My AI Platform Broke the NCSC Cyber Maturity Model (1/5)

Part one of five on AI cyber maturity. The UK’s National Cyber Security Centre published a clean, useful maturity framework. Then I mapped Kairos against it and found every dimension was designed for a world where the threat lived outside the model.

By Nuno Roberto · Chief AI and Data Architect

This is the first article in a five-part series on cyber maturity in the age of agentic AI, written from inside Kairos, the platform I’ve spent the last three years building for logistics carrier intelligence. This part introduces the framework, explains why I chose it, and names the assumption that breaks it. Parts two through four walk the six dimensions two at a time. Part five adds the dimension the framework is missing and lays out what I’d tell a CISO to do about it.

Before you dive in, if you find this story useful, interesting, or worth arguing with, give it a thumbs up, leave a comment, or repost it for someone else who might get something out of it. Those small signals help the story travel further — and the comments usually make the conversation better than the article itself.

I was three weeks into a security review of Kairos when I printed out the NCSC’s Data Driven Cyber Maturity Model and pinned it to the wall next to my desk. The diagram is beautiful in the way…