Offensive security outcomes are woven into how the organization manages risk across functions. Leadership receives metrics on a set reporting cycle, not only after exercises, and cross-functional tabletops reach beyond technical teams. The signal that an organization has reached G4 is that leadership asks about offensive outcomes unprompted, and business units treat findings as operationally relevant between exercise cycles.
Outcomes
- ·Outcomes are reported to executive leadership on a set cadence, not only after exercises
- ·Cross-functional tabletops run at least yearly beyond technical teams
- ·Between cycles, business units own the findings relevant to their functions
- ·Resilience metrics are collected, trended, and included in leadership reporting
- ·Exercise findings are tracked to detection engineering improvements and IR playbook updates
Actions
- 01Set a reporting cadence to executive leadership that runs independent of exercise schedules
- 02Extend tabletops beyond technical teams to business unit leadership, communications, legal, and HR
- 03Define business-unit accountability for findings between cycles, not only during tabletops
- 04Build formal processes linking simulation findings to detection engineering each cycle
- 05Track and report resilience metrics as trend data for leadership
Sustainment Criteria
All criteria must be met to hold this level. If any criterion is unmet at reassessment, consider yourself at the previous level.
Outcomes are reported to executive leadership on a set cadence, independent of exercise schedules
Cross-functional tabletops run at least yearly with participants beyond technical teams
Evidence shows business units owning findings between exercise cycles
Resilience metrics are collected and trended, and executives can say whether they are improving
Each exercise cycle produces traceable detection engineering or IR playbook improvements with verified closure
Practitioner note
What separates G3 from G4 is integration between cycles, not just during exercises. A G4 organization has made offensive security outcomes part of daily operation. Business-unit accountability between tabletop cycles is the most concrete test of whether that integration is real or nominal.
Moving to G5
Make board-level reporting a standing function, formalize the PDCA cycle with documented evidence, run enterprise crisis simulations with executive and board participation, and link resilience metrics to investment decisions.
Corresponding Technical Practice level
T4 Optimized
Organizations often develop these axes at different rates. Compare your position on both.