Practice 02 of 6Scored 1 to 53 questions in the assessment
Understand
How do you decide who needs attention, and what tells you the decision was right?
Understand is the practice of turning signals into priorities: scoring people and AI agents, naming cohorts where threat, access and behavior meet, detecting sequences, and ranking breach scenarios by the organization’s own incidents.
Why it matters
Understand, in practice.
Signals alone are a list. Risk concentrates in a small share of people and agents, and the program that knows who they are can spend its effort there. Incident data from the SOC tells the program which patterns matter in this organization, and incident lift tells it whether the priorities were right.
The five levels
The five levels of Understand.
Each level with its criteria, the evidence to ask for and what moves the practice to the next one.
-
Level 1
Comply
Organization-wide averages; everyone gets the same attention.
- Results are reported as organization-wide averages.
- Every person receives the same training and simulation schedule.
- No person, team or cohort is ranked by risk.
- SOC incidents play no part in setting the program’s priorities.
Evidence to ask for
The latest program report · The training and simulation schedule
What moves you to level 2
- Compute a per-person and per-team score from simulation and reporting results.
- List repeat clickers (three or more clicks in 180 days) by name.
- Ask the SOC for the count of human-related incidents by type over the last 12 months.
-
Level 2
Observe
Scorecards per person and team; repeat clickers named; incidents shared after major events.
- Each person and team has a behavior scorecard refreshed on a fixed cadence.
- Repeat clickers and non-reporters are listed as named groups.
- Priorities are set from simulation results and report rates.
- The SOC shares human-related incidents with the program after major events.
Evidence to ask for
A team scorecard · The repeat clicker list with dates · The last incident summary the SOC shared
What moves you to level 3
- Define cohorts that combine two signals, for example targeted people who click, or risky people who hold payment authority.
- Rank the breach scenarios by last year’s incident counts.
- Agree a monthly review of human-related incidents with the SOC.
-
Level 3
Prioritize
Cohorts across threat, access and behavior; breach scenarios ranked by own incidents; a stage per person.
- Cohorts that combine threat, access and behavior, for example targeted people who click and hold payment authority, are named, counted and trended.
- Breach scenarios are ranked by the organization’s own incident counts from the last 12 months.
- Each person has a stage from Clear to Confirmed, computed from their active signals.
- The riskiest cohorts are reviewed with the SOC on a fixed cadence.
Evidence to ask for
The cohort list with current size and trend · The breach scenario ranking with SOC incident counts · The stage distribution for the workforce
What moves you to level 4
- Define sequences (ordered signals inside a window) for the top three breach scenarios.
- Measure incident lift: the incident rate inside a cohort against the rest of the workforce.
- Add AI use and AI agent cohorts next to people cohorts.
-
Level 4
Orchestrate
Incident lift validates patterns; sequences detected and routed; AI cohorts ranked with people.
- Incident lift is measured for each cohort and sequence: the incident rate inside against the rest of the workforce.
- Cohorts and sequences with no lift after two quarters are retired, and new ones are proposed from incident reviews.
- A detected sequence is routed to the SOC with the person’s context inside its window.
- AI use and AI agent cohorts are ranked alongside people cohorts.
Evidence to ask for
The lift table for the last four quarters · The sequence detection log · The list of retired and new cohorts with reasons
What moves you to level 5
- Forecast next quarter’s stage 3+ population per priority breach scenario and record the forecast error.
- Agree a loss estimate per priority breach scenario with finance.
- Score AI agents on the same stages as people.
-
Level 5
Preempt
Forecasts with recorded error; people and agents on one model; loss and appetite per breach scenario.
- The program forecasts the stage 3+ population per priority breach scenario for the next quarter and records the forecast error.
- People and AI agents are scored on one model with the same stages and the same dimensions.
- Every priority breach scenario has a loss estimate agreed with finance and a risk appetite threshold approved by the board owner.
- Model changes are versioned, and the SOC reviews them each quarter.
Evidence to ask for
Forecast against actual for the last four quarters · The model change log · The risk appetite statement with thresholds per breach scenario
How to hold level 5
- Publish forecast error each quarter and retire predictors that stopped working.
- Re-validate loss estimates with finance each year.
Playbooks
Playbooks for Understand (12).
The assessment picks from these for your 90-day roadmap, by your current level. Each playbook is Easy, Medium or Hard; a quick win is an Easy playbook.
Scroll sideways to see every column.
| From level | Playbook | Owner | Weeks | Difficulty | Measure |
|---|---|---|---|---|---|
| 1 | List repeat clickers by name Pull people with three or more clicks in 180 days from the simulation platform. The list is the first cohort the program can act on. | Security awareness lead | 1–2 | Easy | Repeat clickers as a share of the workforce |
| 1 | Ask the SOC for last year’s human-related incidents Get the count of incidents by type where a person’s action was a step, over the last 12 months. The count ranks which breach scenarios matter in this organization. | SOC | 5–8 | Medium | Incidents by breach scenario for the last 12 months |
| 2 | Define three two-signal cohorts Name cohorts that combine signals: targeted people who click, risky people with payment authority, and non-reporters in finance. A cohort is a population you can count and act on. | Security awareness lead | 1–4 | Easy | Cohorts defined, counted and trended |
| 2 | Rank breach scenarios by your own incidents Score the ten breach scenarios by last year’s incident counts and losses, and publish the top three. Priorities set from your own data survive a budget review. | CISO | 5–8 | Medium | Breach scenarios ranked with incident counts |
| 2 | Start a monthly incident review with the SOC Review every human-related incident of the month and record which signal could have shown it earlier. Each review adds one candidate cohort or sequence. | SOC | 5–7 | Medium | Reviews held with candidate patterns recorded |
| 3 | Compute a stage per person from active signals Place each person on the road from Clear to Confirmed by the furthest active signal. One number per person makes the cohort review fast. | Security awareness lead | 1–3 | Easy | Stage 3+ people per priority breach scenario |
| 3 | Define sequences for the top three breach scenarios Write ordered signal sequences with windows, for example phish delivered, link clicked, unusual sign-in, new MFA device inside 72 hours. A completed sequence is the earliest incident warning you have. | SOC | 5–13 | Hard | Sequences defined and firing inside their windows |
| 3 | Add AI use and AI agent cohorts Define cohorts for sensitive data in prompts, personal-account AI use, and agents with broad scopes and no logging. AI risk needs the same cohort logic as people. | GRC lead | 6–10 | Medium | AI cohorts counted next to people cohorts |
| 4 | Measure incident lift per cohort and sequence Compare the incident rate inside each cohort with the rest of the workforce over 12 months. Lift proves which patterns matter here and which are folklore. | SOC | 5–9 | Medium | Incident lift for the top five patterns |
| 4 | Retire cohorts with no lift Drop cohorts and sequences with no measured lift after two quarters and record why. Fewer, proven patterns keep the SOC’s attention. | CISO | 2–4 | Easy | Cohorts retired or re-scoped each quarter |
| 5 | Forecast next quarter’s stage 3+ population Project the stage 3+ population per priority breach scenario from trend and planned actions, and record the forecast error each quarter. Forecast error is how the program learns whether its model works. | CISO | 5–13 | Hard | Forecast error per priority breach scenario |
| 5 | Agree a loss range per priority breach scenario with finance Set a loss range per breach scenario with finance and a risk appetite threshold with the board owner. The ranges turn stage counts into money the board can govern. | CISO | 1–4 | Easy | Priority breach scenarios with an agreed loss range |
"Understand: the practice", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/understand
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4