Key terms

HRM-INT-17Interventions

A response that removes or narrows an entitlement because a person's risk rose or the entitlement went unused. It reduces the Access dimension directly.

Also: entitlement removal, deprovisioning, privilege reduction

HRM-INT-15Interventions

A security control whose strength changes with a person's measured risk: stricter authentication, narrower access or tighter data rules for high-risk cohorts, relaxed again as risk falls.

Also: conditional policy, conditional access, risk-based control, adaptive security control

HRM-TECH-12Technology

The register of AI agents and service identities with their owner, scopes, logging state and retirement date. It makes agents subjects of the taxonomy.

Also: agent registry, non-human identity inventory, service account inventory

HRM-GOV-10Governance

The record an auditor can inspect for each claim the program makes: the signal definition, the source event, the computation and the time it ran. Every maturity criterion lists the evidence to ask for.

Also: evidence, proof, audit trail

HRM-INT-19Interventions

An intervention executed by a playbook or an agent without a person in the loop, inside limits the program sets. Every run is logged with its trigger and effect.

Also: automated remediation, autonomous response, agentic remediation

HRM-MEAS-16Measurement

The estimated cost of incidents that did not occur because measured risk fell, computed from incident lift, the organization’s own incident costs and the change in exposed population. Assumptions are published with the number.

Also: risk-adjusted savings, loss avoidance, return on risk reduction

HRM-INT-02Interventions

The baseline cybersecurity training delivered to all personnel on a fixed cadence, at hire and at least annually. It builds security awareness and yields a completion rate.

Also: literacy training, all-user training, general training, compliance training, security awareness training

HRM-INT-04Interventions

A short training item assigned automatically when a specific risky behavior signal fires, delivered within hours and tied to that behavior. The share of such content is a program metric.

Also: triggered training, remedial training, event-driven training

HRM-GOV-04Governance

A quarterly report to the board or risk committee of a few key risk indicators against appetite, the trend of exposed populations and the avoided loss claimed, with the method behind each number.

Also: executive reporting, board pack, board metrics

HRM-TECH-11Technology

A service that reports credentials, sessions and personal data about the workforce found in breach dumps, infostealer logs and dark-web markets. Each hit is a Threat signal for the exposed person.

Also: dark web monitoring, credential exposure feed, infostealer feed

HRM-MEAS-01Measurement

The share of delivered simulated lures that were clicked, opened or acted on in a period. The equivalent for real phishing is the real phishing click rate, measured from email security telemetry.

Also: simulation click rate, failure rate, simulation failure rate, click-through rate

HRM-MEAS-13Measurement

The smallest number of records a benchmark group needs before an aggregate is shown: 25. Groups below the minimum show no number, which protects the people in them.

Also: minimum group size, suppression threshold, k-anonymity threshold

HRM-MEAS-20Measurement

The difference, in points, between how able people rate themselves and how they perform in simulations and drills. A large gap marks overconfident cohorts.

Also: overconfidence gap, self-assessment gap

HRM-TECH-03Technology

An integration that pulls events from one data source into the platform on a schedule and maps them to signals. A connector that falls silent for seven days marks its signals unknown.

Also: integration, data connector, source integration

HRM-GOV-06Governance

The legal and policy ground for processing behavior and threat data about people: the lawful basis, the notice given, the retention set and the works council or union agreement where one applies.

Also: lawful basis, privacy basis, processing basis

HRM-MEAS-10Measurement

The share of signals, cohorts and sequences a program can compute from its connected sources, and the share of the workforce each measure reaches. Coverage is reported before any risk number.

Also: data coverage, signal coverage, program reach

HRM-CON-03Constructs

A cohort class where Threat, Access and Behavior signals all fire on one person. The program treats members as its first priority for intervention and control change.

Also: critical triad, T+A+B cohort

HRM-INT-21Interventions

A short, recurring survey that measures attitudes, confidence, perceived friction and help-seeking across the workforce. Participation and the answers are Security culture signals.

Also: pulse survey, culture survey, sentiment survey

HRM-INT-07Interventions

A multichannel simulation that uses synthetic voice or video of a known person to test whether staff verify identity before acting on a request.

Also: AI-powered social engineering simulation, synthetic media simulation

HRM-CON-07Constructs

The time span inside which the steps of a sequence must occur for the sequence to count. Each sequence sets its own window, from 24 hours to 95 days.

Also: sequence window, time window

HRM-CON-08Constructs

How long a signal stays active after it fires: Threat 90 days, simulated behavior 180 days, hygiene behavior 90 days, real interaction 30 days, compromise evidence 14 days, Access standing. A person's stage is the furthest stage any active signal sets.

Also: signal decay, signal lifetime, decay window, dwell

HRM-TECH-06Technology

The system that filters inbound mail and records what reached each inbox: phishing delivered, impersonation attempts, user reports and outbound malicious mail. It is the main Threat source for social engineering.

Also: secure email gateway, SEG, email security

HRM-TECH-07Technology

The agent on a device that detects malware, blocks malicious destinations and records tampering. Its events, joined to the device owner, give the Endpoint and device signals.

Also: EDR, endpoint protection, XDR

HRM-INT-24Interventions

A periodic review of every active policy exception against its approved end date and reason. Exceptions past expiry are a readiness metric.

Also: exception recertification, waiver review

HRM-MEAS-11Measurement

A letter from A to F for one risk domain, computed from its headline metrics against published bands. Grades describe results; maturity levels describe capability.

Also: domain grade, scorecard grade, letter grade

HRM-INT-23Interventions

A standing way for teams to ask security for help before they buy, build or connect something. Request volume is a culture metric that rises as trust grows.

Also: security help desk, business engagement channel, ask-security channel

HRM-CON-02Constructs

A cohort class that joins a risky Behavior signal with an Access signal: a person whose compromise would expose privileged systems, sensitive data or payment authority.

Also: B+A cohort, privileged risky users

HRM-GOV-02Governance

A written agreement between security and human resources on which people data the program may use, for what purpose and for how long. It covers roles, start and leave dates, managers and location.

Also: HR data agreement, people data agreement

HRM-MEAS-12Measurement

The Human Risk Management Framework dataset of assessment results, grouped by role, company size band, industry and region, used to compare a program with its peers. No aggregate is shown for a group under 25 records.

Also: benchmark, peer comparison, peer benchmark

HRM-MEAS-24Measurement

The share of breaches in the Verizon Data Breach Investigations Report where a person was a gating factor in one of the actions: 60% in the 2025 report and 62% in the 2026 report. Always state the year.

Also: human element, human involvement rate

HRM-CORE-01Core concepts

The likelihood and impact of a security loss that a person's action or inaction gates. It combines the threats that reach a person, the access the person holds and the behaviors the person shows.

Also: human cyber risk, people risk, human factor, human layer, workforce risk, eighth layer

HRM-TECH-02Technology

The screen where an analyst sees people and cohorts ranked by risk, the signals behind each number and the interventions in flight. It reads from the platform and adds no new data.

Also: risk dashboard, risk explorer, risk command center

HRM-CORE-02Core concepts

The discipline that measures human risk per person, intervenes with training, nudges and control changes based on that risk, equips the workforce to defend itself and builds a security culture. Forrester named the market in 2024.

Also: HRM, human cyber risk management, workforce risk management

HRM-CORE-03Core concepts

An open framework, version 2.0, under CC BY 4.0, with three parts: the HRM Taxonomy, the HRM Maturity Model and the HRM Maturity Assessment. The HRM Benchmark dataset and the annual State of Human Risk report sit beside it.

Also: HRM Framework, Human Risk Framework 2.0, human risk taxonomy, HRM Taxonomy, HRM Maturity Model

HRM-TECH-01Technology

Software that connects to the sources, computes signals, cohorts, sequences and scores per subject, runs interventions and playbooks, and reports coverage, grades and key risk indicators. The taxonomy defines what it must compute and names no product.

Also: HRM platform, human risk platform, SBCP platform, secure behavior management platform

HRM-GOV-01Governance

The named role accountable for human risk and its key risk indicators. Ownership moves from the awareness lead to the CISO with IT, HR and Finance, and at the Preempt level to a board-level owner.

Also: program ownership, accountable executive, risk owner

HRM-MEAS-23Measurement

Turning threat, access and behavior evidence into a likelihood and impact estimate per subject. The method, inputs and window are published so a second analyst can reproduce the number.

Also: risk scoring, risk modeling, risk quantification

HRM-CORE-05Core concepts

A per-person score that summarizes one subject’s human risk from threat, access and behavior evidence over a window. The scale is set by the program or the tool; the taxonomy states the inputs and the window beside any score.

Also: risk score, risk rating, vigilance score, risk index

HRM-TECH-09Technology

The system of record for entitlements, privileged access and recertification. It supplies the Access dimension, who holds what, since when and last used, and executes access revocation.

Also: IGA, PAM, entitlement management, access governance

HRM-TECH-05Technology

The system that authenticates people and agents and issues sessions. It supplies sign-in, MFA method and anomaly telemetry and executes step-up authentication.

Also: IdP, SSO, identity platform

HRM-GOV-09Governance

One of three CIS Controls v8.1 enterprise profiles, IG1, IG2 and IG3, that select which safeguards apply. Control 14 has 8 of 9 safeguards at IG1; role-specific training (14.9) starts at IG2.

Also: IG, CIS implementation group

HRM-MEAS-15Measurement

How much more often a real incident follows a pattern, a cohort or a sequence, than the base rate across the workforce. Lift above 1 shows the pattern matters in this organization.

Also: lift, pattern lift, predictive lift

HRM-GOV-12Governance

The risk that a person with legitimate access misuses it on purpose. The taxonomy treats insider risk as a sibling discipline: its insider and privilege misuse breach scenario shares signals, while intent is handled by a separate program.

Also: insider threat, malicious insider, privilege misuse

HRM-INT-01Interventions

An action a program takes on a person, cohort or control because of measured risk: training, a nudge, coaching, a simulation, a control change. Interventions are logged so their effect can be measured.

Also: remediation, response, action

HRM-INT-09Interventions

Coaching delivered inside the workflow seconds after a risky action, explaining what happened and the safer step. It differs from a nudge by being tied to a specific detected event.

Also: real-time coaching, in-the-moment coaching, triggered coaching

HRM-MEAS-17Measurement

A metric with a threshold agreed by leadership that signals when human risk exceeds appetite. Key risk indicators are few, trended and reported to the board.

Also: KRI, board metric, risk indicator

HRM-GOV-14Governance

The managed set of awareness, role-based and reinforcement activities, with a strategic plan, an owner and a budget, that an organization runs to reduce risk through education. NIST calls the federal version a Cybersecurity and Privacy Learning Program.

Also: CPLP, training program, curriculum, security awareness program

HRM-MEAS-21Measurement

One of five levels in the Human Risk Management Maturity Model: Comply, Observe, Prioritize, Orchestrate and Preempt, each an active verb for what the program does with risk. Each practice is scored on the same five levels.

Also: level, tier, program maturity

HRM-INT-10Interventions

Training delivered in units of a few minutes, each on one behavior, spaced over time. The unit is small enough to attach to a nudge or a simulation result.

Also: micro-training, bite-sized training, spaced learning

HRM-INT-06Interventions

A simulation delivered by voice, SMS, QR code, collaboration chat or video. In the 2026 DBIR the median click rate in voice and text-message simulations was 40% higher than in email.

Also: vishing simulation, smishing simulation, QR simulation, quishing simulation, voice phishing test

HRM-GOV-08Governance

One of four NIST CSF 2.0 tiers, Partial, Risk Informed, Repeatable and Adaptive, that characterize the rigor of an organization's cybersecurity risk governance and management practices. NIST states that tiers are not maturity levels.

Also: CSF tier, CSF implementation tier

HRM-INT-14Interventions

A timed test of whether people report a suspicious event through the approved channel and how fast the report reaches the responders.

Also: reporting drill, escalation drill

HRM-INT-08Interventions

A short, targeted message that reinforces one security behavior at the moment it matters, sent through chat, email or the browser. Nudges are counted; their effect is read in the behavior that follows.

Also: behavioral nudge, policy nudge, prompt

HRM-MEAS-19Measurement

The share of people who say security controls get in the way of their work, measured by pulse survey. It is read beside policy exceptions and shadow IT measures.

Also: friction rate, control friction

HRM-GOV-03Governance

The rules for storing, showing and acting on risk data about named people: who may see a person's score, how long signals are kept, what managers see and what is shown only in aggregate.

Also: individual data governance, risk data governance, scoring governance

HRM-INT-05Interventions

A controlled, consented lure sent to the workforce to observe who clicks, submits, opens and reports. Results are signals per person; the channel (email, SMS, voice, QR, video) is an attribute of each simulation.

Also: simulated phishing, phishing test, simulation

HRM-MEAS-08Measurement

The share of the workforce whose primary sign-in uses a phishing-resistant factor such as a FIDO2 key or a platform passkey. Privileged accounts are reported separately.

Also: strong MFA coverage, passkey adoption, FIDO2 coverage

HRM-INT-18Interventions

A versioned definition of an automated intervention: the trigger signals or cohorts, the audience and the ordered actions. A playbook run is the unit of automated response the program counts.

Also: workflow, automation, orchestration rule

HRM-INT-12Interventions

A recorded confirmation that a person has read a security policy or a topic-specific policy, refreshed when the policy changes. It is an organization-level readiness signal.

Also: policy attestation, acceptable use acknowledgment

HRM-GOV-11Governance

An approved, time-bound departure from a security policy for a named person or system, with a reason and an end date. Exceptions past expiry and exception holders who click are readiness signals.

Also: waiver, policy waiver, exemption

HRM-MEAS-22Measurement

The weighted mean of a practice’s answered assessment questions on a 1.0 to 5.0 scale. The overall score is the weighted mean of the six practices, and the overall level is at most one level above the weakest practice.

Also: capability score, area score

HRM-INT-22Interventions

A visible acknowledgment of vigilant behavior: a thank-you for a report, a team leaderboard, a champion badge. Recognition reinforces the behavior it names.

Also: positive reinforcement, reward

HRM-MEAS-05Measurement

A person with three or more simulation clicks in 180 days. The repeat clicker rate is the share of the workforce that meets this rule.

Also: serial clicker, chronic clicker, repeat offender

HRM-MEAS-02Measurement

The share of delivered simulations that were reported through the approved channel. For real phishing, the share of targeted people who reported.

Also: reporting rate, phish report rate

HRM-MEAS-03Measurement

Reports divided by clicks across the same simulations in a period. Count every report of a simulated lure, divide by every click on one. A ratio above 1 means more reports than clicks.

Also: report/click ratio, reports per click

HRM-MEAS-04Measurement

People who reported a simulation divided by people who failed it, per simulation. Two other formulas circulate: engagement divided by failure, and reports divided by failures. The taxonomy uses reporters over failers and prints the formula beside the number.

Also: report-to-fail ratio, resilience rate

HRM-CORE-07Core concepts

The amount of human risk leadership agrees to accept, written as thresholds on key risk indicators. A program at the Preempt level reports whether each indicator sits inside its threshold.

Also: risk tolerance, tolerance threshold

HRM-GOV-05Governance

The line in the enterprise risk register that names human risk, its owner, its key risk indicators, current and target levels and the controls that treat it.

Also: enterprise risk entry, register line

HRM-CORE-08Core concepts

An observed action or omission that raises a person's exposure to a breach scenario: clicking a lure, reusing a password, moving data in bulk, disabling protection. Risky behavior signals carry the polarity 'risky'.

Also: insecure behavior, unsafe behavior, risky action, risky behaviour

HRM-CON-04Constructs

A cohort class built from two or more risky Behavior signals with no Threat or Access condition: people whose own repeated actions mark them out.

Also: high-risk users, riskiest users, risk concentration

HRM-INT-03Interventions

Training scoped to a defined work role and the risks that role carries: payment approvers, administrators, help-desk staff, developers. It starts by naming the roles and the people in them.

Also: role-specific training, specialized training

HRM-CORE-10Core concepts

A person's ability to recognize and avoid behaviors that could compromise cybersecurity and to act wisely and cautiously (NIST SP 800-50r1). Awareness is one input to human risk; a program that builds it is an awareness program.

Also: awareness, cyber hygiene, security literacy

HRM-INT-11Interventions

A network of volunteers across teams who model secure behavior, relay questions to the security team and localize guidance. Membership, activity and reach are program metrics.

Also: security ambassador program, ambassadors, evangelists, champions network

HRM-MEAS-18Measurement

A net promoter score for the security team: the share of the workforce who would recommend working with security minus the share who would not, measured by pulse survey.

Also: security net promoter score, security team NPS

HRM-TECH-08Technology

The cloud service that inspects web, SaaS and data traffic: web filtering, cloud access security broker and data loss prevention. It supplies shadow SaaS, shadow AI, OAuth and data movement telemetry.

Also: SSE, CASB, web proxy, SASE, DLP

HRM-CON-06Constructs

An ordered run of signals on one person across attack tactics inside a time window, from first contact to compromise evidence. A completed sequence moves the person to Stage 4 Suspected.

Also: attack sequence

HRM-TECH-10Technology

The security information and event management system, with its orchestration and ticketing, where incidents are opened, attributed and closed. It supplies the Confirmed stage and the incident data behind incident lift.

Also: security information and event management, SOAR, incident management

HRM-MEAS-14Measurement

The median time from a signal firing to the first intervention acting on it. It measures the program’s operating speed; the Orchestrate level expects it under 24 hours.

Also: time to action, response latency, mean time to intervene

HRM-GOV-07Governance

A table that maps each risk domain, signal and maturity level to NIST CSF 2.0, MITRE ATT&CK, CIS Controls v8.1, ISO/IEC 27001:2022 and CMMC 2.0, so a program can report in the language its auditor already uses.

Also: crosswalk, control mapping, framework alignment, lens

HRM-INT-16Interventions

A response that raises the authentication requirement for a person or session, such as requiring a phishing-resistant factor, because a risk signal fired.

Also: MFA step-up, risk-based authentication, forced re-authentication

HRM-INT-13Interventions

A facilitated walk-through of an incident scenario with the people who would respond, used to test decisions and hand-offs without touching systems.

Also: scenario exercise, response rehearsal

HRM-INT-20Interventions

A time-boxed set of interventions aimed at one cohort or risk domain, with a stated metric and a before-and-after reading.

Also: targeted intervention, focused campaign

HRM-CON-01Constructs

A cohort class that joins a risky Behavior signal with a Threat signal on the same person: someone attackers already reach who also shows the behavior the attack needs.

Also: B+T cohort, targeted people, highly targeted people

HRM-TECH-04Technology

The raw events a source emits about a subject: a login, a click, a block, a grant, a survey answer. Signals are computed from telemetry; telemetry itself is kept to the retention the data governance sets.

Also: events, event data, source events

HRM-GOV-13Governance

The risk that a vendor, partner or their software exposes the organization. It is a sibling discipline; the taxonomy keeps the person-side signals, such as vendor-exposed people and risky OAuth grants, in the Web, cloud and SaaS domain.

Also: supply chain risk, vendor risk, supplier risk

HRM-CORE-04Core concepts

The risk model behind the taxonomy. Threat is what reaches a person, Access is what the person could expose, Behavior is what the person does. Risk rises with the product of the three; vigilant behavior lowers it.

Also: T×A×B, three dimensions, risk-factor model, threat, vulnerability, privilege

HRM-MEAS-06Measurement

The median time from an event to the first report of it. For simulations it is measured in minutes from delivery; for real incidents, in hours from the event.

Also: time to first report, reporting latency, mean time to report

HRM-MEAS-07Measurement

The share of people in a scope who have completed the training their role requires inside its validity period. Role-based training currency covers sensitive roles.

Also: training completion, completion rate, currency

HRM-CORE-09Core concepts

An observed action that lowers a person's exposure: reporting a phish, declining a suspicious request, enrolling phishing-resistant MFA, asking security before building. Vigilant behavior signals carry the polarity 'vigilant' and step a person back one stage.

Also: secure behavior, protective behavior, positive behavior, vigilant behaviour

HRM-CON-05Constructs

A cohort class built from vigilant Behavior signals: people who report, decline and enroll strong controls. The program recognizes them and uses them as sensors and champions.

Also: human sensors, reporters

HRM-MEAS-09Measurement

A risk domain that no connected source measures today. It is shown as a gap, never as a failing grade, and the roadmap schedules the integration that closes it.

Also: blind spot, unmeasured domain, coverage gap

HRM-CORE-06Core concepts

Every identity that acts on an organization's systems and data: employees, contractors and AI agents. Each is a subject that can carry threat, access and behavior signals.

Also: hybrid workforce, blended workforce, personnel, people and agents