Technology readiness levels: what each step on the TRL scale claims
Technology readiness levels in security research are a number between one and nine, self-assessed, describing how far a technology is from working in the real world. Read carelessly it turns a prototype into a product.
The technology readiness levels scale in security research
The scale runs from 1 to 9 and describes maturity rather than quality. A technology at level 9 is not better than one at level 4; it is closer to being usable by somebody who did not build it. The distinction matters because coverage of security research routinely reads a high level as a compliment and a low one as a criticism, when both are simply positions on a path.
| TRL | Claim | Evidence that supports it |
|---|---|---|
| 1 | Basic principle observed | published theory or observation |
| 2 | Concept formulated | a described application of the principle |
| 3 | Proof of concept | analytical or laboratory evidence |
| 4 | Validated in the laboratory | components working together on a bench |
| 5 | Validated in a relevant environment | tested outside the laboratory, in conditions resembling use |
| 6 | Demonstrated in a relevant environment | a working prototype shown in the field |
| 7 | Demonstrated in an operational environment | a prototype shown where it would actually work |
| 8 | Complete and qualified | the system finished, tested and certified |
| 9 | Proven in operational use | in service, over time, by its intended users |
Where a field demonstration actually sits
The demonstrations described in the dossiers on this site land at levels 6 and 7. A working system, on real ground, doing what it was specified to do, in front of the people who would use it. That is the summit of what a research programme is funded to reach, and every programme that reached it did something difficult.
It is also two levels short of a system anyone can rely on, and the two remaining levels contain most of the work that decides whether a technology exists in practice. Level 8 asks for the system to be finished — not a prototype with known workarounds, but a qualified, certified product. Level 9 asks for it to have survived actual use, over time, by people who did not build it and cannot repair it.
Why the gap between 7 and 9 is where systems die
Nothing in that gap is interesting to a researcher and all of it is essential to an operator. Reliability measured in years rather than demonstration days. A maintenance regime and the spares to support it. Training material for people who will not read a specification. Certification against national requirements that differ between member states. Integration with whatever the operator already runs, which is usually older and stranger than anyone expected.
None of that is funded by a research programme, because a research programme correctly ends at the demonstration. It is procurement work, decided nationally, on separate money and a separate timetable — the structure set out under programmes and funding. A system reaching TRL 7 and stopping is therefore not evidence of failure. It is the normal terminus of the instrument that funded it.
Reading a TRL claim without being misled
- The level is usually self-assessed, in a proposal, by the people seeking the funding
- "Relevant environment" and "operational environment" are elastic and rarely defined in the claim
- A whole system inherits the level of its least mature component, which is not always the one being described
- A level without the environment it was reached in carries almost no information
The practical rule this site follows: quote the level together with what was demonstrated and where, or do not quote the level at all. A number on a nine-point scale looks like a measurement and is closer to a claim, and treating it as the former is the fastest way to turn a working prototype into a deployed capability in a reader's mind.
One structural caution belongs with technology readiness levels in security research. It was built to describe a single technology moving toward use, and the things described on this site are rarely single technologies. A border surveillance system is a sensor, a platform, a radio link, a command application and a set of procedures, each at its own level, assembled into something whose readiness is not the average of theirs. Where a whole system is given one number, that number is doing a great deal of work quietly, and the component that will actually decide whether the thing survives contact with a border is usually not the one the number was chosen to describe.
Questions about technology readiness levels
What are technology readiness levels?
A nine-point scale describing how mature a technology is, from an observed basic principle at level 1 to a system proven in operational use at level 9. It was devised to let funders and buyers talk about maturity without arguing about words, and it is used throughout European security research calls and grant records.
What TRL does a field demonstration reach?
Typically 6 or 7: a prototype demonstrated in a relevant or operational environment. That is a real achievement and it is not deployment. Levels 8 and 9 require the system to be qualified and then proven in actual operational use, which is a different order of engineering, cost and institutional commitment.
Why do so few systems get past TRL 7?
Because the work between 7 and 9 is unglamorous, expensive and funded by nobody in a research programme: reliability over years rather than days, maintenance, training, spares, certification, integration with what the operator already runs. Research money ends at the demonstration; the rest is procurement, and it is decided nationally.
Can two TRL claims be compared directly?
Only with care. The level is self-assessed in most proposals, the environment a system was "demonstrated in" varies enormously, and a level quoted without describing that environment says very little. This site quotes the level and the environment together, or neither.