Threat Visibility ^*

To what extent does your organisation have visibility into malicious behaviours across users, endpoints, networks, and cloud assets?

No centralised monitoring or logging

Logs collected on select assets; manual review.

SIEM partially deployed; limited rule-based alerts.

Real-time correlation with contextual enrichment (e.g., asset criticality).

Telemetry from IT/OT environments integrated with threat intel feeds.

Advanced XDR with behavioural analytics, UEBA, and continuous tuning.

press Enter ↵

'Oops! something went wrong.',

24x7 Threat Monitoring ^*

How are alerts triaged and escalated after-hours?

Not monitored.

Business hours only.

Basic on-call availability.

Internal 24x7 SOC with Tier 1 monitoring.

Multi-tier SOC (internal or hybrid), covering full shift handoffs.

Fully managed SOC with 24x7 response SLAs and threat prioritisation by business impact.

press Enter ↵

'Oops! something went wrong.',

IR Plan & Playbooks ^*

Do you maintain a formal, tested incident response framework?

No formal plan or ownership.

Basic IR document exists; not widely understood.

IR plan documented, tested annually.

Role-specific playbooks and communication protocols defined.

IR simulations run quarterly, including exec/board engagement.

Automated playbooks executed via SOAR; tied to business continuity and legal obligations.

press Enter ↵

'Oops! something went wrong.',

Breach Containment SLAs ^*

How quickly can you detect and contain a high-severity incident?

No defined SLA or capability.

>24 hours.

8–24 hours.

<4 hours; manually coordinated.

<1 hour using defined escalation workflows.

<30 minutes, with automated containment and forensic readiness.

press Enter ↵

'Oops! something went wrong.',

Coverage Breadth ^*

Which layers of your digital environment are instrumented for telemetry?

Only endpoints.

Endpoints + selective infrastructure logs.

EDR/NDR partially deployed; cloud visibility lacking

Unified logging across hybrid IT + OT environments.

Integrated identity, application, and SaaS telemetry.

Full-stack observability with real-time visibility into shadow IT, encrypted traffic, and external attack surface.

press Enter ↵

'Oops! something went wrong.',

Integration ^*

Are logs and events correlated across domains?

Siloed data

Manual analysis.

Rule-based correlation

SOAR-assisted triage; partial automation.

Contextual risk scoring with automated prioritisation.

Unified data lake or SIEM+XDR ecosystem with threat-informed detection engineering

press Enter ↵

'Oops! something went wrong.',

Proactive Threat Hunting ^*

How often are proactive hunts conducted?

Never

Ad hoc or post-breach.

Quarterly by internal team.

Monthly with IOCs/TTPs from threat feeds.

Continuous threat hunting embedded in MDR or red/purple team engagement.

AI-enhanced hunting aligned with MITRE ATT&CK; business impact analysis integrated.

press Enter ↵

'Oops! something went wrong.',

Control Validation ^*

How are detection controls tested?

Not tested.

Yearly penetration test.

Periodic red teaming or BAS.

Quarterly simulations aligned to threat model.

Ongoing control validation across all vectors (email, endpoint, cloud).

Fully managed Breach & Attack Simulation program with closed-loop detection tuning.

press Enter ↵

'Oops! something went wrong.',

Metrics & Reporting ^*

How is SOC performance tracked and communicated?

No metrics reported.

Alert volumes and mean time to respond (MTTR) tracked.

Reports delivered monthly to IT leadership.

KPIs aligned with compliance and risk thresholds (e.g. ASD E8).

Dashboards reviewed by senior leadership; board-level metrics tracked.

SOC metrics tied to business risk, productivity loss, and customer impact; used in cyber risk quantification models.

press Enter ↵

'Oops! something went wrong.',

Compliance Integration ^*

How integrated is SOC data with compliance reporting?

Manual audit prep.

Spreadsheet-driven compliance tracking.

Audit logs stored, not reviewed.

SOC aligned with ISO/NIST frameworks.

Automated evidence collection for ISO 27001, SOC2, PCI-DSS.

Continuous compliance posture monitoring with GRC dashboards.

press Enter ↵

'Oops! something went wrong.',

Workflow Automation ^*

Are common investigation and response tasks automated?

Fully manual.

Scripts used by analysts.

Basic triage automation (enrichment).

SOAR platform implemented for Tier 1 workflows.

Cross-domain response orchestration (e.g. isolate host + disable account).

Adaptive automation with AI-based decision logic and rollback validation.

press Enter ↵

'Oops! something went wrong.',

Threat Intelligence Usage ^*

How is threat intelligence operationalised?

No threat intel used.

Subscribed to feeds; not integrated.

Indicators manually ingested.

Intel integrated into detection rules.

Strategic, tactical and operational feeds correlated with local telemetry.

Threat intel prioritised by vertical-specific risk and used to inform control tuning.

press Enter ↵

'Oops! something went wrong.',

Complete Your Details For Your Result...

First Name

Last Name

Email

Phone Number

Company

press Enter ↵

'Oops! something went wrong.',

Your Result: Ad Hoc

Your organisation operates with minimal security operations capability, exposing it to prolonged breach dwell time and unquantified cyber risk. There is no meaningful detection, response, or governance process in place.

Priority Actions

· Initiate a baseline cyber risk assessment.

· Deploy foundational 24x7 SOC coverage or Managed Detection and Response (MDR).

· Formalise incident response with playbooks and communication protocols.

Recommended CyberPulse Services

· 24x7 SOC-as-a-Service

· Incident Response Readiness

· vCISO for Strategic Uplift

Download The Full SOC Maturity Report

Your Result: Basic

You have foundational visibility and IR documentation, but detection capabilities are fragmented and reactive. Risk remains elevated due to lack of integration, telemetry, and SLA-driven response.

Priority Actions

· Integrate logs into a unified SIEM or XDR platform.

· Establish measurable response SLAs and conduct tabletop exercises.

· Begin proactive threat hunting and exposure validation.

Recommended CyberPulse Services

· Managed Detection & Response (MDR)

· Incident Response Tabletop and SLA Design

· Breach & Attack Simulation (BAS)

Download The Full SOC Maturity Report

Your Result: Defined

You have structured processes and visibility across key environments, but threat validation, governance integration, and automation are emerging. Risk is moderate and management-driven improvement is possible.

Priority Actions

· Expand telemetry to cloud, identity, and OT environments.

· Automate response to reduce dwell time.

· Integrate SOC metrics with compliance and board reporting.

Recommended CyberPulse Services

· XDR with Threat Hunting

· SOAR and Workflow Automation

· Compliance-aligned Detection Engineering

Download The Full SOC Maturity Report

Your Result: Managed

You maintain a mature, metrics-driven SOC with consistent improvement. Gaps may exist in orchestration, attack surface validation, or alignment to business risk metrics.

Priority Actions

· Implement continuous threat exposure management (CTEM).

· Enhance board reporting with quantitative risk indicators.

· Benchmark controls with Breach & Attack Simulation.

Recommended CyberPulse Services

· CTEM Advisory

· Board-Ready SOC Reporting Pack

· Threat-Informed Red & Purple Teaming

Download The Full SOC Maturity Report

Your Result: Optimised

You maintain a mature, metrics-driven SOC with consistent improvement. Gaps may exist in orchestration, attack surface validation, or alignment to business risk metrics.

Priority Actions

· Implement continuous threat exposure management (CTEM).

· Enhance board reporting with quantitative risk indicators.

· Benchmark controls with Breach & Attack Simulation.

Recommended CyberPulse Services

· CTEM Advisory

· Board-Ready SOC Reporting Pack

· Threat-Informed Red & Purple Teaming

Download The Full SOC Maturity Report

Welcome back! Loading your previous answers...

SOC Maturity Assessment

Your Result: Ad Hoc

Your Result: Basic

Your Result: Defined

Your Result: Managed

Your Result: Optimised