AI security maturity: find your stage, then take the next step
The SANS AI Security Maturity Model gives you five stages across three pillars and a scoring method that stops you from overstating where you are. Here it is mapped to MITRE ATLAS and the NIST AI RMF, with a worked score and the next step from each stage.
- Drawn by
- Blue Marshal
- Post
- 2 of 3
- Issued
- Reading time
- 9 min
- Revision
- A
Most organizations can't say how mature their AI security is. They can list the tools they bought and the policy they published, but not whether those add up to a program. A maturity model fixes that, if you score it honestly.
I use the SANS AI Security Maturity Model, published in May 2026 by Chris Cochran of SANS. It's practical, it's free, and its scoring has two rules that stop teams from rating themselves higher than they are. This post explains the model, maps each stage to MITRE ATLAS and the NIST AI Risk Management Framework, works through a score for a fictional company, and lists the next step from each stage.
Three pillars
The model splits AI security into three areas. They come from the SANS Secure AI Blueprint.
| Pillar | The question it answers |
|---|---|
| Protect AI | Are the AI systems we use and build protected against attack, misuse and leakage? |
| Utilize AI | Are we using AI to make our own security work better: detection, triage, hunting? |
| Govern AI | Do we know what AI we have, who owns it, what's allowed, and how risk is decided? |
Most programs are lopsided. Teams that move fast on AI tooling often score well on Utilize and badly on Govern. Teams with strong policy often score well on Govern and have little in Protect. The scoring method below is built to catch both.
Five stages
| Stage | Name | What it looks like |
|---|---|---|
| 1 | Unaware / Ad Hoc | No inventory of AI tools, no AI usage policy, people bring their own AI. Leadership doesn't know the exposure. |
| 2 | Reactive / Policy-Emerging | An acceptable use policy exists, often a blanket yes or no. A partial inventory of sanctioned tools. Vendor AI features run at their defaults. Shadow AI detection starts. |
| 3 | Defined / Risk-Informed | A complete AI asset inventory with owners. Every AI agent has its own identity and a human owner. Defences against prompt injection are deployed. AI risks sit on the enterprise risk register. AI-specific incident response procedures exist. |
| 4 | Managed / Integrated | Security built into the AI development lifecycle. An AI red team. Quantified AI risk reported to the board. AI-driven threat hunting and autonomous response for validated cases. |
| 5 | Optimizing / Adaptive | Self-improving defences, continuous chaos testing of AI systems, agents trusted with first-level remediation, and the organization contributing back to the field. |
Two things SANS says plainly are worth repeating. First, Stage 5 isn't the goal for everyone. The right stage depends on how much AI you run, your industry, your regulators and your risk tolerance. For many organizations with limited AI use, Stage 3 is a strong, defensible place to be. Second, a documented Stage 2 is in a better position than an undocumented claim of Stage 3.
The same stages in ATLAS and NIST terms
Teams already work with MITRE ATLAS for AI threats and the NIST AI RMF for AI risk. I map each maturity stage to both, so a stage means the same thing to the security team, the risk team and the auditors.
| Stage | MITRE ATLAS | NIST AI RMF |
|---|---|---|
| 1 | Not yet applicable. No awareness of AI-specific attacks and no way to detect them. | Not addressed. No GOVERN, MAP, MEASURE or MANAGE activity. |
| 2 | Awareness. The team learns the ATLAS tactics and the main AI threats: prompt injection, AI supply chain compromise, poisoned training data, unverified model sources. | Partial. GOVERN 1.1 to 1.4 (basic policy, legal awareness, initial risk tolerance) and MAP 1.1 (intended use and deployment context). |
| 3 | Controls mapped. Defences mapped to the key tactics: initial access through the AI supply chain, prompt injection and agent tool use, persistence through RAG or context poisoning, exfiltration through inference APIs, and denial of AI service. Basic adversarial testing against them. | Risk-informed. GOVERN in full, MAP 1 to 5, and MEASURE 1.1 to 1.3. Accountability, security and explainability actively worked on. |
| 4 | Full kill chain. Documented controls for every ATLAS tactic, from reconnaissance and resource development through evasion and impact. Red team exercises across the full technique set. | Measured. MEASURE in full, MANAGE 1 to 3, all seven trustworthiness characteristics measured, and a way to switch off an AI system that causes harm (MANAGE 2.4). |
| 5 | Contributing. Detecting new techniques before they're public and contributing techniques and mitigations back to ATLAS. | Adaptive. All four functions in continuous feedback, and engagement with the standards bodies (GOVERN 5). |
The NIST AI RMF names seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. At Stage 3 a program works on some of them on purpose. At Stage 4 it measures all seven.
How to score yourself
The SANS self-assessment asks a set of questions under each pillar. You rate each one from 0 to 5. The method then runs in six steps.
- Pick your industry profile. It sets how much each pillar counts.
- Weight each pillar. Multiply each pillar's average score by its weight.
- Add them up. The sum is your raw overall score, from 0 to 5.
- Apply the two cap rules. They set the highest stage you're allowed to claim.
- Map the raw score to a stage using the bands below.
- Take the lower of step 4 and step 5. That's your stage.
One rule applies before any of this: an answer you can't back with evidence scores 2 at most. Evidence means approved policies, configuration exports, logs or test results. Not a confident answer in a meeting.
Industry profiles
| Profile | Protect | Utilize | Govern |
|---|---|---|---|
| Default | 35% | 30% | 35% |
| Financial services | 40% | 25% | 35% |
| Healthcare | 35% | 25% | 40% |
| Technology / AI-native | 40% | 30% | 30% |
| Government / defence | 30% | 30% | 40% |
| Critical infrastructure | 30% | 35% | 35% |
| Education and research | 30% | 25% | 45% |
In the default profile, Protect and Govern weigh more than Utilize. Advanced AI tooling in the SOC can't make up for an unprotected or ungoverned AI estate.
Raw score to stage
| Raw score | Stage |
|---|---|
| 0.0 to 0.9 | Stage 1, Unaware |
| 1.0 to 1.4 | Stage 2, Reactive (emerging) |
| 1.5 to 1.9 | Stage 2, Reactive (established) |
| 2.0 to 2.4 | Stage 3, Defined (emerging) |
| 2.5 to 2.9 | Stage 3, Defined (established) |
| 3.0 to 3.4 | Stage 4, Managed (emerging) |
| 3.5 to 3.9 | Stage 4, Managed (established) |
| 4.0 to 4.4 | Stage 5, Optimizing (emerging) |
| 4.5 to 5.0 | Stage 5, Optimizing (established) |
The two cap rules
- Governance floor. Your overall stage can't be more than one stage above your Govern pillar.
- Minimum pillar. Your overall stage can't be more than one stage above your weakest pillar.
These two rules are the most useful part of the model. They stop a strong pillar from hiding a weak one. When I run the check, I read each pillar's average the same way as the questions: a pillar averaging 2.6 is at Stage 2.
A worked score: Northbridge Corp
Northbridge Corp is a fictional mid-size company. It uses the default profile. Here are two versions of it.
Version A: balanced
| Pillar | Average score | Weight | Weighted |
|---|---|---|---|
| Protect | 3.2 | 35% | 1.12 |
| Utilize | 2.8 | 30% | 0.84 |
| Govern | 2.6 | 35% | 0.91 |
| Raw overall | 2.87 |
A raw score of 2.87 maps to Stage 3, established. Govern is at Stage 2, so the governance floor allows up to Stage 3. The weakest pillars are also at Stage 2, so the minimum pillar rule allows up to Stage 3. The lower of 3 and 3 is 3. Northbridge A is at Stage 3.
Version B: strong tools, weak governance
| Pillar | Average score | Weight | Weighted |
|---|---|---|---|
| Protect | 3.8 | 35% | 1.33 |
| Utilize | 4.2 | 30% | 1.26 |
| Govern | 1.4 | 35% | 0.49 |
| Raw overall | 3.08 |
On the raw score alone, Northbridge B looks like Stage 4. It has good AI defences and its SOC uses AI well. But Govern is at Stage 1, so the governance floor caps it at Stage 2, and the minimum pillar rule says the same. Northbridge B is at Stage 2.
Version B is the one I see described most often in the industry: a capable security team, real tooling, and nobody who owns the AI inventory or decides what's allowed. The model doesn't let the tooling hide that. Its next step isn't another tool. It's governance.
The next step from each stage
Pick the row for your current stage. Do the prerequisite first, then the steps.
| From | To | Steps | Prerequisite |
|---|---|---|---|
| 1 | 2 | Run a survey of the AI people already use. Name one owner for AI governance. Draft an AI acceptable use policy. Inventory the AI tools you can find. Put basic allow and block lists in place. | Basic data classification |
| 2 | 3 | Form a cross-functional AI governance group. Run technical discovery of shadow AI, not just a survey. Write a full AI policy framework. Add AI-aware data loss prevention. Offer sanctioned tools through an enterprise AI gateway. Put AI risks on the enterprise risk register. | A governance body exists and the security team has baseline AI training |
| 3 | 4 | Quantify AI risk. Start an AI red team. Build an AI security metrics dashboard. Put AI security into the build pipeline. Monitor AI systems continuously. | Risk quantification adopted, red team started, board-level reporting |
| 4 | 5 | Build autonomous AI security capabilities, run continuous chaos testing on AI systems, start a research program, and extend zero trust to autonomous agents. | An active research program and validated autonomous response |
SANS expects the move from Stage 1 to Stage 2 to take about one quarter, and Stage 2 to Stage 3 to take longer, because that's where policy has to turn into practice.
Traps to avoid
- Scoring what you plan, not what you have. The evidence rule exists for a reason. If you can't show it, it's a 2 at most.
- Calling rules "AI". Rules-based analytics labelled as AI in a vendor's product don't count as utilizing AI. Check whether there's machine learning behind it.
- Treating Stage 2 as the finish line. SANS calls a blanket-ban policy the "Framework of No". It blocks the obvious tools and pushes the rest into shadow use. The move to Stage 3 replaces bans with risk-based decisions.
- Skipping the agent questions. From Stage 3, every AI agent needs its own identity with scoped access and a named human owner. Agents running on a shared service account are a Stage 2 finding, whatever else is in place.
- Chasing Stage 5. Pick a target stage that fits your AI use and your regulators, then hold it.
Where to start on Monday
- Read the SANS model and pick the industry profile that fits.
- Score each pillar with your team, and write down the evidence for every answer above 2.
- Apply the two cap rules before you share a number with anyone.
- Take the next-step row for your stage and turn it into owners and dates.
- If your inventory step stalls, use the AI Visibility Map to find out which tools can actually see your AI. It's the next post.
Sources and credits
- SANS AI Security Maturity Model, Chris Cochran, SANS Institute, May 2026. The pillars, stages, self-assessment, profile weights, score bands and cap rules are from this model. Read it for the full self-assessment questions.
- MITRE ATLAS, The MITRE Corporation.
- NIST AI 100-1, AI Risk Management Framework 1.0, National Institute of Standards and Technology, January 2023.
- SANS developed the model with the OWASP AI Exchange and the OWASP agentic security work from the OWASP GenAI Security Project, and maps it to the NIST AI RMF, the EU AI Act, ISO/IEC 42001 and the CSA AI Controls Matrix.
- The stage-by-stage mapping to ATLAS and the NIST AI RMF is my own. Northbridge Corp is fictional.