Program Theory Maturity Model

A vulnerability program maturity ladder rated by evidence

October 14, 2026·9 min read·Chris Boker
A vertical ladder with five rungs, the lowest three rungs filled solid mint green and carrying pale evidence seals, a scanner wave on rung one, a stack of three exposure chips on rung two, a clock face next to two SLA fill bars on rung three, the fourth rung is a dashed gold outline containing a gold magnifier with a check tick and two dashed empty slots to its right, the top rung is a plain ink outline containing a dark control loop arrow and a small dashed circle, left-side rung counter dots show one through five across the rungs, right side holds a tall watermark gauge with its lowest three cells filled mint and bold ink chevrons marking the top of the third cell as the honest rating, and a gold dashed watermark line crosses from rung three straight to a gold flag at the frame edge

Most vulnerability programs would score well on any maturity chart they picked up. They have a scanner, a ticketing integration, a quarterly review cadence, a severity-based SLA, maybe a bug-bounty page and an SBOM pipeline. By the activity-adoption rubrics every big consultancy publishes, that is a mid-rung program. By what the organisation can actually prove about its exposure, the same programs cannot answer four basic questions during a KEV event (do we have this, where is it, who owns it, did the fix work).

The 2026 Verizon DBIR, drawn from roughly 13,000 organisations, shows the gap plainly. Only 26 percent of surveyed organisations had fully remediated the CISA KEV entries that applied to them, down from 38 percent the year before, and median time to full remediation rose from 32 days to 43 (Help Net Security's DBIR 2026 summary). Vulnerability exploitation is now the known initial access vector in 31 percent of breaches, up from 20 percent. The Edgescan 2026 Vulnerability Statistics Report puts average MTTR on high and critical application and API findings at 54.81 days. The SANS 2026 State of Detection Engineering survey of 307 practitioners found only 18 percent of teams say they keep pace with the threat landscape. All of those organisations own vulnerability-management tools.

Why owning tools is rung zero

Every one of those organisations would mark "in place" on every control a traditional maturity model asks after, and most would score mid-ladder on it. The shelf of security maturity models shares the same unit of measure. CMMI predates the whole category and gave us the five-level grammar. SANS and CIS both publish a vulnerability management maturity model aimed at operational programs. Gartner's CTEM phase model implies a ladder in operational maturity. On the software side, OWASP SAMM and BSIMM are the mature examples. Each model does good work. Every one of them scores the same input, whether a practice is adopted.

A program can hit every green check on a SAMM radar and still fail the question that matters, whether the environment it defends shows measurably reduced exposure. The chart answers "yes, we scan quarterly" and the environment answers "we still ran a 2024 Fortinet CVE on the perimeter yesterday." Both answers are true, and in most places both are routine. Activity adoption is rung zero of the ladder we want.

A federal maturity model that already made the right call

The private sector has been slow to admit this, and a federal maturity model issued five months ago already has. On May 22, 2026, OMB issued memorandum M-26-14, which rescinded the long-standing logging mandate M-21-31 and replaced its prescriptive catalog with a logging maturity model built on five elements and five levels (Tenable's analysis of M-26-14). What makes it the right shape is that the levels are gated on measured asset coverage, not on claimed capability. To reach level 1 an agency has to demonstrate 70 percent IT, OT, and IoT coverage, level 2 is 80 percent, level 3 is 90 percent, and level 4 is 95 percent. OMB is not asking whether the agency owns a discovery tool. It is asking what percentage of the fleet that discovery tool actually sees today, and the evidence file is the inventory itself.

That is the shift private-sector vulnerability program maturity models have not yet taken. The ladder we want for a vulnerability program should look the same way, graded on what the program can produce evidence for right now, with each rung gated by a specific demonstrable claim rather than by whether an activity has been written up in a policy document.

Five rungs, each with an evidence test

The ladder has five rungs. Each rung is a sentence a program must be able to prove, and each carries an evidence test a skeptic could run in an afternoon with read-only access.

Rung 1. We scan.

The claim a program must prove reads, "Our scan coverage is X percent of a known denominator, and here is the denominator." The evidence test is to show the asset inventory, show the scanner's current reach, and compute the ratio. A coverage percentage without a named denominator does not clear rung 1, because no reviewer can falsify the number.

Rung 2. We prioritise with context.

The claim is, "Every finding carries an exposure band derived from reachability, KEV status, and asset criticality, and the band is traceable to its inputs." The evidence test is to pick a random ticket and walk the exposure band back to the data that produced it. If the ticket carries a severity lifted straight off the scanner row, the program is below rung 2 whatever the dashboard says.

Rung 3. We remediate on commitment.

The claim is, "Each exposure band has a published SLA, and MTTR is measured per band, not blended." The evidence test is to ask for last quarter's MTTR split by exposure band. If the number comes back as a single blended average, the program is one rung below where it thinks it is.

Rung 4. We validate.

The claim is, "Closed findings are rescanned, and controls meant to compensate are proven by test." The evidence test is to pull five findings closed last month at random. For each, the program should produce the rescan artifact or the control-validation record. If any closed because the ticket moved to done, rung 4 is incomplete. "Closed" is a workflow state, not an exposure fact, and the evidence architecture piece details the shape of the artifacts rung 4 produces.

Rung 5. We operate a loop.

The claim is, "Loop latency, the time from signal to proven state change, is measured and trending down." The evidence test is to show the control-loop telemetry (sensor, actuator, state transition) for last quarter, with latency broken out by exposure band. The vulnerability management control loop post describes the sensor-and-actuator view this measurement comes from. A program that cannot produce the latency distribution is still at rung 4.

How a program fakes a rung

The failure modes are stable across every engagement, and four show up more than the others.

  • The coverage report lists a percentage with no named denominator. Rung 1 is incomplete, and the dashboard has been giving leadership a figure nobody can verify.
  • The dashboard uses the word "prioritised" while every ticket carries the raw CVSS score the scanner emitted. Rung 2 is a label, not an evidenced claim.
  • Closed means the ticket is closed. The host was never rescanned. Rung 4 is unevidenced.
  • Loop latency is reported as "mean age at close," which blends several different latencies and hides the one that governs exposure. Rung 5 is unevidenced.

If a program's dashboard reports rung 4 and its evidence file reports rung 1, the program is at rung 1. That is the harder, honest grade, and it is the one Monday's operating decisions should run on.

Rate the program by its lowest evidence, not the average

M-26-14's quiet contribution is that it does not let one strong element rescue four weak ones. An agency at level 3 on collection coverage and level 1 on inventory visibility is a level 1 agency, full stop. The temptation in private-sector maturity models is to average, so a program with four rungs at level 3 and one at level 1 calls itself a 2.6 and rounds up. The 2.6 is a number nobody can act on. Rate the program by the rung it can fully evidence, and the operating decisions that follow fit the actual environment rather than the chart.

The rating also protects the roadmap. A program told it is a 2.6 funds four follow-on investments, one per element it already does well. A program told it is rung 1 with a dashboard that lies funds one, which is the asset inventory, and defers the rest. The second roadmap is cheaper and finishes sooner.

A five-sentence self-assessment

Walk the five claim sentences on your own program this week. For each, write down the specific artifact a skeptic could request to verify it. Put a check next to the claims where that artifact exists today, unaltered, in a location you could point to without preparing a slide. The lowest unchecked rung is the program's current rating. Make that rung the quarter's target, not the next rung above it. One rung advanced beats five rungs claimed.

If the honest answer is embarrassing, start at rung 1. A trustworthy coverage report is the foundation for everything above it. The faster path to rung 3 is rarely a fourth scanner, which only adds to the deduplication problem rung 1 already has. It is a clean asset denominator and a published SLA by exposure band.

CVEasy AI is the local-first CTEM platform we built around a ladder shaped like this one, with TRIS driving the exposure banding at rung 2 and BASzy's validation runs feeding the evidence file at rung 4. Loop latency is a first-class metric on the console, so rung 5 reports a number rather than an assertion.