Get startedHRM Taxonomy 2.0CC BY 4.0
Every piece of evidence,one name and one home.
Nine risk domains, three dimensions, four evidence levels and six stages give every observation of human risk a place. Each entry has a stable identifier, a definition, an example and a permalink you can cite.
Loading the index…
Taxonomy explorer
Explore the evidence.
The explorer opens on its own full page: every signal in one matrix by risk domain, the way the MITRE ATT&CK matrix lays out techniques, with the cohorts and sequences each one belongs to a hover away.
Three dimensions. One person.
Threat × Access × Behavior, a conceptual model of human risk with no formula and no score. Every signal belongs to one dimension.
Evidence levels
Four levelsof evidence.
How much evidence it takes to see a risk: from one observation about one person to the incident it can lead to.
-
137
Level 1 · Signals
One observable unit of evidence about one subject from one source.
-
24
Level 2 · Cohorts
Two or three signals that describe the same subject at once.
-
11
Level 3 · Sequences
An ordered run of signals across MITRE ATT&CK tactics inside a detection window.
-
10
Level 4 · Breach scenarios
The breach scenario the evidence beneath it points toward.
Stages
Six stages.
Where a person or agent sits on the road from exposure to incident. Every step of every sequence is placed on one of them.
-
Stage 0
ClearThe person has no active threat, access or risky-behavior signal inside any dwell window.
-
Stage 1
ExposedThe person is targeted by a real threat, or holds access an attacker would want, and has shown no risky behavior yet.
-
Stage 2
SusceptibleThe person has shown risky behavior in a simulation or in hygiene telemetry, and no real threat has reached them yet.
-
Stage 3
ExploitedThe person acted on a real threat: a real click, a real consent, a real reply or a real credential submitted.
-
Stage 4
SuspectedSignals point to a compromise of the person's account or device that the SOC has not yet confirmed.
-
Stage 5
ConfirmedThe SOC opened an incident and attributed it to the person; when it closes, the person returns to Stage 1 for a 90-day watch.
Risk domains
Nine risk domains.
Where the risk lives. Each dot is one of the domain's signals.
-
SE27 signals
Social engineering
Email, SMS, voice, QR, deepfakes, help-desk pretexting
-
IA25 signals
Identity and access
Authentication, MFA, credentials, privilege
-
DH15 signals
Data handling
Sharing, movement, DLP, disposal, personal storage
-
EP19 signals
Endpoint and device
EDR, malware, USB, mobile, patching, physical
-
WC12 signals
Web, cloud and SaaS
Browsing, shadow IT, OAuth, third-party apps
-
AU8 signals
AI use
AI tools, prompts, outputs and the people who use them
-
AG9 signals
AI agents
Agents and service identities, their scopes, logging and owners
-
SC9 signals
Security culture
Attitudes, confidence, friction, ambassadors, help-seeking
-
RR13 signals
Readiness and response
Training currency, reporting, exercises, exceptions, incidents
Sixteen risk categories
The 1.0 categories C.01 to C.16, with their 481 indicators, carried into 2.0 under the nine domains. All categories.
- C.01Communication security
- C.02Engagement & awareness
- C.03Data protection
- C.04Identity & access risk
- C.05Web & cloud usage
- C.06Endpoint & device security
- C.07Physical security
- C.08Social engineering risks
- C.09Incident response readiness
- C.10Remote work risk
- C.11Digital exposure risk
- C.12Mobile security
- C.13Third-party risk
- C.14Policy & regulatory compliance
- C.15Human use of AI
- C.16Agentic AI
Seventeen data sources
Where signals come from. Signals per source.
- Awareness & phishing simulation
- Identity provider & MFA
- Email security
- Endpoint protection
- Web, CASB & DLP
- HR system
- IGA, PAM & entitlements
- SIEM, SOAR & incident tickets
- Breach & dark-web exposure
- Vulnerability management
- Data security posture
- IT service management
- Finance & payments
- Device management (MDM/UEM)
- Badge & physical access
- Pulse survey
- Help desk
Concept terms
92 terms, six layers.
The vocabulary under the evidence: what each word means here, how analysts and vendors name the same idea, and its sources.
Core concepts
10The words the rest of the taxonomy builds on.
Constructs
8How signals combine into cohorts, sequences and windows.
Interventions
24What a program does in response to risk.
- Intervention
- Awareness training
- Role-based training
- Behavior-triggered training
- Phishing simulation
- Multichannel simulation
- Deepfake simulation
- Nudge
- Just-in-time coaching
- Microlearning
- Security champions program
- Policy acknowledgment
- Tabletop exercise
- Notification drill
- Adaptive control
- Step-up authentication
- Access revocation
- Playbook
- Automated response
- Targeted campaign
- Culture pulse survey
- Recognition
- Help-before-you-build channel
- Exception review
Measurement
24The numbers, rates and benchmarks a program reports.
- Click rate
- Report rate
- Report-to-click ratio
- Resilience ratio
- Repeat clicker
- Time to report
- Training currency
- Phishing-resistant MFA coverage
- Visibility gap
- Coverage
- Grade
- HRM Benchmark
- Cohort minimum
- Signal-to-action time
- Incident lift
- Avoided loss
- Key risk indicator
- Security NPS
- Perceived friction rate
- Confidence-ability gap
- Maturity level
- Practice score
- Human risk quantification
- Human element share
Governance
14Ownership, data use, reporting and standards.
Technology
12The sources and platform capabilities that produce the evidence.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.