Level 4 · Breach scenarios10 breach scenarios6 reached by a sequence
Breach scenarios.The incidents they lead to.
The 10 breach scenarios the taxonomy measures toward, each anchored to a Verizon DBIR, VERIS or FBI IC3 category. Red lines are the sequences that end in each one; grey lines are the cohorts that predict it.
-
HB-01DBIR pattern: Social Engineering · VERIS: Social
Phishing & social engineering
No sequence ends here; 6 cohorts predict it.
- Sequences
- 0
- Cohorts
- 6
- Signals
- 42
-
HB-02DBIR: Basic Web Application Attacks · VERIS: Hacking
Credential abuse & account takeover
Sequences Phish to takeover, Leak to login, MFA fatigue, Help-desk takeover
- Sequences
- 4
- Cohorts
- 7
- Signals
- 46
-
HB-03DBIR: System Intrusion · VERIS: Malware
Ransomware & malware intrusion
Sequences Click to execution, Stealer to ransomware
- Sequences
- 2
- Cohorts
- 4
- Signals
- 31
-
HB-04DBIR: System Intrusion · VERIS: Hacking
Vulnerability exploitation
No sequence ends here; 3 cohorts predict it.
- Sequences
- 0
- Cohorts
- 3
- Signals
- 7
-
- Sequences
- 1
- Cohorts
- 1
- Signals
- 11
-
HB-06DBIR: Miscellaneous Errors · VERIS: Error
Data mishandling & error
No sequence ends here; 1 cohort predicts it.
- Sequences
- 0
- Cohorts
- 1
- Signals
- 29
-
HB-07DBIR: Privilege Misuse · VERIS: Misuse
Insider & privilege misuse
Sequences Quiet exit, Dormant to dangerous
- Sequences
- 2
- Cohorts
- 6
- Signals
- 20
-
HB-08DBIR third-party involvement · ATT&CK Trusted Relationship
Third-party, OAuth & supply chain
Sequences Consent to compromise
- Sequences
- 1
- Cohorts
- 3
- Signals
- 18
-
- Sequences
- 1
- Cohorts
- 3
- Signals
- 18
-
HB-10DBIR: Lost and Stolen Assets · VERIS: Physical
Lost & stolen devices
No sequence or cohort ends here; 15 signals feed it.
- Sequences
- 0
- Cohorts
- 0
- Signals
- 15
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.