Business Architecture for Cybersecurity: AI Transformation Blueprint | Capstera

Business Architecture for Cybersecurity: AI Transformation Blueprint gives business and enterprise architects the full design for bringing AI into the security function. It keeps the capability model of 195 L3 capabilities, with an AI profile for each L2, and adds 12 value streams shown today and AI-native, a business data model of 116 entities, 44 agent specification starters with guardrails, 64 use cases, 45 controls and responsible AI principles, an operating model and a three-wave roadmap. The import files load it into the Capstera platform, and MCP access lets your assistants and agents look up one agent or control at a time.

What the Business Architecture for Cybersecurity Is

This blueprint contains the whole AI-Ready capability model for cybersecurity and builds the layers an AI program needs on top of it. The capability layer is unchanged: 9 L1, 39 L2 and 195 L3 capabilities, 161 KPIs, an AI profile for every L2, ratings for every L3, prioritization, the heatmap and the readiness assessment. Everything added links back to those capability IDs.

Twelve cybersecurity value streams, 60 stages in all, describe how security work runs from trigger to outcome, each stage shown today and AI-native with its human checkpoint, alongside 14 standard value streams. The business data model has 16 subject areas, 116 entities, 871 attributes and 400 relationships, each with sensitivity and data-quality requirements, describing the information security agents would read and act on. The 44 agent specification starters each state tool permissions, guardrails and an escalation path.

The governance layer turns the design into something a security leader can sign: 64 use cases as structured business cases, 45 controls and responsible AI principles tied to the risk tiers, an operating model with governance bodies, a RACI, an agent lifecycle, role impacts and new roles, and a three-wave roadmap. A leadership presentation template and an implementation guide come with it.

The Problem It Solves

In security, the hard part of AI is not finding places it could help. It is deciding what an agent may do without a person, and proving that decision was made deliberately. An agent that quarantines a device, revokes a session or releases a credential acts directly on the estate. Designed one tool at a time, those agents end up with different permissions, different escalation rules and no common record of who approved them.

The blueprint designs that authority up front. Each value stream stage names the human checkpoint, each agent starter states what it may touch and when it must escalate, and each control is tied to a risk tier, so a new agent is reviewed against a standard rather than argued from scratch. The sample shows the pattern: the Access Request Agent prepares a privileged access request and carries out only what the System Owner approved.

What's Inside

• Everything in the AI-Ready Capability Model edition: 9 L1, 39 L2 and 195 L3 cybersecurity capabilities, with definitions to L3 and 161 KPIs at L2, an AI profile for every L2, AI ratings for every L3, prioritization, the AI heatmap and a 40-question readiness assessment
• 12 cybersecurity value streams, 60 stages with their steps, each described today and AI-native, with the human checkpoint at every stage, plus 14 standard value streams
• An AI-ready business data model: 16 subject areas, 116 entities, 871 attributes and 400 relationships, with sensitivity and data-quality requirements
• 44 agent specification starters with tool permissions, guardrails and escalation paths
• 64 use cases as structured business cases
• 45 controls and responsible AI principles, tied to risk tiers
• An operating model: governance bodies, a RACI, an agent lifecycle, role impacts and new roles
• A three-wave roadmap
• A Welcome document, a leadership presentation template to adapt, the capability map deck, standalone documents for the capability definitions, KPIs, data model, agent specifications, use cases and AI governance, a value streams deck, the Excel workbook, the implementation guide, and import files for the Capstera platform
• Bonus files: a cybersecurity glossary, cybersecurity roles and how AI changes them, cybersecurity operating model archetypes, a cybersecurity transformation overview and framework, A Practical Guide to Business Architecture, a capability modeling overview, an AI-ready capability profile template, capability relationship mapping templates, a framework-to-enablement deck, a capabilities to microservices and AI agents mapping example, and a business architecture leader role guide
• Free corrections, new versions free for 180 days, and MCP access for your AI assistants for the same 180 days

Every file names your organization and carries your license ID. Ratings describe a typical large enterprise and are a starting point for your own.

Use Cases

Redesigning security value streams. Compare today and AI-native stages for the value streams behind your top-ranked capabilities, and agree with the teams who run them where the human checkpoint sits. The result is a target process, not a list of features.

Approving security agents. Use the agent specification starters as the template every security agent must complete before it goes live. Reviewers check tool permissions, guardrails and escalation against the risk tier instead of reading a vendor brochure.

Building the security AI portfolio. Select from the 64 use cases, written as structured business cases, to fill a portfolio that covers the capabilities you ranked highest, and compare them on the same terms.

Governing AI inside security tools. Apply the controls and responsible AI principles by risk tier to AI features that arrive in products you already own, so a vendor update does not quietly change who decides.

Designing the security operating model. Use the governance bodies, RACI, agent lifecycle and role impacts to set who owns each agent, who may change its permissions, and how analyst and engineer roles shift.

Sequencing and funding the program. Adapt the three-wave roadmap and the leadership presentation template to show what each wave delivers and which foundations it depends on.

Who Uses It

Chief Information Security Officer. Owns the roadmap and the funding case, and uses the operating model to make accountability for each agent explicit.

Security architects. Design agents and integrations from the specification starters and the data model, and keep every design traceable to a capability and a control.

Security operations and identity leads. Review the AI-native stages for their value streams, confirm the human checkpoints and decide which agent actions need approval.

AI risk and governance reviewers. Assess each agent and use case against the controls and principles for its risk tier before it goes live.

Enterprise architects and program managers. Connect the security design to the wider enterprise architecture and run delivery against the three waves.

Build It, Hire It, or Start Here

Designing AI into security across capabilities, value streams, data, agents, controls and an operating model is several projects at once, and the starting point decides how long the first coherent version takes.

• Building it from a blank slate. Each layer needs its own workshops and review cycles, and every change in one layer has to be carried into the others by hand. Security experts spend their time drafting structure, and the links between agents, data and controls are the first thing to drift.
• Hiring consultants to build it. A consulting team can staff the workstreams, but the generic parts still have to be elicited and written before the specific ones, and the design depends on the team staying long enough to keep it consistent.
• Starting from this model. All layers arrive drafted and linked, with cross-references between capabilities, value stream stages, data entities, agents, use cases and controls validated before release. Your experts start by deciding what to change for your environment.

Use your own security experts and any advisors on what only they can judge: the risk tiers that fit your exposure, the escalation paths that match your on-call model, and which agents should exist at all. The generic agent template and data entity are already written.

How to Get Started

1. Read the Welcome document and the implementation guide, and rank the capabilities with your own weights.
2. Review the AI-native stages of the value streams behind the top-ranked capabilities with the teams that run them.
3. Choose the use cases and agent specification starters for those stages and adapt permissions and escalation to your tools.
4. Adopt the controls by risk tier and stand up the governance bodies and RACI from the operating model.
5. Adjust the three-wave roadmap and leadership presentation template and take them to the executive committee.

Read the Public Sample

The sample follows one thread through the package, privileged access management, and is 0.76% of the content. From the Privileged Access Management (CY-4.4) AI profile:

• Work patterns: Coordination & orchestration, Analysis & insight, Rules-based decision
• Target AI mode: Augment
• Human oversight: Human-in-the-loop
• AI fit / Value / Feasibility / Data readiness: 4 / 5 / 3 / 2 (1–5)
• Risk tier: High
• Roadmap wave: Wave 2
• AI opportunity: Find accounts with elevated rights across systems, classify their power and propose an owner for each, flagging standing privileged accounts with no recent use
• What stays human: The System Owner approves every privileged access grant for a task, whether just-in-time elevation or release of a vaulted credential; the Access Request Agent prepares the request, carries out only what the System Owner approved and never decides a grant

The preview above shows more of the profile, the AI heatmap, an agent card and a value stream stage redesigned for AI. Any MCP client can also query the sample at https://platform.capstera.com/api/mcp/blueprints?package=cy without a key.

Connect Your AI Assistant

Your license includes access to the package through MCP (Model Context Protocol). Connect an MCP-capable AI assistant or your own agents, and they look up your licensed content as they work: one capability, agent or control at a time, scoped to your edition and stamped with your license ID. The key arrives with your order confirmation, and access runs for the 180 days in which new versions are free. Setup and limits: AI-ready license and MCP access.

Upgrade Credit

Bought the AI-Ready Capability Model edition in the last 90 days? The full price you paid counts toward this Blueprint. Email support@capstera.com with your order number for a one-time checkout code.

Frequently Asked Questions

What is the difference between the two editions?

The AI-Ready Capability Model covers the capability map, an AI profile for every L2 capability, prioritization, the heatmap and the readiness assessment. The AI Transformation Blueprint adds value streams redesigned for AI, the business data model, agent specifications, use cases, responsible AI principles and controls, the operating model and the roadmap, a leadership presentation template, and bonus files on roles, operating model archetypes and transformation.

Can I upgrade from the Capability Model to the Blueprint later?

Yes. The full price you paid for the Capability Model counts toward the Blueprint if you upgrade within 90 days. Email support@capstera.com with your order number for a one-time checkout code.

What happens after 180 days?

Your license to use the files does not end. Corrections are free for as long as you use the files. New versions released within 180 days of purchase are free, and MCP access runs for the same 180 days. There is no renewal after that: you can buy a new version at 25% off its price. Orders placed before October 27, 2026 keep the 12 months they were sold with.

Can I load the content into our own AI tools?

Yes, within the license. The Enterprise license allows internal tools, including your own assistants and agents. Neither license allows training, fine-tuning or prompting AI systems for third parties.

Does the package cover AI laws and regulations?

No, by design. It is business architecture: capabilities, value streams, data and the AI layer describe what cybersecurity does and how AI fits, and they hold whichever laws apply where you operate. The risk tiers, principles and controls are durable practices your compliance team maps to your own jurisdictions.

Why not just ask ChatGPT or another AI assistant?

Ask an AI assistant how security could use agents and you will get a sensible starting list, which is useful for orientation. The list will not tell you what each agent may do on its own, which data it reads, how it escalates, or which control governs it, and it will change the next time you ask. Security automation has to survive a review by risk, audit and the people whose access it changes. This blueprint gives you stable IDs across capabilities, value streams, data entities, agents, use cases and controls, cross-references checked before release, rated AI profiles, risk tiers, 44 agent specification starters with guardrails, and a scoring model you weight yourself.