Cybersecurity Management

BC-620 Level 1 Cross-Industry 54 providers 260 API surfaces 23 rated strong or better

Security strategy, controls, identity, and threat response.

Cybersecurity Management (BC-620) is a level-1 business capability in the Cross-Industry model. The catalog holds 260 API surface(s) from 54 provider(s) that can perform some part of it, 23 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Security Strategy & Governance Management BC-620.10

Security strategy, policies, frameworks, GRC.

no catalog coverage

Identity & Access Management BC-620.20

IAM, PAM, federation, joiners-movers-leavers.

50 providers, 160 API surfaces

Threat Detection & Response Management BC-620.30

SOC, SIEM, incident response.

7 providers, 69 API surfaces

Vulnerability Management BC-620.40

Vulnerability scanning, patching, remediation.

5 providers, 13 API surfaces

Security Architecture Management BC-620.50

Secure design, security patterns, zero trust.

no catalog coverage

Security Awareness Management BC-620.60

Awareness training, phishing simulations, culture.

no catalog coverage

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 7 Complete, well-documented, and agent-ready
ThousandEyesRolesUsers2 APIs71.2SignalWireMulti-Factor Authentication1 API68.9Sigma Computingteams1 API68.8Cisco Catalyst SD-WANAdministration - User and GroupIPS Signature - Custom RuleIPS Signature - RuleIPS Signature - Rule Group4 APIs68.4WorkRampScim1 API67.7DoiTUsers1 API66.5Showpadusergroups1 API66.5
Strong 16 Solid coverage with minor gaps
NexGen CloudRBAC RoleUser Permission2 APIs65.6Cisco Identity Services EngineADGroupsActiveDirectoriesAdmin GroupsAdmin Users76 APIs64.4NexlaUsers1 API62.2Rhombus SystemsPermission WebserviceUser Webservice2 APIs62.2NasuniIAM1 API61.9Cisco XDRActorAsset PropertiesAttack PatternCOA28 APIs61.4PixieBrixgroups1 API61.1Sift StackUserGroupService1 API60.7Cisco UmbrellaActivityCisco Secure Malware Analytics IntegrationCo-occurrences for a DomainDestination Lists19 APIs59.3MaltSCIM1 API58.5EVEDEXACLAuth2 APIs57.6Cisco Secure FirewallAPI EntitlementASA Access RulesAccess GroupsIntelligence15 APIs57.4Brandfolderuser_permissions1 API55.8Cisco Intersightiamtam2 APIs55.8Cisco PSIRT openVuln APICurrent EndpointsObsolete EndpointsSunset Endpoints3 APIs55.0BigtincanUser1 API54.5
Developing 14 Usable, with meaningful gaps to close
Platform.shGrantsMFAOrganization MembersTeam Access6 APIs52.9Bevzintegrator_users1 API52.5TrustArcPermissionProfilesUserProfilesUserProfiles-ActivationsUserProfiles-Users6 APIs51.6Pyntapplicationscanscan-business-impact-analysisscan-false-positive-analysis7 APIs51.2PartsTechuserusers2 APIs50.9Cisco Crossworkauthconfigpasswordrbac3 APIs50.2University of AmsterdamSSO Settingsjwt_mappingskey managementscim4 APIs48.9Flume HealthUsers1 API48.2University of GroningenRolesUsersuser3 APIs47.0Oxidepolicysilossystem/silostokens4 APIs45.8MetabolonUsers1 API44.2Université de MontréalRolesUsers2 APIs43.9SpyderbatAgent ActionCasesCustomFlagForwardedEvents8 APIs39.7King Fahd University of Petroleum & Mineralsuser1 API39.4
Thin 14 Limited public surface area
Maastricht UniversityRolesUsers2 APIs37.4MealieAdmin: Manage Users1 API37.0InfoworksSecurityUsers2 APIs35.8SecuronixAdversariesAttack PatternCampaignCourse of Action17 APIs34.5SparkyFitnessAdmin1 API34.2UCLouvainRolesUsers2 APIs33.0PavootAdmin1 API31.7Tecnológico de MonterreyRolesUsers2 APIs31.4National University of SingaporeAuthorizationSession2 APIs31.3CacheflowUsers1 API30.3FlueidAccountPermissions2 APIs30.2Norwegian University of Science and TechnologyRolesUsers2 APIs29.9University of North Carolina at Chapel HillRolesUsers2 APIs28.2Queen's University at KingstonRolesUsers2 APIs28.0
Emerging 3 Early or largely undocumented
University of ChileRolesUsers2 APIs24.1Queen's University Belfastroleuser2 APIs22.0Yonsei Universityuser1 API17.6

Workflows that realise this capability

Arazzo workflows whose own sourceDescriptions call APIs that carry this capability. The link is derived, not asserted: each workflow declares x-realizes-capability-ids with the spec and confidence behind it.

This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Cybersecurity Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →