An open frameworkBy Living SecurityVersion 2.0CC BY 4.0

The evidence behindhuman risk.

An open framework for what to measure, how mature your program is and what to fix next.

Start the assessment Explore the taxonomy

Phish to takeoverSE-T-02 → SE-B-04 → IA-B-04 → IA-B-05 → SE-T-06→ Real-phish clicker with privileged access and 3 more cohorts → Credential abuse & account takeover · within 72 hours

Schematic. One dot per signal; positions are illustrative.

One path through the framework

SE-T-02Real phishing delivered to inbox
SE-B-04Clicks links in real phishing
IA-B-04Signs in from unusual contexts
IA-B-05Approves MFA after repeated prompts
SE-T-06Account sending malicious or phishing mail
CohortReal-phish clicker with privileged access and 3 more cohorts
SequencePhish to takeover within 72 hours
Breach scenarioCredential abuse & account takeover

Schematic

The model

Four levelsof evidence.

Every entry sits on one level, from a single observation about one person to the incident it can lead to.

137

Signals
One observation about one person or AI agent, from one source.
24

Cohorts
Signals that matter together.
11

Sequences
Risk developing over time.
10

Breach scenarios
The incidents they lead to.

481
indicators in the library: 17
source types: 9
risk domains: 3
dimensions: threat, access, behavior

Job one · The taxonomy

Understandwhat to measure.

Search 137 signals across nine risk domains. Every signal has an ID, a dimension and a source type, and every one shows where it connects.

SE-T-01 Threat Email security
SE-B-04 Behavior Email security
IA-A-01 Access Identity provider & MFA

Example entries from the library. Open the taxonomy explorer

Three dimensions. One person.

A conceptual model for reading every signal, with no formula and no score. The letter in each ID names its dimension.

Threat SE-T-01

What reaches a person?
Access IA-A-01

What could they expose?
Behavior SE-B-04

What do they do under pressure?

Job two · HRM Maturity Model 2.0

Assess the program.

Five levels, from complying with a training requirement to preempting attacks before they land, aligned to NIST CSF 2.0 Implementation Tiers. Six practices, each scored on its own.

Level 1

Comply

NIST CSF 2.0 Implementation Tier: Tier 1 · Partial

The program meets the training requirement and counts activity: training completion and simulation clicks.
Level 2

Observe

NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed

The program observes behavior across several risk domains and knows who reports.
Level 3

Prioritize

NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable

Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
Level 4

Orchestrate

NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive

Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
Level 5

Preempt

NIST CSF 2.0 Implementation Tier: Beyond Tier 4

AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.

Six practices, each scored on its own

Read the maturity model

See
Understand
Act
Prove
Govern
Culture

18

Questions in the initial assessment

4 min

About, from first question to result

Nothing

To type before you see the result

Start the assessment

Job three · Your result

Decide what to improve.

The initial assessment returns your level, a score for each practice, your top gaps, three first playbooks and a 90-day roadmap.

Initial assessment· Result

Illustrative · sample data

Your level

3Prioritize

ComplyPreempt

Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.

Next level · 4

Orchestrate

Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.

Practice scores

See Orchestrate, level 4
Understand Prioritize, level 3
Act Observe, level 2, a top gap
Prove Observe, level 2, a top gap
Govern Prioritize, level 3
Culture Orchestrate, level 4

Five steps per bar, one for each level. Red marks a top gap.

Top gaps

Act. Next: Campaigns target the riskiest cohorts; written playbooks with owners and time limits.
Prove. Next: Stage 3+ per breach scenario and cohort sizes against targets, mapped to the control framework.

Three first playbooks

01 Write the first three playbooks Easy · quick win
02 Set a target for each cohort and report against it Easy · quick win
03 Compute a stage per person from active signals Easy · quick win

90-day roadmap

Next check: retake the assessment

Days 1–30
Write the first three playbooks
Days 31–60
Target repeat clickers and the Critical cohort
Days 61–90

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result.