Cybersecurity Capability Matrix: AI-Ready Edition

The Cybersecurity Capability Matrix describes security work in 9 Level 1 areas, 39 Level 2 capabilities and 195 Level 3 capabilities, each defined, with identity and access management as one of the areas. Security architecture teams at banks, insurers, asset and wealth managers and payments firms use it to set out what the function does in terms a board and a budget committee can follow. Each Level 2 capability has an AI profile stating where AI can take on work, how closely a person oversees it and how risky the use is. A scoring model ranks the 39 on your weights. The content is cross-industry.

What it is

Inside the Cybersecurity Capability Matrix

Security work is named here by its purpose, so a capability keeps its name when the product behind it is replaced. Detection, response, access and the rest of the function share one hierarchy, defined down to Level 3, with 161 KPIs at Level 2.

Privileged access management is CY-4.4 in every release. A security team can carry that ID into its risk register, its tool inventory and its project list, and a search across all three returns the same capability.

Every Level 2 capability has a profile listing the AI opportunity, the decisions a person keeps, the agents and data involved, prerequisites, risks and the effect on roles, with a target AI mode, an oversight level and a risk tier. Every Level 3 is rated for work pattern, mode, AI fit and risk tier. In the sample, CY-4.4 scores 4 for AI fit and 5 for value but 2 for data readiness, and it is rated High risk with a person in the loop. An agent may find accounts with elevated rights and propose an owner for each. The System Owner approves every grant.

The Problem Behind It

Boards of financial firms ask their security leaders what the function covers and where the money goes. A list of teams and tools answers poorly. One tool can serve several capabilities, and some capabilities have no tool and no owner.

AI widens that gap. Detection products, ticketing systems and identity tools now include AI features, some of them enabled in a routine update, and each one can act on accounts, devices or alerts. The matrix lets security leadership decide per capability how far an agent may go without a person, and then hold every tool serving that capability to the same answer.

The deliverables

What the Download Contains

The matrix comes with its AI ratings and the files to rank and present them:

The model

• 9 L1, 39 L2 and 195 L3 cybersecurity capabilities, defined through L3, with 161 KPIs set at L2

AI and governance

• For each L2 capability, an AI profile covering opportunities, what stays human, agents, data, KPIs, AI measures, prerequisites, risks and workforce impact
• L3 capabilities rated for work pattern, target AI mode, AI fit and risk tier
• Risk-adjusted scoring and ranking of each L2 capability, driven by your own ratings and weights
• An AI heatmap across the entire model
• A weighted AI readiness assessment with 40 questions

Files and terms

• To begin, a Welcome document; then the capability map deck, standalone capability definitions and KPIs documents, the Excel workbook, the user guide
• Bonus files included: a cybersecurity glossary, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template and capability relationship mapping templates
• Corrections free of charge, and new versions free for 180 days after purchase

Your organization's name and license ID are printed in every file. Ratings reflect a typical large enterprise; treat them as a first draft of your own.

Who It Is For

Chief information security officer. Reports the function to the board by capability and uses the ranking to choose where AI goes first.

Security architects. Map products and designs to capability IDs and check new proposals against the oversight levels.

Identity and access management lead. Uses the profiles for access capabilities to fix which grants and reviews stay with a named person.

Security operations lead. Compares AI features in detection and response products against the target mode for each capability.

Technology risk partners. Use the risk tiers as the baseline for reviewing AI in security work and track the KPIs the matrix assigns.

Putting it to work

Use Cases

Reporting coverage to the board. Present the function as its 39 Level 2 capabilities with their KPIs and owners. Gaps and overlaps are visible on one page, and each investment request points at a capability ID.

Deciding which AI features to enable. When a security product offers a new AI feature, look up the capability it serves and read its target AI mode and oversight level. Switch the feature on only to the degree the profile and your own review allow.

Mapping the security tool estate. Place each security product against the Level 3 capabilities it supports. Several products on one capability point to consolidation, and a capability with none points to a gap.

Ranking security AI proposals. Score the Level 2 capabilities with your own ratings and weights. The heatmap shows where AI fit and value are high and the risk tier is acceptable.

Testing readiness before the first agents. Run the 40-question assessment with security operations, identity and technology risk. Low answers on data or skills show what to fix before an agent acts on the estate.

Scoping a managed security service. List the Level 3 capabilities a provider will run and those the firm keeps. The split shows which KPIs belong in the contract and which decisions stay in-house.

The economics

The Alternatives

Security teams usually get a capability model in one of three ways, and each puts the effort in a different place.

• Building it from a blank slate. Architects collect the work of each security team, write definitions, settle overlaps between identity, operations and engineering, and take drafts through review. Rating every capability for AI and building a ranking come afterward, often as a second project.
• Hiring consultants to build it. A consulting team brings a method and can move fast, but its first weeks go to drafting the structure every security function shares. The model then has to be kept current by your own people.
• Starting from this model. The structure, KPIs, AI profiles, ratings, scoring model and assessment arrive cross-checked. Your workshops change ratings and remove what does not apply, and the first ranked list follows quickly.

Fitting the ratings to your estate and your appetite for risk is the judgment that needs experienced people, internal or external. The ratings in the files describe a typical large enterprise.

Getting Started

These steps take a security team from the files to an agreed first list:

1. Read the Welcome document and the user guide.
2. Walk the capability map deck with the security leadership team and mark what to rename, merge or drop.
3. Adjust the AI ratings for your estate and set your weights in the Excel workbook.
4. Run the readiness assessment with operations, identity and technology risk.
5. Turn the top-ranked capabilities into proposals that name an owner, the oversight level and the KPIs to watch.

Public sample

A Sample Profile

The sample is 0.76% of the package and traces one thread through it: privileged access management. The fields below come from the Privileged Access Management (CY-4.4) AI profile:

• AI mode: Augment
• Oversight level: Human-in-the-loop
• Risk rating: High
• Wave: Wave 2
• Fit, value, feasibility and data readiness scores: 4, 5, 3, 2 on a 1–5 scale
• Patterns of work: Coordination & orchestration, Analysis & insight, Rules-based decision
• What AI could do: Find accounts with elevated rights across systems, classify their power and propose an owner for each, flagging standing privileged accounts with no recent use
• What people decide: The System Owner approves every privileged access grant for a task, whether just-in-time elevation or release of a vaulted credential; the Access Request Agent prepares the request, carries out only what the System Owner approved and never decides a grant

Upgrading Later

Buy this edition now and, if you upgrade to the Cybersecurity Business Architecture Package: AI Transformation Blueprint within 90 days, its full price counts against the upgrade. Email your order number to support@finantrix.com for a one-time checkout code.

Read before you buy

Common Questions

Which edition fits my team?

Choose the AI-Ready Capability Model for the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. Choose the AI Transformation Blueprint for all of that plus value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.

Can our internal AI tools use the content?

Yes, inside your organization. The Enterprise license covers internal tools, including assistants and agents you run yourselves. No license permits using the content to train, fine-tune or prompt AI systems on behalf of third parties.

Does it address AI laws and regulations?

No. The content is business architecture by intent: capabilities, value streams, data and the AI layer describe what cybersecurity does and where AI fits, which holds under whatever laws apply to you. The risk tiers, principles and controls are lasting practices for your compliance team to map to the jurisdictions you operate in.

What happens when the 180 days end?

The license continues with no end date, and corrections stay free for as long as you use the files. New versions released within 180 days of purchase are free, and we email a download link for each. After that nothing renews, and new versions are offered at 25% off.

Can I move from the Capability Model to the full blueprint?

Yes. If you upgrade within 90 days, the full price paid for the Capability Model is credited. Email your order number to support@finantrix.com for a one-time checkout code.

Could an AI assistant write this instead?

An AI assistant can list what a security function does, and for orientation the list is fine. It will differ on the next run, and it will suggest where AI helps without saying who approves an agent's actions or how risky each use is. A decision to let an agent touch accounts or devices has to hold up when audit asks why it was allowed. The matrix gives you stable IDs for 195 Level 3 capabilities, cross-references validated before release, a target AI mode, oversight level and risk tier for every Level 2 capability, and a scoring model weighted by you.