Appendix
Cye AI & Maturity Report 2026— Data, Frameworks, and Methodology
The reference data behind the report ' s findings. All scores are on a 1 – 5 scale( see Scoring). Figures are drawn from the 2026 dataset.
A. About the Data
This year ' s report covers 21 countries, 16 industries, and 2,400 + NIST CSF function scores, up from 17 countries and 1,500 data points in 2025. Scores are drawn from thousands of cybersecurity maturity assessments conducted in Cye ' s exposure management platform. AI risk maturity was derived for the first time by mapping NIST CSF 2.0 function scores to the four core functions of the NIST AI RMF 1.0.
SCORING SYSTEM( CMM)
Scores follow the Capability Maturity Model( CMM), on a scale of 1 to 5, where 1 is the least mature( most vulnerable) and 5 is the most mature.
FUNCTION |
SCORE |
DESCRIPTION |
Initial |
1 |
Ad hoc, reactive |
Managed |
2 |
Basic processes in place |
Defined |
3 |
Standardized, documented |
Quantitative |
4 |
Measured and controlled |
Optimized |
5 |
Continuous improvement |
29