eBooks/eGuides

14 The accuracy of the model in showing an organization true maturity grows as each CMI is factored in. In other words, accuracy increases as the number of datapoints increase. Here's an example. This one uses two CMIs, specifically the Security Awareness Proficiency (SAPA) Assessment and the Security Culture Survey (SCS). The example is useful in understanding the current distribution of organizations across the model. Each of these on their own would have limited directional accuracy; but when combined, they serve to add precision. This is a prototype result based on real data, presented for illustrative purposes. In future research, more CMIs will be added to these models. Doing so will impact the distribution. Our team is currently working through the statistical modeling and various CMI weightings to provide the best representations possible. In other words, lots of cool stuff is ahead! Here's another illustrative example. Whereas the last example was across several thousand organizations, this one focuses in on a single organization and shows how multiple CMIs provide context. This example shows an organization whose information sharing program is really only focused on doing the minimum. But they also engage in monthly phishing simulations and have been making good progress. Additionally, they sent out an awareness survey that returned its own assessment of their maturity, and they have some security technologies reporting observed behaviors. The dashed red line represents breach likelihood and relative cost remediation The solid blue line represents awareness/culture maturity gains at each stage of the model Source: KnowBe4 Level 1 Basic Compliance Level 2 Security Awareness Foundation Level 3 Programmatic Security Awareness & Behavior Level 4 Security Behavior Management Level 5 Sustainable Security Culture Figure 5: Example of the SCMM showing maturity across organizational scores with KnowBe4's Security Awareness Proficiency Assessment and Security Culture Assessment as CMIs

• Cover