ES0.9 The Endpoint Security Maturity Model

Level assessment criteria

The maturity model is only useful if the assessment criteria are specific enough to produce an unambiguous level assignment. Each level has binary criteria — you either meet them or you do not.

Level 1 (Ad Hoc): You have an EDR product deployed on most devices. AV is running with default settings. Security controls are not systematically configured. Detection depends entirely on the vendor’s built-in alerting. No custom detection rules. No documented policies for endpoint security. Incident response for endpoint-related incidents is ad hoc — different analysts handle similar incidents differently. This is where approximately 70% of M365 E5 organisations operate.

Level 2 (Baseline): MDE onboarded on 100% of managed devices with validated sensor health. AV cloud protection at High+ with Block at First Sight enabled. At least the “safe set” ASR rules in block mode (LSASS protection, vulnerable driver blocking, USB untrusted process blocking). LAPS deployed across the fleet. Compliance policies enforcing conditional access for at least standard users. Device health monitoring dashboard operational. This level provides measurable prevention improvement over default configuration.

Level 3 (Managed): Most applicable ASR rules in block or warn mode with documented exclusions. At least 10 custom detection rules with documented TP rates above 30%. AIR configured with deliberate automation levels per alert type (not all at default). Monthly hunting cadence with documented hunts. Sysmon deployed on all endpoints. Advanced audit policies and PowerShell ScriptBlock logging configured. Exclusion register maintained with quarterly review. This level provides both prevention AND detection capability.

Level 4 (Optimized): 20+ custom detection rules covering the major ATT&CK tactics relevant to your threat model. Weekly hunting cadence with hunt-to-detection pipeline operational. Cross-platform coverage (servers and Linux in MDE). Sentinel integration with cross-workload detection rules. Automation playbooks for high-confidence automated response. Vulnerability management operationalized with remediation tracking. CIS hardening baselines applied. This level represents a complete, integrated endpoint security architecture.

Level 5 (Adaptive): Threat intelligence drives detection priorities. Red team or purple team exercises validate the endpoint security stack regularly. Evasion-aware detections that anticipate and account for attacker bypass techniques. Continuous validation using Atomic Red Team or similar testing frameworks. Governance framework with documented policies, exception management, change management, and compliance mapping. Detection lifecycle management (versioning, review, retirement). This level represents continuous improvement driven by the evolving threat landscape.

Scoring each layer: what the levels mean in practice

The maturity model is not a binary pass/fail — each layer is scored independently, and the scores reveal where investment provides the most improvement.

Onboarding at “Baseline” (score 2/5): MDE is deployed to most endpoints but not all. Some servers are missing. Linux has no coverage. Device health is checked manually. Moving to “Managed” requires: 100% onboarding across all device types, automated health monitoring with alerting, and device groups configured for differentiated policy application. The effort: moderate (ES2 covers this in 2-3 weeks).

ASR at “Ad hoc” (score 1/5): No ASR rules are in block mode. Some may be in audit mode from a previous attempt that was abandoned. No ASR monitoring exists. Moving to “Baseline” requires: at least 5 safe ASR rules in block mode with documented exclusions. Moving to “Managed” requires: 12+ rules in block mode, audit data analysis cadence, exclusion register. The effort: significant (ES4 covers this over 3-5 weeks because audit data collection takes time).

Detection at “Ad hoc” (score 1/5): Zero custom detection rules. Complete dependence on MDE’s built-in detections. No hunting activity. Moving to “Managed” requires: 15+ custom detection rules with documented TP rates, weekly hunting cadence, hunt-to-detection pipeline. The effort: significant but can run in parallel with other layers (ES8-ES9, weeks 5-8).

Forensic readiness at “Ad hoc” (score 1/5): Default audit policies, no PowerShell logging, no Sysmon. Moving to “Managed” requires: advanced audit policies, ScriptBlock logging, Sysmon deployed with a tuned baseline. The effort: moderate (ES11, weeks 6-8).

The scoring reveals NE’s improvement path: onboarding is closest to target (2/5 → 4/5 with focused effort). ASR and detection need the most work but provide the highest security improvement. Forensic readiness is the foundation that investigation depends on — deploy it in parallel with detection engineering.

The maturity model as a communication tool

The maturity model serves a dual purpose: it is an engineering planning tool (which layers to improve, in which order) and an executive communication tool (where we are, where we are going, and what investment is needed to get there).

When presenting to the CISO, the maturity model visualises the gap between current state and target state across every layer. A spider diagram showing the current scores (1.2 average across 10 layers) overlaid with the target scores (3.5 average after the 90-day project) makes the scope of the improvement instantly visible. The delta between current and target drives the project plan. The progress from current toward target drives the monthly status report.

When presenting to the IT team, the maturity model identifies which layers require their collaboration. Onboarding (layer 1) needs the endpoint management team. Compliance (layer 2) needs Intune administrators. Server hardening (layer 7) needs the server infrastructure team. Each layer’s maturity improvement has specific dependencies on other teams — the maturity model makes these dependencies explicit and the timeline visible.

The quarterly re-assessment is not just measurement — it is the accountability mechanism. If a layer’s score does not improve between quarters, either the planned work was not executed (resource issue), the planned work was executed but ineffective (engineering issue), or the target was unrealistic (planning issue). Each explanation drives a different corrective action.

Troubleshooting

“We meet some criteria from Level 3 and Level 4 but not all from Level 2 — what level are we?” Level 1. The maturity model is cumulative. Advanced detections on an unprotected endpoint are like sophisticated locks on an open door. Fix the Level 2 gaps first — they represent the foundation that everything else depends on.

“Our management wants a maturity score, not a level — they want a number out of 100.” Convert the model to a weighted score: Level 1 criteria = 20 points, Level 2 = 20, Level 3 = 20, Level 4 = 20, Level 5 = 20. Partial credit within each level: if you meet 4 of 6 Level 2 criteria, score 13/20 for that level. Total: (Level 1 score) + (Level 2 score) + … = composite score out of 100. NE’s current score: approximately 20/100 (full Level 1, partial Level 2). Target: 70-80/100 (full through Level 3, most of Level 4).