of maturity through concrete, observable behaviours. The assessment produces area-level and overall scores that highlight where operational capability is strong and where investment in people, process, or technology will have the greatest impact on the organisation's ability to detect and respond to real threats.

Who this assessment is for

• SOC managers and security operations leads benchmarking their team's maturity
• CISOs and security directors evaluating operational capability and identifying investment priorities
• Incident response and threat intelligence teams assessing process maturity
• Security engineers and analysts seeking a structured view of operational gaps
• Managed security service providers (MSSPs) baselining client SOC capability
• IT leaders in organisations building or scaling a security operations function for the first time

The three maturity levels

• Level 1 — Alert-Driven: Security operations are reactive and alert-driven. There is no formal SOC structure — monitoring is handled alongside other IT duties, alerts are investigated one at a time with no prioritisation framework, and most activity is triggered by tool-generated notifications rather than deliberate detection strategy. Logs are incomplete, retention is ad hoc, and incident response is improvised. The team is constantly firefighting, and there is no capacity for proactive work.

• Level 2 — Operationalised: A defined security operations function exists with documented processes, dedicated staff, and structured workflows. Log collection is comprehensive, detection rules are actively maintained, and incidents are handled through a formal response process with playbooks. Threat intelligence is consumed and applied to detection, and basic automation reduces manual toil. The team operates with consistency and can handle routine incidents reliably, though capacity for advanced analysis and proactive hunting is limited.

• Level 3 — Intelligence-Led: Security operations are intelligence-driven, proactive, and continuously improving. Detection engineering is mapped to threat frameworks, hypothesis-driven hunting is a regular activity, and forensic capability supports deep investigation. Automation handles enrichment, triage, and routine response actions, freeing analysts for high-value work. Metrics drive decisions about staffing, tooling, and detection coverage. The SOC anticipates threats rather than waiting for alerts, and every incident makes the operation stronger.

The 6 areas assessed

1. SOC Structure & Staffing

How the security operations function is organised, staffed, and sustained. This area examines whether there is a dedicated team, whether coverage matches the organisation's risk profile, whether analysts have the skills and career paths to remain effective, and whether burnout is actively managed. A SOC that cannot retain its people cannot retain its capability.

2. Log Management & Telemetry

Whether the organisation collects the right data from the right sources with sufficient quality and retention. This area covers collection breadth, data normalisation, storage and retention policies, and telemetry quality. Detection is only as good as the data it operates on — gaps in log collection are gaps in visibility.

3. Threat Detection & Alerting

How the organisation engineers, maintains, and measures its detection capability. This area assesses detection rule quality, coverage against known attack techniques, false positive management, and whether detection logic evolves in response to new threats. An alert that nobody trusts is worse than no alert at all.

4. Threat Intelligence & Hunting

Whether threat intelligence is consumed, contextualised, and operationalised — and whether the team actively hunts for threats that evade automated detection. This area covers intelligence programme maturity, indicator management, hypothesis-driven hunting, and collaboration with offensive security teams through purple teaming.

5. Incident Response & Forensics

How incidents are managed from initial triage through containment, eradication, and recovery — and whether the organisation can conduct forensic investigations when needed. This area goes deeper than general IR planning to assess playbook quality, forensic evidence handling, chain-of-custody practices, and the feedback loop from incidents back into detection and prevention.

6. Automation & Orchestration

How effectively the organisation uses automation to reduce analyst toil, accelerate response, and improve consistency. This area covers SOAR platform adoption, playbook automation, alert enrichment, and the degree to which routine response actions are automated while keeping humans in the loop for critical decisions.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

• SOC-CMM (SOC Capability Maturity Model) — a detailed maturity model specifically designed for evaluating security operations centre capabilities
• MITRE ATT&CK — a knowledge base of adversary tactics and techniques used to map detection coverage and structure threat hunting
• NIST SP 800-61 (Computer Security Incident Handling Guide) — guidance on building and maturing incident response capabilities
• CREST guidance on security operations — guidance from CREST for building and buying SOC services
• MITRE D3FEND — a knowledge graph of defensive cybersecurity countermeasures mapped to ATT&CK techniques
• PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) — a widely used incident response lifecycle model

Frequently asked questions