Cybersecurity Capability Model: AI-Ready Edition

This cybersecurity capabilities map is for CIOs, architects and transformation leads deciding where AI should help the security function and where people must keep the decision. It describes security in business terms, from identity and access to detection and response, across 39 L2 capabilities, and records for each one the AI opportunity, what stays human, the oversight level and the risk tier. A scoring model ranks the capabilities, and a 40-question readiness assessment shows what would stop the first AI uses from working.

About the Cybersecurity Capability Model

Security work is described here as capabilities: stable, defined units of what the function does, independent of the products it runs. The model has 9 L1 areas, 39 L2 capabilities and 195 L3 capabilities, with definitions to L3 and 161 KPIs at L2. Identity and access management is one of the areas rather than a separate model, so access decisions sit in the same structure as detection, response and the rest of the function.

Each capability carries an ID that stays fixed between releases. Privileged access management, for example, is CY-4.4. That lets a roadmap, a heatmap, a risk register and an investment case refer to the same capability without arguing over what a team or tool name covers.

On top of the structure sits the AI layer. Every L2 capability has a profile that sets out the AI opportunity, what stays human, the agents involved, the data they need, AI measures, prerequisites, risks and workforce impact, with a target AI mode, an oversight level and a risk tier. Every L3 has its own work pattern, mode, AI fit and risk tier. The sample shows the level of detail: for privileged access management an agent finds accounts with elevated rights and proposes owners, while the System Owner approves every privileged access grant and the agent never decides one.

Why It Matters

Security functions tend to be described by their tooling and their org chart: the operations center, the identity team, the vulnerability scanner, the awareness program. That description makes it hard to show a board what the function does, to compare investments across teams, or to see which work no one owns. A capability model gives the function a vocabulary that does not change when a tool is replaced.

AI is arriving in security from every direction, inside detection tools, ticketing, identity products and analyst assistants, sometimes switched on by a vendor update. Each addition raises the same questions about what an agent may do on its own and who answers for its actions, and security is a function where an unattended mistake can lock people out or leave a door open. The AI profiles answer those questions per capability, once, and the ranking shows where AI earns its place first.

What's Inside

• 9 L1, 39 L2 and 195 L3 cybersecurity capabilities, with definitions to L3 and 161 KPIs at L2
• A full AI profile for every L2 capability: opportunities, what stays human, agents, data, KPIs, AI measures, prerequisites, risks and workforce impact
• AI ratings for every L3: work pattern, target AI mode, AI fit and risk tier
• A prioritization model with a risk-adjusted score and rank for every L2 capability, using your own ratings and weights
• An AI heatmap of the whole model
• A 40-question weighted AI readiness assessment
• A Welcome document, the capability map deck, standalone capability definitions and KPIs documents, the Excel workbook, the user guide
• Bonus files: a cybersecurity glossary, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template and capability relationship mapping templates
• Free corrections, and new versions free for 180 days

Every file names your organization and carries your license ID. Ratings describe a typical large enterprise and are a starting point for your own.

Where It Is Used

AI opportunity assessment for security. Score the 39 L2 capabilities with your own ratings and weights and read the heatmap to see where AI fit and value are high relative to risk. Capabilities that grant access or block activity show their oversight level next to their score, so the ranking never hides the control question.

Security tool rationalization. Map each security product to the L2 and L3 capabilities it supports. Overlaps between tools and capabilities with no tool at all become visible in one view, which gives consolidation decisions a basis other than contract renewal dates.

Vendor evaluation by capability. When a vendor offers an AI feature, find the capability it serves and read its profile first. The target AI mode and oversight level tell you whether the feature's proposed autonomy matches what the capability should allow.

Board and executive reporting. Report security posture and investment by capability and KPI rather than by project. Executives see the function as a set of stable areas they can follow from one quarter to the next.

Readiness baseline. Run the readiness assessment with security, IT and risk stakeholders to find the data, skills and governance gaps that would stop AI work. Use the result to fund foundations before agents.

Merger and integration planning. Map both security functions to the same capabilities to see where they overlap, where one is stronger, and where access and monitoring must be joined first.

Who Works With It

Chief Information Security Officer. Describes the function, its investments and its AI plans in capability terms, and decides where AI goes first from the ranking.

Security architects. Map tools and controls to capabilities and use the profiles to set the autonomy an AI feature may have before it is enabled.

Identity and access management lead. Uses the identity capabilities and their profiles to decide which access work an agent can prepare and which grants stay with a System Owner.

Security operations lead. Uses the ratings for detection and response capabilities to decide where analysts get AI assistance and where a person must act.

Enterprise architects. Link security capabilities to the rest of the enterprise model so security work appears in roadmaps and investment cases alongside the business it protects.

A Blank Slate, Consultants, or a Reference Model

Security leaders who want a capability model with an AI layer can build one, commission one or start from one, and each choice spends a different kind of scarce time.

• Building it from a blank slate. Senior security staff spend workshop after workshop agreeing the structure and wording of capabilities, then rate each one for AI mode, oversight and risk, then build a scoring model. Those are the same people who are needed to run the function, so the work competes with operations and drags.
• Hiring consultants to build it. Consultants bring a method and keep the work moving, and they still have to elicit a generic security structure from your team before tailoring it. The result is often tied to their own vocabulary and harder to maintain after they leave.
• Starting from this model. The structure, definitions, KPIs, AI profiles, ratings, scoring model and readiness assessment are drafted and cross-checked. Your team reviews and edits instead of writing from scratch, and the debate moves straight to your own exposures and priorities.

The judgment your team or advisors bring is best spent on adjusting ratings and risk tiers to your environment and setting the weights. The package ratings describe a typical large enterprise; your threat exposure, estate and staffing should change them.

First Steps

1. Read the Welcome document and the user guide to understand the IDs, files and rating scales.
2. Review the capability map deck with security leaders and mark capabilities to rename, merge or drop.
3. Adjust the AI ratings and risk tiers in the workbook to reflect your environment, then set your weights.
4. Run the readiness assessment to see which foundations need work first.
5. Read the AI profiles of the top-ranked capabilities and turn each into a proposal with an owner, oversight level and KPIs.

Read the Public Sample

The sample follows one thread through the package, privileged access management, and is 0.76% of the content. From the Privileged Access Management (CY-4.4) AI profile:

• Work patterns: Coordination & orchestration, Analysis & insight, Rules-based decision
• Target AI mode: Augment
• Human oversight: Human-in-the-loop
• AI fit / Value / Feasibility / Data readiness: 4 / 5 / 3 / 2 (1–5)
• Risk tier: High
• Roadmap wave: Wave 2
• AI opportunity: Find accounts with elevated rights across systems, classify their power and propose an owner for each, flagging standing privileged accounts with no recent use
• What stays human: The System Owner approves every privileged access grant for a task, whether just-in-time elevation or release of a vaulted credential; the Access Request Agent prepares the request, carries out only what the System Owner approved and never decides a grant

Upgrade Credit

Start here and move up later: the full price of this edition counts toward the AI Transformation Blueprint for Cybersecurity if you upgrade within 90 days. Email support@ciopages.com with your order number for a one-time checkout code.

Frequently Asked Questions

What is the difference between the two editions?

The AI-Ready Capability Model covers the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. The AI Transformation Blueprint adds value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.

Can I upgrade from the Capability Model to the Blueprint later?

Yes. The full price you paid for the Capability Model counts toward the Blueprint if you upgrade within 90 days. Email support@ciopages.com with your order number for a one-time checkout code.

What happens after 180 days?

Your license to use the files does not end. Corrections are free for as long as you use the files. New versions released within 180 days of purchase are free: we email you a new download link when one is released. There is no renewal after that: you can buy a new version at 25% off its price.

Can I load the content into our own AI tools?

Yes, within the license. The Enterprise license allows internal tools, including your own assistants and agents. Neither license allows training, fine-tuning or prompting AI systems for third parties.

Does the package cover AI laws and regulations?

No, by design. It is business architecture: capabilities, value streams, data and the AI layer describe what cybersecurity does and how AI fits, and they hold whichever laws apply where you operate. The risk tiers, principles and controls are durable practices your compliance team maps to your own jurisdictions.

Why not just ask ChatGPT or another AI assistant?

An AI assistant can list what a security function does, and as orientation that list is often fine. It will differ each time you ask, and it will suggest where AI could help without saying who approves what or how risky the use is. Security decisions about automation need a record that holds up when someone asks why an agent was allowed to act: stable IDs for 195 L3 capabilities, cross-references checked before release, an AI profile with a target mode and oversight level for every L2 capability, a risk tier for each, and a scoring model you weight yourself. Use an assistant to think aloud, and decide against the model.