A transparent method for a complex question.

Each answer maps to a defined maturity position. Questions carry different weights reflecting their importance — privileged access controls matter more than naming conventions — and weights are adjusted for your context, such as regulation, data sensitivity or whether you develop software internally.

Answers roll up into capability scores, capability scores into dimension scores, and dimensions into an overall readiness score (0–100). Scoring is deterministic: the same answers always produce the same result, and AI never changes a score.

Every assessment is pinned to a published framework version. When the methodology evolves, existing results do not change.

Level 5 is not automatically the goal. A 20-person company does not need the governance of a regulated multinational. The assessment sets a target maturity per dimension based on size, industry, regulatory environment, data sensitivity and strategic priorities, and reports the gap to that target.

Questions adapt as well: organizations without software development are not asked about deployment pipelines, while multi-country operations see regional integration and data-flow questions.

Risk (0–100, higher means more exposure) is calculated independently from maturity. It considers the risk impact and criticality of each answer, unanswered or unknown areas, and exposure factors such as sensitive data or public digital channels.

Critical findings — for example missing MFA on privileged accounts, untested disaster recovery or secrets in source code — are identified by explicit rules, reported separately, and set a floor on the overall risk level. A strong average never hides a critical exposure.

Important questions ask how confident you are in the answer and invite optional evidence such as policies, reports, diagrams or metrics. “We believe we have MFA everywhere” is different from “we verified MFA coverage last quarter.”

Assessment confidence reflects coverage, evidence, self-reported confidence, unknown answers and contradictions between answers. The report lists the information that is still missing.

Opportunities are identified from capability gaps and findings, then prioritized by business impact, relevance to your stated objectives, risk reduction, time to value and effort. Dependencies are respected when building the roadmap.

Where a finding maps naturally to a capability JK Ventures offers, the report notes it. Recommendations are never generated to fit a service.

After deterministic scoring, an AI model interprets the structured results: explaining findings, identifying cross-dimension patterns, drafting recommendations and a roadmap narrative. Its output is validated against a strict structure and checked so it cannot alter scores, invent evidence or claim that an organization is “secure” or “compliant.”

The AI receives only the minimum necessary information — no company names, contact details or evidence documents — and assessment data is not used to train models.

The assessment is based on information provided by the organization. It is not a technical audit, penetration test or legal review. Security observations should be validated through technical testing, and potential regulatory considerations — including data protection requirements such as Colombian habeas data regulations — should be confirmed with qualified legal counsel.

Benchmarks are shown only when a statistically meaningful number of comparable, anonymized assessments exists. Until then, results are compared only with your own history.