A cybersecurity maturity assessment measures how structured an organization's security practices are, compared with a recognized framework and expressed on a scale, usually from 0 to 5. It shows where the company stands, where similar companies stand, and the distance to the target.
Maturity measures process; risk measures what an adversary can do. The two are related, but a high score alone does not guarantee protection.
What each level of the scale means
Most assessments use a scale inspired by CMMI. In the Vultus methodology, 0 to 0.9 is the initial level, where activities happen inconsistently. From 1.0 to 1.9, the level is known: the process exists but depends on specific people. From 2.0 to 2.9, it is standardized, with documentation and a designated owner.
From 3.0 to 3.9, the level is managed, with indicators and goals tracked; from 4.0 to 5.0, it is optimized, with continuous improvement and automation. The transition from known to standardized is the most important: security continues to function even when the person operating it is absent.
What is assessed
The NIST Cybersecurity Framework 2.0 is the most widely used framework as a foundation because executives can understand it and it enables comparisons between companies. Results can be viewed through NIST's six functions (Govern, Identify, Protect, Detect, Respond, and Recover) or four organizational dimensions: governance, processes, people, and technology.
A breakdown by dimension is usually the most revealing for the board because it shows where investment has gone. The framework comparison is in the article on NIST CSF 2.0, ISO 27001, and CIS Controls.
Where Brazilian companies stand
The 2026 Cyber Risk Landscape, a Vultus study of 132 organizations across 11 sectors, recorded average maturity of 1.87 in technology, 1.67 in people, 1.62 in processes, and 1.48 in governance. All scored below 2, in the range where security still depends on specific people.
Between 2025 and 2026, average maturity increased 5.6% and attack likelihood rose 3.7%. The improved score did not keep pace with growing exposure.
The same pattern appears at the country level. The Global Cybersecurity Index 2024, from the ITU, a UN agency, shows that the global average score has risen to 65.7 out of 100 since 2021, but capacity building and technical measures remain the weakest pillars in most countries.
Self-reporting or evidence
When a score comes from a self-assessment questionnaire, the bias tends to be optimistic: respondents know the policy and have rarely seen it fail. Requiring documentary evidence for every answer, interviewing the people doing the work, and checking the score against a real test reduce that bias.
Consider a fictional logistics company that scores 2.4 on its self-assessment. In the evidence-based assessment, access reviews have been on hold for two years, the response plan has never been tested, and the inventory excludes cloud services procured by business departments. Its score falls to around 1.6.
How to turn a score into a plan
The score creates value only when it translates into management:
- Goal: where the company wants to be and by when, according to its risk appetite.
- Roadmap: initiatives organized in annual waves, each linked to the dimension it improves.
- Measurement routine: annual reassessment using the same method so progress can be compared.
For most companies, reaching the standardized level in critical dimensions already represents a structural change. The assessment is also one component of the Information Security Master Plan.
Assessment against industry benchmarks
Vultus assesses maturity using evidence and compares results with companies in the same industry, size, and revenue bracket, giving the score context and turning it into a goal. Take the Vultus maturity assessment and read about risk-based cybersecurity.
