There's No Maturity Model for Autonomous Containment. So We Built One.
ARGUS argues that there are required preconditions before we ever allow autonomous containment to happen. Those preconditions are honest system state, asset truth, Andon Cord and deception signals or tripwires. Each is instrumental if we are to ever allow autonomous containment to take place. Without them, we are just making the wrong decisions faster.
Overall, ARGUS and the preconditions have landed well, but one question kept coming up from customers and partners: "Where does my enterprise stand?"
That is the right tactical question, and here is my attempt to answer it.
The Gate Check
We start first with a simple gate check, and it is brutal on purpose. The question: "What percentage of your containment actions fire today through a deterministic workflow, WITHOUT a human in the loop?"
If the honest answer is none, then this is the starting point. Deterministic automatic containment shows that processes have been laid down (and are being followed), it shows that someone has worked through some hard enterprise risk questions. It shows someone on the security team has looked through their detections and decided that Threat "X" is worth the immediate response and has most likely articulated that threat to other business leaders.
Throwing a probabilistic AI layer on top of a SOC that cannot reliably execute if-this-then logic is simply not set up for success. AI will have worse explainability and move faster than a human ever will.
The Seven Domains: Weighted with ARGUS
We start with the seven domains, mapped directly from ARGUS.
| Domain | Weight | Description |
|---|---|---|
| Honest System State | ×3 | Independent telemetry confirms every autonomous action's outcome. Not command acknowledgment. |
| Asset Truth | ×3 | A criticality mesh architected around your CMDB's known gaps, not built on blind trust in it. |
| Deception Signal Integration | ×2 | Honeytoken or tripwire signals reserved a slot in the confidence model. Design commitment counts, even pre-deployment. |
| Andon Cord Governance | ×4 | The override mechanism is documented, tested, and signed off by CISO and legal. |
| Confidence Scoring Integrity | ×2 | Action is gated by asset criticality, blast radius, and deception input, not by model output alone. |
| Cross-Domain Organizational Authority | ×4 | The SOC has documented executive-backed authority to act against assets it doesn't own. |
| Feedback Loop Closure | ×1 | IOC propagation, threshold updates, and playbook revision close after every engagement. |
Honest System State and Asset Truth carry the heaviest technical weight. Everything downstream depends on these being right. Andon Cord and Cross Domain Organization Authority carry the heaviest weight overall; these domains are organization problems first – technical problems second. Deception gets a slot as it is one of the cleanest high confidence signals your SOC or the criticality mesh will see. Finally, Feedback Loop Closure closes us out. Low weight is intentional: it measures whether we have learned from previous actions.
Weights come to 19. Score yourself One through Five. Max score is 95. One rule that sits above it all: if any domain scores a 1: the organization isn't ready, regardless of the total. A strong aggregate should not buy you out of a prominent gap.
Where totals map to phases:
| Score | Phase | Description |
|---|---|---|
| 0–33 | Not Ready | One or more foundational domains score too low to support any autonomous action. Fix the gate check and the weakest domains before scoring again. |
| 34–47 | Now-Stage | Executive sponsorship across CISO and CIO. Cross-domain containment authority requires org-level alignment, not SOC-level negotiation. |
| 48–61 | Phase 1 Viable | Identity response first. Most mature API surface, lowest blast radius, fastest time to value. Step-up MFA and session kill on high-confidence behavioral detections. |
| 62–76 | Phase 2 Viable | Endpoint containment for non-critical assets. Decision logic wrapper and governance layer around existing EDR capability. |
| 77–95 | Phase 3 Viable | Full six-domain control plane. Network, cloud, and application with elevated thresholds and mandatory human approval for critical asset classes. |
The Expected Pattern
As expected, and as a few quick scorings confirm, one profile is common: high Confidence Scoring Integrity paired with low Cross Domain Organization Authority. The technical proficiencies are there. The org chart is not.
This gap does not close with more budget or better engineering. Identity, cloud, network, endpoint and application teams that do not report to the CISO are not going to start allowing autonomous containment because detections and confidence models got more sophisticated. Executive authority must grant it. In writing. Across the domains in which the SOC do not own.
My piece of advice here: trust is earned slowly, regardless of if it is with humans or not. The more autonomous triage performed with high levels of confidence, and matching human analyst verdicts, will build trust in the underlying systems. Track this data meticulously, as I am sure it will be helpful with organizational buy in later.
Where Do You Stand?
Run through this exercise, starting with the gate check. If you pass it, score the seven domains honestly. The rubric is not a report card – it is a map of exactly where the organization needs to have a conversation and with whom.
If you're interested in a second set of eyes or looking for someone to bounce off ideas with. The GSAsecops@wwt.com is here to help.