Skip to content
Cybersecurity Maturity Assessment

Find out your company's cybersecurity maturity level

In just a few minutes, identify gaps in governance, identity, protection, vulnerabilities, detection, response and compliance.

  • Free
  • ~7 minutes
  • Instant result
  • No sensitive technical information
  • Based on recognized best practices
// About the assessment

What cybersecurity maturity is.

Cybersecurity maturity measures how well an organization's security practices are defined, consistently carried out and improved over time. It goes beyond having tools: it assesses governance, people, processes and the real ability to prevent, detect and respond to incidents.

This assessment organizes that view into eight domains, inspired by references such as NIST Cybersecurity Framework 2.0, CIS Controls and ISO/IEC 27001, and returns a score from 0 to 100 per domain, the main gaps and a prioritized action roadmap.

// What is assessed

Eight domains, one broad view.

Each domain gets a score from 0 to 100 and a maturity level, showing where improvement pays off most.

  • 01

    Governance and Risk Management

    Responsibilities, risk management, third parties and executive oversight of security.

  • 02

    Assets and Attack Surface

    Asset inventory, vulnerability management and awareness of external exposure.

  • 03

    Identity and Access Control

    MFA, privileged access, offboarding and periodic access reviews.

  • 04

    Protection and Hardening

    Endpoint protection, patching and backup quality.

  • 05

    Application Security and DevSecOps

    Security across the development lifecycle, code and dependency analysis and secrets management.

  • 06

    Detection and Monitoring

    Ability to spot suspicious activity: logs, monitoring, triage and time to detect.

  • 07

    Response and Recovery

    Incident readiness, restore testing and crisis exercises.

  • 08

    Compliance and People

    Regulatory alignment, employee awareness and audit evidence.

// Methodology

How the score is calculated.

Each answer is worth 0 to 4 on the maturity ladder. The domain score is a weighted average normalized to 0 to 100, and the overall score combines the domains that apply to your context.

  1. Level 1Initial0 to 24Reactive, informal practices that depend on individuals and have little standardization.
  2. Level 2Basic25 to 44Practices exist, but execution is inconsistent, with little automation and limited governance.
  3. Level 3Structured45 to 64Defined processes, clear roles and predictable execution, with known controls.
  4. Level 4Managed65 to 84Metrics, automation and governance in use, with systematic improvement.
  5. Level 5Optimized85 to 100Data-driven decisions and continuous optimization, with a high level of automation.

"I don't know" answers are not scored as zero: they lower the answer completeness and indicate low visibility, which is a finding in itself. Some answers generate declared critical points regardless of the average.

Methodology cyber-v1.0 is guided by NIST Cybersecurity Framework 2.0, CIS Controls and ISO/IEC 27001, used as a conceptual reference, without literal reproduction. The result does not indicate compliance with any of these frameworks.

This is a self-assessment based on the answers provided and is indicative only. It does not replace an audit, pentest, technical assessment, certification or independent validation of controls.

// Free self-assessment

How the organization believes it is doing

Based on your answers, it delivers a first view of gaps and priorities in minutes.

// FFTech technical assessment

What the evidence shows

Specialists analyze your environment and evidence, with a validated roadmap.

Learn about the Security Posture Assessment
// FAQ

Frequently asked questions about the assessment.

// Start now

Find out how mature your security is.

It takes about 7 minutes and the result appears right away, with no sign-up.

Assess my security