Assessment Accuracy

To validate the scoring structure and assess the natural distribution of maturity levels, a simulation of 1,000 organizations was conducted using the ARMOR self-assessment model. The simulation used realistic organizational profiles across four market segments (SMB, Mid-Market, Enterprise, and Large Enterprise) representing typical employee counts, IT/security staffing, and operational complexity.

Each simulated organization answered 20 representative questions covering governance, testing cadence, remediation, and integration. Scores ranged from 1 to 3 per question, and overall averages were mapped to the five ARMOR maturity levels. The simulation incorporated weighted sampling that mirrors the real-world distribution of company sizes in the United States, excluding very small organizations (\< 200 employees) that typically fall outside ARMOR's intended audience.

Objectives

• Validate the scoring bands and ensure consistent mapping to ARMOR levels

• Assess expected maturity distributions by segment

• Confirm that the model scales predictably across organizational sizes

Methodology

Randomized scores were generated following a bell-curve distribution tuned for each segment's expected maturity and variance. The resulting dataset contains 1,000 simulated cases, summarized by both count and percentage. Confidence intervals were calculated for each segment and level.

Confidence Note: 95 percent confidence intervals were within ±3.0 percent for all major levels, confirming representativeness of the 1,000-organization sample.

The following tables and figures summarize the simulated results by segment and level.

Interpretation

The results align closely with expected real-world trends. SMBs primarily cluster around Levels 1 and 2, where practices are emerging or repeatable but not yet strategic. Mid-Market organizations show stronger representation at Level 3, reflecting the development of managed programs and early strategic alignment. Enterprise and Large Enterprise organizations demonstrate a more even spread between Levels 3 and 4, with a small but significant proportion beginning to achieve Level 5 characteristics.

Overall, the distribution reinforces the model's intent: higher maturity requires deliberate investment, integrated governance, and sustained operational execution. Progression between levels is incremental and realistic, with the model exhibiting logical scalability across organizational types and sizes.

Assessment Simulation Results

Data Availability: The full 1,000-organization simulation dataset and summary tables are available at [LINK]