Essential 8 maturity assessment: what the gap analysis actually finds
Julian ThorneApril 29, 2026
Key takeaways
Organizations self-reporting Essential 8 Maturity Level 2 for application control routinely have unmanaged endpoints outside scope — Vulnox assessment data shows this pattern in the majority of mid-market Australian environments reviewed.
The most exploitable gap in E8 assessments is not MFA absence but MFA exemption lists: privileged accounts with documented exceptions that have not been reviewed in over 12 months.
Patch management maturity scoring collapses when assessors check internet-facing assets separately from internal ones — the SLA evidence that satisfies Level 2 for internal systems frequently does not cover externally exposed services.
Essential 8 gap analysis using only internal scans misses an entire asset class: forgotten subdomains and cloud instances outside the managed inventory that attackers enumerate before the assessment begins.
Reaching Maturity Level 3 for user application hardening requires behavioral evidence, not just configuration screenshots — the difference between Level 2 and Level 3 is whether controls demonstrably stop something, not whether they are configured.
TL;DR
Most Essential 8 maturity assessments in Australia produce optimistic results because they assess what organizations already know about themselves. The gaps that matter — exemption lists that have grown unchecked, assets outside managed inventory, internet-facing services on separate patch cycles — only appear when the assessment starts from outside the perimeter, not from an intake questionnaire. This article covers what those gaps actually look like and what to do about them before an auditor or an attacker finds them first.
The assessment that found the wrong environment
A 200-person financial services firm in Melbourne commissioned an Essential 8 maturity assessment ahead of a government contract renewal. Their internal IT team had documented controls across all eight strategies, assembled evidence packages, and estimated they were sitting comfortably at Maturity Level 2 across most categories. The intake survey said so. The configuration screenshots said so. The patch reports said so.
External reconnaissance before the formal assessment started found 14 subdomains the IT team had no record of. Three were running services. One had not received a patch since 2022. The organizations patch management evidence — which covered their known asset inventory — was accurate. Their inventory was just wrong. The gap analysis had to start from a different baseline than anyone expected.
What the intake survey does not capture
Unmanaged assets outside declared scope
In Vulnox assessments of Australian mid-market organizations (50 to 500 employees), the pattern is consistent: organizations self-reporting Maturity Level 2 for patch management have a meaningful portion of their internet-facing attack surface outside the asset inventory used to produce that rating. The specific count varies, but the existence of out-of-scope externally reachable assets has been a finding in the majority of engagements where external reconnaissance preceded the formal review.
MFA exemption lists older than 12 months
Across engagements where we reviewed privileged account MFA enforcement, exemption lists — accounts formally excluded from MFA policy — were present in nearly every environment. The exemption itself is often documented and legitimate at the time it was created. What is rarely documented is a review cycle. Lists created during a system migration or vendor access event accumulate over time without anyone auditing whether the original justification still applies. (Vulnox assessment data, 2024–2025)
Application control scope gaps on non-standard endpoints
Application whitelisting policies that satisfy Level 2 criteria for standard Windows endpoints often have no equivalent enforcement on OT-adjacent machines, kiosk devices, or systems running specialized software that IT classifies as 'exceptions.' These exceptions rarely appear in the evidence package because they are excluded from the scope before scoring begins. (Vulnox assessment pattern, mid-market Australia)
Why Essential 8 maturity levels measure the wrong thing
The maturity model is structured around implementation consistency — whether a control is applied uniformly, whether governance exists around it, whether it is monitored. That is a reasonable proxy for security effectiveness when the asset inventory is complete and the scope of assessment matches the actual attack surface. The problem is that neither condition is reliably true in mid-market Australian environments.
Maturity Level 2 for patch management, for example, requires that patches are applied within defined timeframes and that there is evidence of this process operating consistently. If the organization's asset inventory excludes a cloud instance that was stood up by a developer 18 months ago and never registered, the patch management process can be fully Level 2 compliant while that instance runs unpatched indefinitely. The framework grades the process. It does not find what the process does not know about.
The same structural gap applies to application control. Level 2 requires application whitelisting on workstations and servers covering the assessed scope. Scope is defined at the start of the engagement, typically based on the asset register the organization provides. An assessor working from that register will score controls against it accurately. Whether the register reflects the actual environment is a different question, and one that the framework's evidence requirements do not force.
This is not a flaw unique to Essential 8. It is a property of any control-based maturity model: it assesses declared controls against declared scope. What it does not do is discover what has not been declared. That requires a different starting point.
Example
A logistics company in Queensland had documented application control policies covering all endpoints in their Active Directory domain. Evidence was clean. Level 2 criteria satisfied. During reconnaissance, we identified a Linux-based fleet management server reachable from the internet, outside the AD domain, running a web interface with no application control equivalent. It was not in scope because it was not in the asset register. It was not in the asset register because it had been provisioned directly by an operations team three years earlier without going through IT procurement. The maturity rating for application control was accurate relative to the declared environment. The declared environment was not the whole environment.
External asset discovery using passive DNS enumeration, certificate transparency log review, and service fingerprinting will surface assets that internal inventory processes miss. This is not a sophisticated technique — it is what any competent attacker does before touching a target. Running this step before scoring maturity produces a more accurate baseline than accepting the organization's asset register at face value.
What gap analysis actually surfaces
Assessment base: Vulnox Essential 8 and broader framework assessments, Australian mid-market and SMB clients, 2023–2025
MFA exemption lists functioning as permanent backdoors
In environments where MFA enforcement for privileged accounts was assessed, we consistently found documented exemptions that had not been reviewed since creation. The original justification — service account compatibility, vendor access, legacy system integration — was often valid when the exemption was written. In multiple cases, the underlying system or vendor relationship no longer existed, but the exemption remained active. One environment had 11 privileged accounts with MFA exemptions; 7 had justifications referencing systems that had been decommissioned.
Organizations treating MFA enforcement as a one-time configuration task will pass E8 assessments that check policy existence and broad enforcement while maintaining permanent authentication gaps for a subset of high-value accounts. The exemption list is the control's failure mode, and it is rarely in scope for the evidence review.
Patch management SLA evidence that covers only internal assets
Patch evidence packages submitted for Essential 8 assessments typically come from endpoint management tools — SCCM, Intune, similar. These tools report on assets enrolled in the management platform. Internet-facing assets provisioned outside standard IT workflows — cloud infrastructure, development environments, marketing-owned web properties — are frequently not enrolled and therefore not visible in the patch reporting used to satisfy Level 2 evidence requirements.
The organization's patch management process can be genuinely mature for the environment it manages. The gap is not in the process — it is in the scope of what the process manages. An attacker enumerating internet-facing assets does not distinguish between IT-managed and operations-managed infrastructure. The patch window that matters is the one covering externally reachable services.
Application control policies with undocumented publisher-based exceptions
Several environments using publisher-based application control (trusting all applications signed by specified vendors) had accumulated publisher entries over time without corresponding review cycles. In one case, a vendor whose software had been removed from the environment two years earlier remained in the trusted publisher list. Any application signed by that vendor — including malicious software signed with a compromised or acquired certificate — would execute without challenge.
Publisher-based application control is a legitimate approach to managing whitelisting overhead. It creates a different risk profile than hash-based control, specifically around certificate compromise and vendor acquisition scenarios. The maturity framework does not distinguish between these implementation approaches. An environment using publisher-based control with a stale publisher list may score identically to one using hash-based control with current reviews.
The finding that surprises clients most
Common belief
Organizations approaching an Essential 8 assessment typically believe their biggest gaps are in the strategies they have not started implementing — application whitelisting if they are running AV-only environments, or MFA if they are still on password-only authentication. They expect the assessment to confirm what they already suspect.
What we found
In assessments where clients arrived with self-assessed maturity ratings, the gap between self-assessment and assessment findings was consistently larger for clients who rated themselves higher. Organizations self-reporting Maturity Level 1 or early Level 2 had gaps that matched their self-assessment reasonably well. Organizations self-reporting Level 2 across most categories had the largest discrepancies, almost always concentrated in scope coverage and exemption management rather than control existence.
The actual finding is usually different. Organizations that have invested in E8 implementation — the ones who have bothered to commission an assessment — tend to have the obvious gaps addressed. Their exposure sits in the implementation edges: the assets outside managed scope, the exemptions that were never reviewed, the evidence that covers the right process applied to the wrong perimeter.
A mid-market organization with no application whitelisting at all has a clear and obvious problem. An organization at self-reported Level 2 with 14 unmanaged internet-facing assets has a problem that is harder to see and easier to exploit, because nothing in their control environment is looking for it.
Put differently: the gap analysis is most valuable for organizations who think they have most of it covered. They are right about what they have covered. They are wrong about what 'covered' includes.
What standard E8 gap analysis misses
Digital footprint outside IT-managed scope
Asset registers are snapshots of what IT knows about. They are not inventories of what exists. Shadow IT, developer-provisioned cloud infrastructure, acquired company assets carried into a merger, marketing-owned SaaS with data integrations — none of these reliably appear in the asset register used to scope an E8 assessment. Running external reconnaissance before accepting a client-provided asset list as complete is the difference between assessing the declared environment and assessing the actual one.
Maturity evidence validity periods
E8 evidence is typically collected at a point in time. A configuration screenshot proves the setting existed when the screenshot was taken. A patch report proves the patch cycle operated during the reporting period. Neither proves the control is operating today or will operate next month. Level 3 maturity requires continuous monitoring and review cycles, but Level 2 evidence requirements can be satisfied with point-in-time documentation. Organizations that prepare evidence packages specifically for assessments can achieve Level 2 ratings that reflect assessment-period behavior rather than ongoing operational practice.
Privileged access scope in hybrid environments
Restricting administrative privileges is assessed against administrative accounts in the organization's identity infrastructure. In hybrid environments — on-premises AD alongside Azure AD, or multiple tenancies from acquisitions or client service delivery — the administrative account inventory is frequently incomplete. Azure AD guest accounts with directory roles, break-glass accounts from legacy migrations, and service principals with owner-level permissions regularly appear outside the scope of privilege restriction evidence without anyone having made a deliberate decision to exclude them.
Office macro settings in cloud-delivered productivity suites
Essential 8 controls around macro settings were designed around on-premises Office deployments. Microsoft 365 policy enforcement through Intune or Group Policy follows a different model, and the evidence that satisfies the framework's requirements does not always reflect whether the control is actually enforced for cloud-delivered applications, mobile access, or shared device scenarios. Assessors checking GPO settings for macro control may miss entirely separate policy surfaces through which a document-delivered payload could execute.
What clients say before the assessment — and what it actually means
'We already did an E8 assessment last year and we were Level 2 across most categories. We just need a light-touch review to confirm nothing has changed.'
Root cause:A point-in-time assessment does not account for configuration drift, new asset provisioning, staff changes that affect privileged account lists, or vendor relationship changes that affect MFA exemptions. 'Nothing has changed' is almost never accurate at the control evidence level over a 12-month period in a live environment. The request for a light-touch review is a request to confirm last year's finding, not to assess this year's reality.
'Our patch management is solid — we have automated deployment through Intune and we hit our SLAs consistently.'
Root cause:Intune covers enrolled devices. The question is what is not enrolled. Development machines, contractor laptops, cloud-hosted services, OT-adjacent systems running specialized software — these are common Intune exclusions. The patch management process is only as comprehensive as the asset scope it operates against. Consistent SLA performance against an incomplete inventory is not comprehensive patch management.
'We have MFA on everything.'
Root cause:Almost universally, 'everything' means 'everything in the standard identity policy scope.' The exemption list exists. It grew during an implementation sprint and has not been reviewed. Service accounts, vendor access accounts, and legacy system integrations frequently survive MFA rollouts because enforcing MFA on them requires application changes that are deferred and then forgotten.
Where Essential 8 assessments are heading
ACSC will introduce mandatory external attack surface validation as a prerequisite for Level 2 and Level 3 ratings within 3 years, specifically requiring that assessment scope be reconciled against externally discoverable assets before evidence review begins.
The current model's scope definition weakness is a known problem inside the assessor community. As breaches of organizations with clean E8 ratings become more visible — and they will, because the scope gaps create real exploitable exposure — regulatory pressure to strengthen scope methodology will follow. External asset reconciliation is the obvious technical fix.
Confidence: mediumACSC Essential 8 assessment methodology updates between 2025 and 2028. If updated methodology does not include mandatory external reconnaissance, this prediction is wrong.A publicly disclosed breach of an Australian organization holding a current E8 Maturity Level 2 or 3 rating, where the initial access vector was an asset outside the assessment scope, will occur within 2 years and will drive significant methodology changes.
The structural conditions for this breach already exist. Organizations with Level 2 ratings have unmanaged externally facing assets. Those assets are discoverable. The question is whether an attacker focuses on one of these organizations before the methodology catches up. The probability is high enough that preparation rather than prevention is the appropriate response.
Confidence: highNo publicly disclosed breach matching this profile by May 2027. This would suggest either the scope gaps are less prevalent than assessment data indicates, or organizations are not being targeted in the expected pattern.
The honest problem with E8 as a maturity signal
Essential 8 maturity ratings have become a procurement signal — a number that appears in vendor questionnaires, government contract applications, and board risk reports. That creates a structural incentive to optimize for the rating rather than the security outcome. An organization can reach Maturity Level 2 across all eight strategies through careful scoping, well-prepared evidence packages, and disciplined control implementation within a defined and incomplete perimeter. The rating will be accurate. The security posture it signals will be overstated.
This is not an argument against the framework. Essential 8 is a reasonable set of controls and the maturity model is a useful forcing function for organizations that would otherwise not have implemented them at all. The problem is using the rating as a finished product rather than a starting point. A Level 2 rating should be the beginning of a conversation about what was in scope and what was not — not the end of one.
Counterargument
The counterargument is that any maturity framework will be gamed if it is used as a procurement signal, and the solution is better procurement questions rather than framework modification. This is true. The problem is that better procurement questions are not how government contracting currently works at scale, and organizations are not going to voluntarily disclose scope limitations that reduce their ratings. The framework will be used as it is used, not as it was intended.
Running an E8 gap analysis that finds real gaps
Step 1 — external reconnaissance before scope definition. Most organizations and many assessors begin with the asset register the IT team provides. The gap between that register and the actual external footprint is where the most exploitable findings live, and it is the step most likely to be skipped because it requires external tooling and adds time to an engagement that is already budget-constrained.
- 1Security lead or external assessor
Run external reconnaissance before accepting the client asset register as the assessment scope. Use passive DNS enumeration, certificate transparency logs, and WHOIS data to build an independent asset list for the organization's domains. Compare against the declared inventory. Any discrepancies become scope reconciliation items before scoring begins.
Expected outcomeAn accurate baseline that includes externally discoverable assets the internal team does not know about. This step typically adds between 5 and 30 assets to scope for mid-market organizations.
- 2Security lead or assessor
Pull the MFA exemption list for all privileged accounts before reviewing MFA enforcement evidence. For each exemption, check whether the original justification document exists, whether the system or relationship it references is still active, and when the exemption was last reviewed. Flag any exemption without a review date in the past 12 months.
Expected outcomeA cleared exemption list where each entry has a current justification, or a finding list of exemptions that need review or removal before the MFA maturity rating is finalized.
- 3IT or assessor
Cross-reference patch management evidence against the external asset list from step 1. For each externally discoverable service, confirm it appears in the patch management tool's reporting scope. If it does not, identify what process — if any — covers patching for that asset.
Expected outcomeA patch coverage map that distinguishes between assets the patch management process covers and assets it does not. This is the input for accurate Level 2 scoring on patch management.
- 4Security lead
Review the trusted publisher list for application control implementations using publisher-based whitelisting. For each publisher entry, confirm the vendor relationship is active and the vendor's certificate infrastructure is monitored. Remove entries for vendors whose software is no longer in use.
Expected outcomeA trusted publisher list that reflects current vendor relationships, with a documented review cycle established for ongoing maintenance.
- 5IT or identity team
Audit administrative account inventory across all identity systems in scope, including Azure AD guest accounts with directory roles, service principals with elevated permissions, and accounts in any satellite or acquired tenancies. This inventory becomes the basis for privileged access restriction evidence.
Expected outcomeA complete privileged account list that accounts for hybrid identity environments, used as the accurate denominator when calculating MFA enforcement and privilege restriction coverage.
One thing to do this week
Pull the MFA exemption list for your privileged accounts today. Count the exemptions. For each one, find the original justification document and check whether the system or vendor it references is still active. If you cannot find a justification, or if the justification references something that no longer exists, that exemption is a gap — not a configuration choice. This takes an afternoon. It will tell you more about your actual E8 maturity than the last assessment report did.
If you want to understand the external asset scope problem before your next assessment, run a certificate transparency log query against your primary domain and compare the results to your asset register. The difference between what appears in the CT logs and what is in your inventory is where an attacker starts. It should be where your gap analysis starts too.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint analysisNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideHow to Map Your Digital Footprint - UpGuard
mapping your digital footprint
Frequently Asked Questions
What does an Essential 8 maturity assessment actually measure, and what does it miss?
An Essential 8 maturity assessment measures whether documented controls are implemented consistently within the declared assessment scope. What it misses is anything outside that scope: assets not in the organization's inventory, MFA exemptions that have never been reviewed, and patch management evidence that covers internal systems but not externally facing ones. The maturity rating reflects the declared environment, not necessarily the actual one.
How do organizations get to Essential 8 Maturity Level 2 with real security gaps still open?
Level 2 ratings are awarded based on evidence of consistent control implementation within the assessment scope. If the scope excludes unmanaged cloud assets, shadow IT, or development infrastructure provisioned outside IT workflows, the controls can satisfy Level 2 criteria while leaving exploitable assets unaddressed. The rating is accurate relative to what was assessed. The problem is the gap between what was assessed and what actually exists.
What is the most commonly exploitable gap found in Essential 8 gap analysis?
MFA exemption lists for privileged accounts. These exemptions are created for legitimate reasons during implementation — service account compatibility, vendor access, legacy system integration — and then never reviewed. Accounts with active exemptions have no second authentication factor. In Vulnox assessments, exemption lists containing accounts whose original justification no longer applied were a consistent finding across environments that otherwise satisfied MFA enforcement evidence requirements.
Why does patch management evidence often fail to cover internet-facing assets?
Patch management evidence comes from endpoint management platforms — Intune, SCCM, and similar tools. These platforms report on enrolled assets. Internet-facing services provisioned outside standard IT workflows, including developer-created cloud instances and marketing-owned web properties, are frequently not enrolled. The patch process operates correctly against the enrolled inventory. The enrolled inventory does not match the externally discoverable asset list.
What is the difference between Essential 8 Maturity Level 2 and Level 3 in practice?
Level 2 requires consistent implementation and documented governance. Level 3 requires evidence that controls demonstrably work under realistic conditions — behavioral evidence from monitoring, documented response to control failures, and review cycles that confirm ongoing effectiveness. The distinction matters most for application control and privileged access: a Level 2 rating can be satisfied by configuration evidence, while Level 3 requires showing that the control stopped something or that review processes caught drift before it was exploited.
How should external asset discovery change the scope of an Essential 8 maturity assessment?
External reconnaissance using passive DNS enumeration, certificate transparency logs, and service fingerprinting should be run before the asset register is accepted as the assessment scope. Any externally discoverable asset not in the declared inventory becomes a scope reconciliation item. The reconciled scope — declared assets plus discovered assets — is the accurate denominator for patch management and application control evidence. Starting from the client-provided register without this step produces a maturity rating that applies only to assets the organization already knows about.
What should an organization do immediately after an Essential 8 gap analysis to address the most critical findings?
Review and clear the MFA exemption list for privileged accounts — this is typically a one-day task with immediate risk reduction. Then cross-reference the externally discoverable asset list against the patch management reporting scope and identify which assets are not covered. These two actions address the two most consistently exploitable gaps found in E8 assessments without requiring a major remediation program.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.