How should security teams measure progress if maturity scores are too static?

Why static maturity scores miss improvement

Static maturity scores are useful for a snapshot, but they often flatten the difference between a control that is merely present and a control that is getting measurably better. A programme can score well while still failing to shorten response times, reduce rework, or remove recurring exceptions. Progress needs to reflect movement across cycles, not just status at one point in time.

A momentum model solves that by asking whether the next control cycle is easier, faster, and less error-prone than the last one. That makes the measurement closer to operational reality: a control that is repeated with less friction, better evidence, and fewer exceptions is improving even if the maturity label has not yet changed.

For teams measuring security work, this is especially important because many gains are invisible in a single score. Better control design can reduce manual overrides, faster approvals can reduce queue time, and clearer ownership can reduce back-and-forth. Those changes matter because they show whether the programme is accumulating capability or simply maintaining compliance theatre.

What to measure instead of a single maturity number

A useful measurement model combines three signal types. Leading indicators show whether the next cycle is likely to improve, such as closure rate for control gaps or reduction in open exceptions. Lagging outcomes show whether the change actually held, such as fewer incidents, fewer audit findings, or fewer emergency fixes. Friction signals show how hard the work is becoming or easing, such as review time, handoff count, exception volume, or rework.

The point is not to replace maturity assessment entirely, but to anchor it in movement. If leading indicators improve but lagging outcomes do not, the programme may be busy without being effective. If lagging outcomes improve while friction stays high, the team may be succeeding through heroics rather than durable control.

That is where a momentum view gives leadership a better story than a static score. It shows whether control quality is compounding, where the path is getting smoother, and which parts of the programme are stuck in a loop of repeated effort. For teams that use maturity language, this makes the score a descriptor, not the decision tool.

How to make momentum scores credible to leadership

The measurement has to stay close to operational evidence. Use the same control cycle over time, compare like with like, and avoid mixing activity metrics with outcome metrics as if they mean the same thing. A rising count of completed assessments is not the same as fewer control failures, and a lower score is not always a setback if the programme is exposing hidden friction that was previously invisible.

Leadership also needs a consistent baseline. If each team defines improvement differently, the score will drift toward optimism or local convenience. The best practice is to tie momentum to observable change, then review the mix of signals so that one easy-to-game metric cannot dominate the narrative.

For teams looking for a mature operating model, Identity Security Maturity Model shows how capability assessment can be structured without relying on a single static number. For teams that want a broader process maturity reference, OWASP SAMM remains a useful maturity framework for tracking whether security practices are becoming more repeatable and effective over time.

Practitioner Guidance

What to prioritise: Start with one control cycle that already has regular evidence, because momentum measurement works best where you can compare repeated work rather than invent new reporting. Pick signals that show movement in both effort and outcome, not just whichever metric is easiest to collect.

What to verify: Check that your leading indicators, lagging outcomes, and friction signals are all measuring the same operational path. If they point in different directions for several cycles, the team may be improving process hygiene without reducing actual risk, or reducing risk without making the process easier to run.

Common mistake: Treating a higher score as proof of progress. Static maturity often rewards documentation and coverage, while momentum reveals whether the programme is compounding, plateauing, or regressing under real operating conditions.

Practitioner takeaway: If leadership wants to know whether security is improving, answer with trend, not label, because sustainable progress is visible when controls become easier to execute and more effective at the same time.

Related resources from NHI Mgmt Group

• How should security teams measure progress in NHI governance beyond risk scores?
• How should security teams prioritize application vulnerabilities when static severity scores are too noisy?
• How should security teams prioritise NHI remediation in cloud environments?
• How should security teams govern non-human identities at scale?