A free, browser-based ransomware readiness assessment tool — updated for the 2026 threat landscape, covering 7 domains and 80+ controls across all major industries.
RansomwareMaturity.com was built to give organizations of all sizes a structured, actionable way to benchmark their ransomware defenses and prioritize improvements — at no cost, with no account required, and with no data leaving your browser.
The threat landscape has fundamentally shifted. AI-generated phishing, Ransomware-as-a-Service affiliate models, double and triple extortion, software supply chain attacks, cloud workload ransomware, and identity-based no-malware techniques are now standard attack patterns. Preparation and measurable maturity — not just reactive response — is what separates organizations that recover in hours from those that recover in weeks.
Major additions and updates from the previous framework version:
Seven domains · 80+ controls · 1–5 maturity scale · Aligned with NIST CSF 2.0 and CIS Controls v8
EDR/XDR, ZTNA, AD/Entra ID hardening, CSPM/CIEM, data classification & DLP, firmware integrity
24/7 MDR/SOC, ITDR, AI/ML behavioral anomaly detection, SOAR-driven alert triage
Double/triple extortion playbooks, out-of-band comms plan, CIRCIA compliance, negotiation retainer
Air-gapped immutable backups, 3-2-1-1-0 strategy, clean-room recovery, chaos testing
AI phishing/deepfake simulations, MSP/RMM audits, software supply chain security (SBOM/SLSA)
Ransom payment policy with OFAC screening, post-quantum cryptography roadmap, cyber insurance pre-claims readiness
AI agent inventory, prompt injection testing, model supply chain integrity, AI-generated malware defense
Unrated items count as Level 1 (lowest maturity) to prevent score inflation from skipping controls.
The tool tailors criteria and recommendations for nine sectors, each reflecting sector-specific regulatory requirements, threat actors, and operational constraints.
All assessment scoring and recommendations are generated entirely in your browser using client-side logic. No assessment data, scores, or organization details are transmitted to any server or stored externally. The tool is safe to use with sensitive internal security information.