Topic starter
17/08/2026 4:37 pm
TL;DR: MITRE’s AI maturity model gives organisations a structured way to score readiness across governance, data, technology, and operating model, but WitnessAI’s analysis makes clear that maturity alone cannot govern prompts, responses, or agent actions in real time. That gap matters because AI adoption is already outpacing control design, making runtime enforcement the decisive layer as agentic and customer-facing systems scale.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “Understanding the MITRE AI maturity model: a framework for assessing organizational AI capabilities”.
Key questions
Q: What breaks when AI maturity assessments are used as a substitute for runtime control?
A: The assessment becomes a snapshot of readiness rather than a live control, so unauthorised prompts, tool calls, and agent actions can still occur outside policy.
Q: When should organisations prioritise runtime controls over policy documentation for AI agents?
A: They should prioritise runtime controls whenever an agent can access data, invoke tools, or trigger external actions without a person approving each step.
Q: What are the signs that an AI programme is mature on paper but weak in practice?
A: Common signs include multiple approved-looking policies, limited live monitoring, unclear ownership for agent access, and no reliable way to explain what an AI system did during a session.
Practitioner guidance
- Map AI maturity scores to control gaps Use the maturity assessment to identify where governance, data, technology, and operating-model weaknesses are concentrated, then convert those gaps into funded remediation work.
- Separate readiness from runtime enforcement Keep maturity scoring as a planning and benchmarking exercise, while implementing live policy checks for prompts, responses, and agent actions inside the workflow.
- Inventory sanctioned and shadow AI use Establish visibility into approved tools, unsanctioned tools, and agent activity so the organisation can see where AI is already operating without formal control.
Bottom line: MITRE-style maturity scoring helps leaders locate AI governance and operating-model gaps, but it does not control live prompts or agent actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:43 pm
MITRE-style maturity scoring is necessary, but it is not sufficient. It gives leadership a common language for readiness, which is useful in boards, audit conversations, and programme planning. But readiness language does not stop a live model from disclosing data or acting on a bad prompt, so governance and runtime control must be treated as separate layers. The practitioner conclusion is simple: score maturity to plan, but govern execution to control risk.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Companies using AI governance put over 12 times more AI projects into production, according to a Databricks report.
A question worth separating out:
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
👉 Read our full editorial: MITRE AI maturity scores are useful, but runtime controls still decide risk