A Security Maturity Assessment is a structured, scored baseline of where your organization actually stands against four operational pillars — physical, personnel, procedural, and cyber-physical. The output is a tier label and a /100 score that gives leadership the same language to talk about security that a finance team uses to talk about payroll. The assessment itself takes about four minutes and is free.
Physical security is everything that an unauthorized person would have to defeat to walk into, move through, or leave a protected space with something they shouldn't have. It covers perimeter integrity, access-control layering, surveillance coverage, alarm systems, guard post placement, and visitor management. The pillar matters because most organizations have physical defenses on paper that the floor reality cannot reproduce — a magnet-locked door that is propped open during shift change, a camera that has been down for nine days, a service corridor that nobody has remapped since the last renovation.
Personnel risk is the exposure that comes from the people who already have legitimate access to your facility, your systems, your data, and your decision-making. It includes the depth of pre-employment vetting, the maturity of insider-threat awareness programs, the rigor of termination procedures, the cadence of behavioral monitoring, and whether security training is treated as a checkbox or as an operating discipline. The pillar matters because the most damaging incidents in the last decade were not committed by outsiders forcing a door — they were committed by people who already had the badge.
Procedural gaps are the difference between what your organization has written down and what would actually happen on the floor at 02:00 on a Sunday with two staff members on shift. This pillar covers policy documentation completeness, incident response playbooks, audit cadence, training regularity, regulatory compliance posture, and operational continuity. The pillar matters because the most common finding across industries is not that procedures are absent — it is that the procedures exist on paper only, were last reviewed three years ago, and the policy written in section 4.2 is not the policy being executed in section 4.3.
Cyber-physical threats are the risks that live at the intersection of your digital and physical exposure — the OT/ICS boundary, the access-control server on the same VLAN as the visitor Wi-Fi, the camera fleet that no one is patching, the badge system whose credentials are recycled against the org SSO. This pillar covers network segmentation between IT and physical-security systems, supply-chain integrity for physical-security hardware, biometric system resilience, and converged attack scenarios where a digital foothold produces a physical outcome. The pillar matters because the convergence is no longer theoretical — it is the operating reality for every organization that has run an internet-connected camera for more than eighteen months.
The deliverable is a score and a tier label — Critical, Emerging, Established, or Resilient — across each of the four pillars, plus an unlocked per-pillar breakdown that gives you the language to act on the finding. The four-minute assessment is free, the breakdown arrives by email, and the score is reproducible: the same inputs produce the same score, so you can re-baseline quarterly and see whether the program is moving.
Fifteen questions. Scored against the four pillars above. Free, with no commitment required to see your result.
Take the Free Assessment — 4 Minutes Or view the full Risk Assessment for engagements starting at $999