Cybersecurity Capabilities Model

A Security Function Described by What It Does, Not What It Bought

The Cybersecurity Capabilities Model is a three-level decomposition of roughly 230 security capabilities — with definitions at Level 3 and KPIs at Level 2 — delivered as a core archive of editable PowerPoint, Excel, and Word files plus a bonus archive of eight business architecture deliverables.

Ask a security team what it does and the answer usually arrives as a tool inventory. Identity runs on this, detection on that, vulnerability management on the other. It is an accurate description of spend and a poor description of the function.

The gap shows up in the conversations that matter most. A board question about coverage, a due diligence questionnaire, a budget review, an incident post-mortem asking why nobody owned a particular control — none of those can be answered from a tool list, because the unit of the question is a capability and the unit of the answer is a product license.

A capability model closes that gap. It states what the function does — identity governance, threat detection, vulnerability management, incident response, third-party risk, the rest — decomposed far enough to be assigned and scored, and independent of which vendor currently provides it.

This model is that description, decomposed and defined, ready to customize.

What a Capability Model Is Actually For

A capability model earns its keep in specific, recurring situations. These are the ones security functions hit most often.

Answering coverage questions honestly. "Are we covered for X?" is answerable against a capability model and guesswork against a tool inventory. The uncomfortable cases — where a capability is technically owned by a team that has no time for it — become visible rather than assumed.

Rationalizing overlapping tooling. Security estates accumulate tools that overlap in ways nobody planned. Mapping products to capabilities is what turns a renewal conversation from a price negotiation into a coverage decision.

Separating what you do from what you outsource. Managed detection, outsourced SOC arrangements, and vendor-provided controls all move execution without moving accountability. A capability-level split is what makes that boundary explicit before an incident tests it.

Why a Stable Model Matters More Right Now

Security functions are absorbing AI in two directions at once — as a tool inside their own operations, and as a new attack surface everyone else in the business is deploying.

AI Is a Capability Question Twice Over

Applying models to triage and detection changes how existing capabilities are performed. Securing the organization's own AI deployments is closer to a new set of capabilities. Conflating the two produces roadmaps that address neither, and a granular model keeps them apart.

Operational Resilience Expectations Keep Rising

Financial services supervisors increasingly ask firms to demonstrate — not assert — that critical services can withstand disruption. That demonstration is far easier from a capability model with owners and measures attached than from an architecture diagram.

Third-Party Risk Is Where Most Estates Are Thinnest

Supplier and fourth-party exposure tends to be modeled least and asked about most. Decomposing it into distinct capabilities is what stops it being a single box everyone assumes someone else is holding.

KPIs Make Maturity Assessable

Indicators at Level 2 — time to detect, time to remediate, control coverage — turn a current-state assessment into a baseline with numbers attached.

What Is Included

Two archives — the core model files and a bonus set of business architecture deliverables. Everything is editable and populated with real content:

Who This Is Built For

This is a cross-sector functional model rather than a financial services one. The structure holds across industries; firms in regulated sectors should expect to extend it against their own supervisory expectations.

How to Put It to Work

• Score current-state maturity and identify capability gaps.
• Map tools and providers to capabilities to expose overlap and blind spots.
• Assign an owner to every capability, and find the ones nobody owns.
• Use capabilities as the shared language between security, technology, and risk.

Where Functions Typically Start

What You Are Actually Buying Is Time

Building a capability model from scratch is not intellectually hard. It is long — many hours of decomposition and definition, most of it spent rediscovering structure common to every security function.

• You edit rather than originate. The generic structure is done; your effort goes to what is specific to your estate.
• Reviewers get something to react to. Critiquing a draft model is a far faster conversation than facilitating one from an empty whiteboard.
• It works as a cross-reference. If you already have a partial map, this is a gap-finder rather than a replacement.

Those first two columns describe what comparable efforts tend to involve, not a quoted benchmark — your figures will depend on scope and who does the work.

Built From Real Engagements

We are software entrepreneurs and business consultants who have delivered business architecture and transformation work across financial services firms. This model is the distilled, reusable output of that work rather than a theoretical exercise — which is also why it carries the opinions and gaps described below.

An Honest Note on Fit

This is a generic model designed as a starting point. Customization to your organization's context is expected, not a sign that something went wrong.

One thing to be clear about before buying: this is a business capability model of the security function. It is not a control framework, and the distinction matters more here than in any other product we publish.

Specifically:

Terms You Should Know Before Purchasing

Read the description above in full before you buy. Delivery is immediate and the files are yours to keep, which is also why we cannot take returns, issue refunds, or swap a purchase for a different product once it has been downloaded. What you receive is what is listed — no warranty beyond that, and no bundled customization, implementation help, or support. A Enterprise License covers everyone inside one organization; if you intend to reuse the material across several clients, the Consultancy License is the one you need. The full digital product terms govern the sale.