Practice 01 of 6Scored 1 to 54 questions in the assessment
See
Which signals can you see, for whom, and how fresh are they?
See is the practice of collecting signals about threat (what reaches a person), access (what a person could expose) and behavior (what a person does), per person and per AI agent, across the nine risk domains, with a known source and refresh date for each.
Why it matters
See, in practice.
Every later practice depends on what the program can see. A program that sees only simulation clicks can target only clickers; a program that sees who attackers target, who holds sensitive access and who reports can find the people where the three meet. Freshness counts as much as coverage: a signal from a monthly extract cannot interrupt a sequence with a 72-hour window.
The five levels
The five levels of See.
Each level with its criteria, the evidence to ask for and what moves the practice to the next one.
-
Level 1
Comply
One source, two numbers: training completion and simulation clicks.
- Training completion and phishing simulation click rate are the only numbers the program collects.
- All data comes from one platform: the awareness and simulation tool.
- Who holds privileged or sensitive access is unknown to the program, or lives in a spreadsheet that is rarely refreshed.
- Real attack targeting data from email security never reaches the program.
Evidence to ask for
The latest program report · The list of data sources the program reads
What moves you to level 2
- Count reported simulations and reported real emails per person.
- Pull MFA enrollment per person from the identity provider.
- Ask email security for a monthly list of targeted people.
- Record the source and refresh date of every number the program reports.
-
Level 2
Observe
Behaviors from two or more domains, reporting counted, scorecards per team.
- Reported simulations and reported real emails are counted per person and per team.
- Behaviors from at least two risk domains are measured, for example simulation clicks and MFA enrollment.
- Privileged and sensitive access is listed from directory groups and refreshed at least quarterly.
- Every reported number has a named source and a refresh date.
Evidence to ask for
A per-team behavior scorecard with its refresh date · The directory export of privileged accounts with the date it was pulled · The source inventory with refresh cadence
What moves you to level 3
- Connect email security so real phishing targeting is known per person.
- Join every source on the HR system’s person identifier.
- Sync privileged accounts from the identity provider on a schedule.
- Add a third and a fourth domain, for example endpoint and data handling.
-
Level 3
Prioritize
Threat, access and behavior joined per person across four or more domains.
- Threat, access and behavior signals are joined per person on one identifier from the HR system.
- Phishing simulation results are joined to real-phishing targeting data per person.
- Signals cover at least four risk domains, including social engineering and identity and access.
- Each signal has a dwell window, and a source silent for more than seven days marks its signals unknown.
Evidence to ask for
A per-person record that shows threat, access and behavior fields side by side · The signal list with source and dwell window per signal · The staleness report for the last 30 days
What moves you to level 4
- Connect endpoint, web and SaaS, and data sources to reach five or more domains.
- Move the top sources from monthly extracts to daily feeds.
- Add breach-exposure data so leaked credentials are known per person.
- Measure AI tool use per person, including personal-account logins.
-
Level 4
Orchestrate
Daily signals from five or more domains, sequences detected, AI use and AI agents in view.
- Signals from five or more risk domains refresh at least daily.
- Ordered signal sequences, for example real phish delivered, link clicked, new MFA device inside 72 hours, are detected inside their window.
- AI tool use per person is measured, split by corporate and personal accounts.
- AI agents and service identities are inventoried with a named human owner and their scopes.
Evidence to ask for
The sequence detection list with window and last firing date · The AI use report by team · The agent inventory with owner, scopes and last attestation date
What moves you to level 5
- Put people, AI agents and vendor accounts on one subject record with the same fields.
- Tie vendor breaches to the people whose accounts are exposed.
- Report signal freshness as a key risk indicator with a target.
- Publish the list of signals no source measures, with a target date for each.
-
Level 5
Preempt
Every subject on one record, all nine domains live, gaps and freshness reported.
- People, AI agents and vendor accounts sit on one per-subject record with the same threat, access and behavior fields.
- All nine risk domains have at least one live signal, and every unmeasured signal is listed as a visibility gap with an owner and a target date.
- Signal freshness is reported as a key risk indicator against a target the program set.
- A standing process adds a source when a gap is opened and retires a source that no longer moves a decision.
Evidence to ask for
The visibility-gap list with owners and target dates · The freshness KRI on the latest board report · A per-agent record with owner, scope and last action
How to hold level 5
- Re-test join quality each quarter: duplicate identities, orphaned agents, unmatched vendor accounts.
- Retire sources that fed no decision in the last two quarters.
Playbooks
Playbooks for See (14).
The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.
Scroll sideways to see every column.
| From level | Playbook | Owner | Weeks | Difficulty | Measure |
|---|---|---|---|---|---|
| 1 | Count reported simulations per person Add report-button data to the program export and count reports per person next to clicks. Reporting is the first vigilant behavior and it costs nothing to collect. | Security awareness lead | 1–2 | Easy | Report rate per person and per team |
| 1 | Ask email security for the monthly targeting report Request a monthly export of who received real phishing and impersonation attempts. It shows which people attackers pick before any connector exists. | SOC | 2–4 | Easy | Targeted people listed by name each month |
| 1 | Inventory every data source and its refresh date List each number the program reports, its source, its owner and the date it was last refreshed. The list is the baseline the next three levels build on. | Security awareness lead | 5–8 | Medium | Sources listed with owner and refresh date |
| 2 | Pull MFA enrollment per person from the identity provider Export the MFA method per person and join it to the behavior scorecard. Weak MFA is the access signal that turns a click into a takeover. | Identity team | 1–3 | Easy | Share of the workforce on phishing-resistant MFA |
| 2 | Join real phishing telemetry to simulation results Connect email security so delivered and reported real phish sit per person next to simulation results. The join shows the report rate against real attacks. | SOC | 5–12 | Hard | Real-phishing report rate among targeted people |
| 2 | Use the HR system as the person identifier Map every source to the HR employee identifier so each person has one record. Every later join depends on this spine. | HR business partner | 5–9 | Medium | Share of records matched to one HR identifier |
| 3 | Set a dwell window and a staleness flag per signal Give each signal a window (threat 90 days, simulated behavior 180 days, real interaction 30 days) and flag any source silent for seven days. Stale signals put people at the wrong stage. | Security awareness lead | 1–3 | Easy | Share of signals with a window and a freshness flag |
| 3 | Connect endpoint protection to the person record Bring tampering, malware and patch events in and attribute each one to the device owner. Endpoint is the fourth domain and the first step of the ransomware sequence. | SOC | 5–13 | Hard | Endpoint signals attributed to a named owner |
| 3 | Connect breach-exposure data for leaked credentials Feed leaked-credential and dark-web exposure per person into the record and open a ticket for each new hit. An exposed credential is a threat signal with a deadline. | Identity team | 6–10 | Medium | Exposed credentials resolved inside the target window |
| 4 | Measure AI tool use and personal-account logins Use web and SaaS logs to count AI tool use per person, split by corporate and personal accounts. Shadow AI share is the first AI use signal and it needs no new tool. | Security awareness lead | 1–4 | Easy | Shadow AI share by team |
| 4 | Inventory AI agents and service identities with owners List every agent and service identity, its human owner and its scopes from the entitlement system. An agent with no owner cannot be governed or paused. | Identity team | 5–9 | Medium | Share of agents with a current named owner |
| 4 | Move the top sources to daily feeds Replace monthly extracts from the top five sources with daily feeds through the SIEM or an API. A sequence with a 72-hour window is invisible in monthly data. | SOC | 6–13 | Hard | Median signal age in hours |
| 5 | Publish the visibility-gap list with target dates List every signal no source measures and give each a target date and an owner. A gap is risk nobody can see, and a dated list keeps it on the agenda. | CISO | 1–2 | Easy | Open visibility gaps with a dated owner |
| 5 | Put people, agents and vendors on one subject record Extend the person record so AI agents and vendor accounts carry the same threat, access and behavior fields. One model lets the SOC compare a runaway agent with a compromised person. | Identity team | 5–13 | Hard | Subjects of all four types on one record |
"See: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/see
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4