This maturity level signifies there are weaknesses in an organisation’s overall cyber security posture. When exploited, these weaknesses could facilitate the compromise of the confidentiality of their data, or the integrity or availability of their systems and data.

This maturity level focuses on criminals operating with a modest step-up in capability from the
previous maturity level. These adversaries are willing to invest more time actively targeting
credentials using phishing and employing technical and social engineering techniques to circumvent
weak, multi-factor authentication. Generally, criminals in this group are more selective in their
targeting, but still somewhat conservative in the time, money, and effort they invest in a target.
Depending on their intent, adversaries may also destroy data (including backups) accessible to an
account with special privileges.

This maturity level signifies there are weaknesses in an organisation’s overall cyber security posture. When exploited, these weaknesses could facilitate the compromise of the confidentiality of their data, or the integrity or availability of their systems and data.

This maturity level focuses on criminals who are more adaptive and much less reliant on public tools
and techniques. These hackers exploit the opportunities provided by weaknesses in their target’s
cyber security posture, such as the existence of older software or inadequate logging and
monitoring. These criminals are more focused on targets and are willing to invest some effort into
circumventing the policy and technical security controls implemented by their targets. Once a
foothold is gained on a system, adversaries will seek to gain privileged credentials or password
hashes, pivot to other parts of a network, and cover their tracks. Depending on their intent,
adversaries may also destroy data (including backups).