A 90-day roadmap,71 playbooks.

Count reported simulations per person

Add report-button data to the program export and count reports per person next to clicks. Reporting is the first vigilant behavior and it costs nothing to collect.

List repeat clickers by name

Pull people with three or more clicks in 180 days from the simulation platform. The list is the first cohort the program can act on.

Send a nudge inside 24 hours of a simulation click

Replace the remedial module with a short nudge delivered the same day. Timing changes behavior more than length does.

Publish the report-to-click ratio

Report reports divided by clicks per simulation, next to completion. The ratio is the first number that shows vigilance.

Write a one-page program charter

Name the owner, scope, partners, reporting cadence and the decisions the program can make. A charter is the first governance artifact anyone will ask for.

Count reports of suspicious activity each month

Count every report from the button, the help desk and email, and publish the number. What gets counted gets noticed.

Ask email security for the monthly targeting report

Request a monthly export of who received real phishing and impersonation attempts. It shows which people attackers pick before any connector exists.

Inventory every data source and its refresh date

List each number the program reports, its source, its owner and the date it was last refreshed. The list is the baseline the next three levels build on.

Ask the SOC for last year’s human-related incidents

Get the count of incidents by type where a person’s action was a step, over the last 12 months. The count ranks which breach scenarios matter in this organization.

Agree a manual MFA reset path with the identity team

Write the steps the program follows when a person is confirmed compromised: who requests, who resets, inside what time. The first control change starts as a documented manual request.

Send a one-page quarterly report to the CISO

Put four numbers, one trend and one decision needed on a page each quarter. The reporting habit creates the demand for better numbers.

Publish an AI acceptable-use policy

State which tools are sanctioned, what data may never enter a prompt, and how to request a new tool. A policy makes shadow AI measurable.

Open a help-before-you-build channel

Give people one place to ask security a question and log each request. Requests are the first culture signal a program can count.

Pull MFA enrollment per person from the identity provider

Export the MFA method per person and join it to the behavior scorecard. Weak MFA is the access signal that turns a click into a takeover.

Define three two-signal cohorts

Name cohorts that combine signals: targeted people who click, risky people with payment authority, and non-reporters in finance. A cohort is a population you can count and act on.

Write the first three playbooks

Document trigger, audience, action, owner and time limit for repeat clickers, weak-MFA privileged users and leavers. A written playbook is what gets automated later.

Set a target for each cohort and report against it

Agree with the CISO a target size for repeat clickers and weak-MFA privileged users and show progress each quarter. A number with no target is trivia.

Give every policy exception an expiry date

Record exceptions in the ticket system with an end date and an owner. An expired exception is risk with no owner.

Run a three-question culture pulse

Ask security NPS, perceived friction and confidence each quarter. Three questions get answered every quarter.

Use the HR system as the person identifier

Map every source to the HR employee identifier so each person has one record. Every later join depends on this spine.

Rank breach scenarios by your own incidents

Score the ten breach scenarios by last year’s incident counts and losses, and publish the top three. Priorities set from your own data survive a budget review.

Start a monthly incident review with the SOC

Review every human-related incident of the month and record which signal could have shown it earlier. Each review adds one candidate cohort or sequence.

Target repeat clickers and the Critical cohort

Aim simulations and coaching at people who are targeted, click and hold sensitive access, and shrink the whole-workforce schedule. Effort goes where risk concentrates.

Report stage 3+ people per priority breach scenario

Add the count and trend of people at stage 3 or above for each priority breach scenario. The count links the program to breach scenarios.

Start a monthly review with the SOC, IT and HR

Review cohorts, decisions and blocked actions with minutes. Decisions need the partners in the room who can carry them out.

Stand up security champions in each business unit

Name a champion per unit, give them a monthly brief and a channel to security. Champions carry the program where email cannot.

Recognize people who report real phishing

Thank reporters the same day and name the top reporting teams each month. Recognition raises the report rate faster than reminders do.

Add voice, SMS and QR lures to the simulation mix

Run simulations on the channels attackers use beyond email. Per-channel results show where people are untested.

Map program metrics to the control framework

Tie each reported metric to a NIST CSF 2.0 outcome or to the framework the organization follows. The map lets GRC and audit reuse the program’s numbers.

Join real phishing telemetry to simulation results

Connect email security so delivered and reported real phish sit per person next to simulation results. The join shows the report rate against real attacks.

Set a dwell window and a staleness flag per signal

Give each signal a window (threat 90 days, simulated behavior 180 days, real interaction 30 days) and flag any source silent for seven days. Stale signals put people at the wrong stage.

Compute a stage per person from active signals

Place each person on the road from Clear to Confirmed by the furthest active signal. One number per person makes the cohort review fast.

Measure time from signal to action per playbook

Timestamp each trigger and each completed action, and publish the median per playbook. The median is the number that proves playbooks run.

Compute training hours saved by targeting

Compare hours delivered under the targeted schedule with the old whole-workforce schedule. Saved hours is a number the CFO reads.

Require a named human owner for every AI agent

Add owner, scope and retirement date as required fields for any agent or service identity. Ownership is the base of agent governance.

Measure the confidence-ability gap

Compare self-rated ability from the pulse with simulation results per team. Overconfident teams are the coaching target.

Give the review decision rights over controls

Agree in writing which MFA, access and DLP changes the program may trigger and which need IT or HR sign-off. Decision rights turn playbooks into action.

Join pulse results to behavior per team

Put friction and NPS next to reporting and click rates for each team. Teams with high friction and low reporting are where culture work goes first.

Connect breach-exposure data for leaked credentials

Feed leaked-credential and dark-web exposure per person into the record and open a ticket for each new hit. An exposed credential is a threat signal with a deadline.

Add AI use and AI agent cohorts

Define cohorts for sensitive data in prompts, personal-account AI use, and agents with broad scopes and no logging. AI risk needs the same cohort logic as people.

Add a playbook for sensitive data in AI prompts

Trigger coaching and a policy reminder when inspection finds sensitive data in a prompt, and route repeats to the manager. AI use needs a response path like any other risky behavior.

Connect endpoint protection to the person record

Bring tampering, malware and patch events in and attribute each one to the device owner. Endpoint is the fourth domain and the first step of the ransomware sequence.

Define sequences for the top three breach scenarios

Write ordered signal sequences with windows, for example phish delivered, link clicked, unusual sign-in, new MFA device inside 72 hours. A completed sequence is the earliest incident warning you have.

Automate the two highest-volume playbooks

Connect trigger to action for the two playbooks with the most runs, for example step-up MFA for stage 3 people and an access review for leavers. Automation removes the queue between signal and action.

Report incident lift and avoided incidents

Publish lift per pattern and the incidents avoided where sequences were interrupted. Avoided incidents is the proof of risk reduction.

Measure AI tool use and personal-account logins

Use web and SaaS logs to count AI tool use per person, split by corporate and personal accounts. Shadow AI share is the first AI use signal and it needs no new tool.

Write a reversal rule for every automated action

State who can reverse each automated action, how, and inside what time. Reversal is what makes automation acceptable to IT and HR.

File a privacy review for each automated action

Record the lawful basis, the data used and the works-council or employee notice for each automated action. The file keeps automation running when HR or legal asks.

Publish role-based AI guidance for three teams

Write one page each for developers, finance and customer-facing teams on which AI use is sanctioned and how to check an output. Role guidance gets read; a generic policy gets filed.

Retire cohorts with no lift

Drop cohorts and sequences with no measured lift after two quarters and record why. Fewer, proven patterns keep the SOC’s attention.

Draft five board KRIs with thresholds

Pick five numbers (stage 3+ share, time to action, report rate, phishing-resistant MFA, agents with owners) and propose a threshold for each. The draft starts the risk appetite conversation.

Inventory AI agents and service identities with owners

List every agent and service identity, its human owner and its scopes from the entitlement system. An agent with no owner cannot be governed or paused.

Measure incident lift per cohort and sequence

Compare the incident rate inside each cohort with the rest of the workforce over 12 months. Lift proves which patterns matter here and which are folklore.

Estimate avoided loss with a method finance agreed

Multiply avoided incidents by the loss range per breach scenario and publish the method with the number. An agreed method beats a big number.

Write the human risk appetite statement

State the tolerated level per KRI and the escalation when it is crossed. Risk appetite is what the board can govern.

Co-create the next policy with employee feedback

Draft the policy with champions, run it past the teams it affects and record the changes. People follow policies they helped shape.

Pause out-of-scope AI agents by playbook

Alert on agent actions outside the declared scope, pause the agent and notify its owner. A runaway agent needs the same response speed as a compromised account.

Interrupt the phish-to-takeover sequence at step three

Trigger step-up MFA and session revocation when a sequence reaches the unusual sign-in step. The sequence ends before persistence.

Move the top sources to daily feeds

Replace monthly extracts from the top five sources with daily feeds through the SIEM or an API. A sequence with a 72-hour window is invisible in monthly data.

Publish the visibility-gap list with target dates

List every signal no source measures and give each a target date and an owner. A gap is risk nobody can see, and a dated list keeps it on the agenda.

Agree a loss range per priority breach scenario with finance

Set a loss range per breach scenario with finance and a risk appetite threshold with the board owner. The ranges turn stage counts into money the board can govern.

Review reversal and false-positive rates each quarter

Count reversed actions and complaints per playbook and tune the thresholds. Automation that annoys people loses its mandate.

Have internal audit review the measurement method

Hand the method, data lineage and model change log to internal audit. Independent review keeps the board’s trust in the numbers.

Name the board owner of the human risk KRIs

Agree which board member or committee reviews the KRIs each quarter and record it in the committee’s terms of reference. A named owner makes the KRIs real.

Report executives their own security behaviors

Show each executive their MFA, reporting and simulation results each quarter. Leaders change what they can see.

Report human risk reduction over 6, 12 and 24 months

Publish the index change over three horizons with the model version used. Long horizons show whether gains hold.

Report culture KRIs to the board inside appetite

Add security NPS, perceived friction and time to report as board KRIs with thresholds. Culture becomes a risk measure the board reviews.

Put people, agents and vendors on one subject record

Extend the person record so AI agents and vendor accounts carry the same threat, access and behavior fields. One model lets the SOC compare a runaway agent with a compromised person.

Forecast next quarter’s stage 3+ population

Project the stage 3+ population per priority breach scenario from trend and planned actions, and record the forecast error each quarter. Forecast error is how the program learns whether its model works.

Tie standing access to stage

Let stage drive entitlement: stage 3+ people lose standing privilege inside the window set, and regain it when the stage drops. Access that follows risk closes the insider and takeover sequences.

Commission an annual independent review

Have internal audit or a third party review the model, the automation and the privacy controls each year. Review is the price of automation at scale.