Scorecard · Security
Benchmark your security program in 3 minutes across 7 dimensions — MFA, endpoint, email, network, identity, logging, incident response — and get the 90-day hit list.
Security maturity isn't a score on a glossy report — it's whether you'd survive a real incident. This scorecard maps to NIST CSF + CIS Controls at a practical level, without the consultant bingo.
Out of 28. 22+ is mature, 15-21 is passable, below 15 is at elevated risk for common ransomware and business email compromise paths.
In real incident response, three controls catch most of what gets through: phishing-resistant MFA on identity (blocks the initial token theft), EDR with isolation (blocks the second-stage), and logging/SIEM (lets you see the movement). Segmentation determines whether an initial compromise becomes a catastrophe. Email gateways and DMARC block the most common delivery. IR plan determines your Monday-morning cost.
Only large enterprises hit it sustainably. Most mid-markets live at 18-22 with targeted gaps.
It's a subset of what auditors look for. Use ISO or SOC2 readiness as the formal exercise; use this for quick leadership alignment.
Score 20/28. Priorities: enforce DMARC, add logging/SIEM (Sentinel), document IR plan with tabletop.
Score 13/28 pre, 22/28 six months in. Biggest lifts: MFA on all apps, EDR rolled out, SIEM with UEBA use cases.