Cybersecurity Capabilities Model

A comprehensive, industry-agnostic capability map for the Cybersecurity function, covering 230+ business capabilities organized across three hierarchical levels. Use it to evaluate functional maturity, plan capability investments, and align technology to business needs.

Why a capability model, not a prompt

Security vocabulary turns over faster than almost any other domain — new acronyms (XDR, SOAR, CTEM, whatever comes next) get marketed as entire capability categories when they're really just the latest packaging of long-standing capabilities like detection, response, and threat intelligence. A generic AI prompt tends to reproduce whichever vendor category is loudest this year, which is the opposite of what a security leader needs when mapping a program to durable, audit-friendly capabilities. This map separates the capability (what your security function must do) from the product category (how you're doing it today), so it doesn't need a rewrite every time the market invents a new three-letter acronym.

What's Inside

• Capability Map — 230+ capabilities across Level 1 (strategic), Level 2 (tactical), and Level 3 (operational), in PowerPoint, Word, and Excel
• Capability Definitions — Clear descriptions at the most granular level for consistent interpretation
• Capability KPIs — Measurable indicators at Level 2 to assess maturity and performance

How Teams Use It

• Baseline current-state maturity and pinpoint capability gaps ahead of a security program review or board update
• Map your control set and tooling to a durable capability structure instead of a shifting vendor taxonomy
• Give security, risk, and technology leaders a shared vocabulary that survives the next product-category rebrand
• Prioritize security investment by capability gap, not by whichever threat made headlines this quarter

Who It's For

CISOs, security architects, enterprise architects, risk and compliance leaders, and technology strategists building or defending a security roadmap.