Overview
In the Cye Exposure Management Platform, technologies such as EDR or SIEM can be linked to NIST subcategories to reflect the organization's security tooling. These linked technologies contribute positively to the maturity score — as long as they genuinely enhance coverage. This article explains how linked technologies are scored, how to add them, and when to create a finding instead.
How Technologies Affect Maturity Scores
Linked technologies are assigned a default maturity level of 3
This value is editable
The Cye platform incorporates this score only if it increases the subcategory's existing score
Example: If a subcategory score is 2.5, a linked technology with a value of 3 will raise it
If the subcategory score is already above 3, the technology will be ignored to avoid lowering the score
Changing a technology's maturity level updates all subcategories it's linked to
When to Use a Finding Instead
If a technology provides only partial coverage or needs to be supplemented with additional tools:
Create a finding to represent the shortfall
This helps reflect the gap accurately and ensures the maturity score isn't overestimated
Adding Technology Assets
Go to the Assets page
Use the Unmapped Framework filter to find technologies not assigned to a NIST framework:
Select a framework to view unmapped technology and process assets:
Add a Suggested Technology
If the Cye platform detects a relevant subcategory without a linked technology, it will suggest assets to add:
Click the + button to add (grayed out if permissions are insufficient)
A new technology can also be manually added if no suggestions are listed
Complete the Asset Form
Fill out required fields, including:
Technology type (e.g., SIEM)
Tool name
Engagement (choose one or use a dedicated one for separation)
Function, Category, Subcategory (under the primary framework only)
Click Create
Note: One technology asset can be applied to multiple subcategories if relevant. Only one asset can be created at a time — repeat as needed.
Wrap-up / Next Steps
Linking technologies is a smart way to show investment in protective tools and improve the maturity score — but only when the tools are meaningful and mapped correctly. Review assets regularly and make sure they reflect the real state of the security posture.