Cyber maturity or AI readiness? Start here

Exposure Get a real picture of what would happen in an incident today (detection, response, and recovery) before anything else gets layered on top.

Compliance Work backwards from the next audit, insurer questionnaire, or client security review, and close the gaps you already know they will ask about.

Ownership Name one accountable owner with budget and authority. Nothing else on this list survives contact with a busy quarter without it.

Data Find out where your sensitive and business-critical data actually lives, and who can reach it, before you decide what to automate or protect.

AI momentum Get visibility into what AI is already being used for, by whom, and with what data. You cannot steer what you cannot see.

Capacity Be honest about who has the hours. Work with no owner and no protected time is the first thing dropped when the quarter gets busy.

In the last 18 months, what security events have you actually dealt with? What has already happened is the cheapest evidence you have. Nothing we’re aware of, and we’d expect to know Phishing attempts that went nowhere A close call, or an incident we contained ourselves A breach, ransomware, or a fraud loss

What’s coming that you’ll have to answer for? Audits, insurers, and client security reviews set the real deadlines. Nothing on the calendar A client or insurer questionnaire at renewal A formal audit, exam, or security review this year An overdue finding, or a requirement we can’t currently meet

Who owns these decisions today? Security and AI both stall in the same place: nobody accountable. One accountable owner with a mandate covering both Security is owned; AI decisions are ad hoc IT handles what it can, without a mandate for either Nobody owns either. It comes up, and then it doesn’t

How much AI is already in use across your team? Unmanaged AI use is both an adoption question and an exposure question. Almost none, and no near-term pressure to change A few sanctioned pilots we can see and control Growing use across teams, only partly visible to IT Widespread use through personal accounts we don’t control

If you wanted AI to work from your data tomorrow, where is that data? AI is only as useful as the data it can actually reach. In connected systems we could point AI at In systems, but siloed: someone would have to pull it together Spread across spreadsheets, inboxes, and shared drives Mostly in people’s heads and local files

Where is the pressure to do something about AI coming from? Who is asking, and how hard. No real pressure yet Internal curiosity, no deadline Leadership or the board is asking for a plan Clients or competitors are already moving, and it’s costing us

If an account or laptop were compromised right now, how would you find out? The realistic path from compromise to awareness. Monitoring would flag it and someone would act We’d catch it on a scheduled alert review Probably when a user noticed something odd We likely wouldn’t know

What happens to this work when your team gets busy? Capacity decides whether anything actually ships. It’s someone’s actual job, with protected time It progresses slowly, alongside everything else It stops until something forces it back up the list There’s nobody with capacity to pick it up at all

Do you have obligations specific to how AI handles your data? Client AI clauses, regulated data, sector rules, the EU AI Act. No, and none expected Possibly. We haven’t checked Yes, and we don’t yet know how we’d evidence compliance Yes, and we’re already being asked questions we can’t answer

Where does your most sensitive data live, and who can reach it? Classification and access, not storage. Classified, access-controlled, and reviewed We know where it is; access reviews are occasional We could work it out, but nobody has mapped it We’re not sure where all of it is

What’s forcing the timing right now? This doesn’t change your score. It tells us how to be useful. An audit, insurer, or contractual requirement Board or leadership pressure A recent incident or close call An internal efficiency or cost push

When do you need to show progress? Also unscored. It decides whether we send you a plan or a starting point. Within 30 days This quarter This year No fixed deadline, exploring

Start with cybersecurity Your answers point at exposure and obligations that AI adoption would only amplify. Securing the base first is the cheaper order of operations. It’s also what an auditor, insurer, or client security review will ask about regardless of what you do with AI. Start with the cybersecurity maturity self-check. Two minutes, and you get a scored baseline across the six NIST CSF functions.

Start with AI readiness Your security fundamentals are in better shape than your AI footing. The live risk is AI spreading faster than your ability to govern it, alongside capability you already pay for sitting unused. Start with the AI readiness self-check. It scores six readiness dimensions and shows what to fix before the next rollout.

Both are live: sequence them Both fronts scored close enough that either is a defensible starting point. Security usually goes first: AI adopted on an ungoverned base multiplies whatever exposure already exists, and the same governance work counts toward both. Either self-check is a reasonable start. If you want the shorter path to a defensible answer, begin with the recommended one below.

No urgent gap: get a baseline Nothing in your answers points to urgent pressure on either front. That’s a good position to be in, and the right moment for an evidence-based baseline, while it’s a choice rather than a response to an audit or an incident. There’s no fire to put out. A scored baseline now is what keeps it that way, and most organisations score lower against evidence than they expect.

Skyrocket · Stage 0 · Orient

Cyber or AI: which one should you actually start with?

Both are urgent in the abstract. Usually only one is urgent for you right now. Twelve questions, two minutes, and a straight answer about which starting line is yours, plus what’s driving it.

Starting in the wrong order is expensive. AI adopted on an ungoverned base multiplies whatever exposure already exists. Security hardened without knowing how AI is already being used misses the newest hole. This tells you which comes first.

The Skyrocket journey

Orient

You are here

Assess

Prioritize

Implement

Operate

12 quick questions · No answer is wrong · A clear recommendation at the end

Select an option to continue

Your starting point

—

Priority signal by track

A higher number means more pressure, not better maturity, so these figures aren’t comparable with the scores from the two maturity self-checks.

Six-theme priority breakdown

What’s driving this

What to do next

This self-check points you at a starting line. It isn’t an assessment. Both Skyrocket tracks begin the same way: a scored, evidence-based baseline, then a sequenced climb through Prioritize, Implement, and Operate.

Take the cybersecurity self-check Explore Skyrocket Take the AI readiness self-check

Grounded in standards. Scored against evidence: NIST CSF 2.0 · CIS Controls v8 · NIST AI RMF · ISO/IEC 42001 · MITRE ATLAS

Reference

The four possible recommendations

This self-check compares two priority scores against each other rather than measuring maturity. The recommendation depends on which track carries more pressure, and by how much.

Recommendation	When it applies
Start with cybersecurity	Exposure, incident history, or compliance deadlines outweigh AI pressure. Security fundamentals come first because AI adoption on an ungoverned base multiplies existing risk.
Start with AI readiness	AI activity, data readiness, or AI-specific obligations outweigh security exposure. Governing and directing AI adoption is the higher-value first move.
Both are live: sequence them	The two tracks score within the tie threshold of each other. Both need attention; the recommendation is to sequence rather than choose, starting with the tie-breaker track.
No urgent gap: get a baseline	Both tracks fall below the low-priority floor. No urgent gap is indicated; a baseline assessment is suggested as preventative rather than corrective work.

How the recommendation is calculated

Ten scored questions, each weighted and assigned to the cybersecurity track, the AI track, or both where the signal is shared: unclear ownership and unmanaged AI use count toward both. Each track produces an independent 0–100 priority score, where a higher number means more pressure rather than better maturity. The two scores are then compared: a clear lead recommends that track, scores within ten points recommend sequencing both, and two low scores indicate no urgent gap. Two further questions capture context and do not affect the score.

What this is, and what it isn’t

This is a routing tool, not an assessment. It tells you which starting line is probably yours; it does not measure how mature either programme is. The two maturity self-checks do that, and a full engagement scores the same areas against evidence: interviews, configuration review, and technical validation. Results here are indicative and not a guarantee of outcome.

DigitalEra Group · Doral, Florida · serving the United States, Latin America, and the Caribbean since 2000. SOC 2 Type II certified.

DigitalEra · Empowering Confidence.
Skyrocket: cybersecurity maturity and Secure AI Adoption journeys. This self-check indicates a starting point only and is not a formal assessment.

Active incident? Certified IR professionals respond 24/7.