Zero Trust Maturity:
a security score you cannot argue with

In my previous blog post I wrote that measuring security is hard, but measuring Zero Trust isn’t. That post was about two dimensions which together form a quadrant, and about one thing above all: if you want to do Zero Trust well, the business and the operation have to be aligned. Strategic and operational, pointing the same way. Without that, the rest does not happen.

This post is about the other axis. Once Zero Trust is operationalized, how do you measure it? That is what we call Zero Trust fitness, and the Zero Trust fitness score tells you, at any moment of any day, where you stand.

We did not want to invent a new maturity model

The last thing this industry needs is another vendor with its own five-level model. So we did not build one. We took CMMI, which has been around for decades and is widely understood well beyond security, and used it as the basis.

CMMI has five levels. You cannot go below 1 and you cannot go above 5. Every organization starts at level 1. An organization that has done nothing at all is at 1, not at 0.

The work was in deciding what each level should mean for Zero Trust. We did that by discussing it with customers, arguing about it internally, reading what others had published and building on the work John Kindervag had already done in this space.

This is roughly what each level holds:

Which level should you aim for?

Not necessarily level 5. The right level depends on your ambition, your risk appetite and the industry you are in. If you find yourself pushing every Protect Surface toward 5, that usually means you have not decided what matters most.

Why the score has to be deterministic

If you want to measure something and especially if you want to know whether you are making progress or declining, the score has to be trustworthy. By that I mean deterministic: the same data has to produce the same score, every time.

So for every maturity level we wrote down criteria that can only come out true or false. Boolean. Either you meet it or you don’t.

That sounds obvious, but it rules out the two things that quietly ruin most security scores.

What you get back is a number anyone can reproduce. Hand the same snapshot to our platform or to someone with a spreadsheet and a few minutes, and you get the same answer.

How the number is built

The score is a level plus a decimal, and the decimal is what makes it useful month to month instead of in five enormous jumps.

The whole number is the level you are currently completing, not the one you finished. The decimal is the share of that level’s own criteria that currently pass.

The score always stays between 1.0 and 5.0. Once every level 5 criterion passes as well, it tops out at 5.0.

The other thing we built in is that the levels are cumulative. A lot of what Zero Trust asks for at the start is basic and has to be in place before anything above it means much. So a level only counts once that level and every level below it are complete.

That has a consequence worth being explicit about. If everything is green up to level 3 but one level 1 criterion is failing, you are not at 3. You are back at level 1, because the foundation the higher levels were resting on is not there anymore. Not 2.9. Level 1.

There is one criterion that behaves as a hard gate. The readiness assessment has to be current, and that is one of level 3’s own criteria. Let it go stale and level 3 can never complete, which blocks level 4 and level 5 as well, no matter how good your operations look.

That is not an accident. It is the message of the first blog post, wired into the scoring. We are not just advising that alignment matters. The model refuses to award maturity to an organization that stopped checking whether its business is still behind this.

Most Zero Trust programs don’t fail on technology. They fail on alignment.

Binary criteria have one more advantage that matters a lot once this lands on a CISO’s desk: the gaps name themselves. A report never just says 3.5. It says 3.5, and level 3 is being held open by two criteria: not enough Protect Surfaces fully implemented and not enough transaction flows mapped. That is not a score to discuss, it is next quarter’s plan.

What we measure

Every criterion has to be measurable from real data or from a documented assessment. If we cannot measure it, it does not become a criterion. These are the components:

One number that is not static: the scoping target

Almost everything above is measured statically. The scoping target is the exception, and it is the denominator for all the coverage percentages: the number of Protect Surfaces you expect to end up with.

It is a moving target on purpose. The more you work in your environment the more you learn about it, and the more Protect Surfaces emerge that nobody had thought of. Early on this number is close to a guess, and we can help you with it because we have seen a lot of environments across a lot of industries. The further you get, the more precise it becomes.

The important part is not that the number is right on day one. It is that a number exists, because without it there is nothing to divide by and no coverage percentage to report.

A score that cannot fall is not a score worth having

Most maturity scores are a ratchet. You get certified once and you are that level forever. That is a marketing number, not a measurement.

Ours goes down and it should. If you stop maintaining step 5, your Zero Trust decays. You implemented a handful of Protect Surfaces and attached the business owners to them, then those owners leave the company. The data is no longer valid and something needs to be done about it. Your score drops and tells you so.

That is also what makes the trend line worth looking at. Because the scoring is deterministic, every snapshot is comparable with every other one.

This is a fictional organization, but every shape in that line is one we see in real environments.

The first five months are the climb, from 1.3 to 2.6. Onboarding, the first Protect Surfaces, metadata, controls. Early progress is fast because the first criteria are the most basic ones.

Then it goes flat for two months. Nothing went backwards, but nothing went forward either. The transaction flows were not being mapped, and until they are, level 2 cannot complete. A flat line is a finding in its own right and without history you would never see it.

In August the organization reached 3.5. In September a reorganization took several business owners out of the company, metadata completeness dropped below the level 2 threshold, and the score fell back to 2.8. All the level 3 work was still there. It just could not be credited while the foundation underneath it was broken. Owners were reassigned and the next snapshot was back at 3.5. Same data, same score.

The dashed line is level 3, the minimum for anyone serious about this. This organization crossed it in July, fell below it in September and is back above it today. That is a story you can tell a board in one slide. It is not a graph of how we felt that quarter. It is a graph of what was actually there.

And once that line starts moving, it tends to keep moving. People can see their work landing, which makes the next Protect Surface easier to get through than the last one.

Conclusion

And you still need both angles. The fitness score tells you how mature your Zero Trust actually is. The readiness assessment tells you whether the business is behind it. The first post covered that one separately on purpose, because that is where we see most organizations fail.

---

Related reading

• Measuring security is hard. Measuring Zero Trust isn’t.
• Zero Trust isn’t hard
• Navigating Zero Trust, part 1
• The crucial role of business alignment in Zero Trust
• You don’t need additional AI security tooling

FAQ