WCRisk domain
Web, cloud and SaaS
Web, cloud and SaaS covers browsing, SaaS use and third parties: malicious and unauthorized sites, web-filter bypass, shadow IT, risky OAuth grants, unvetted browser extensions, public Wi-Fi without a VPN and breached vendors. The domain carries the vendor subject: 28 library indicators describe third-party risk through the people exposed to it. An OAuth consent is the human act that gives a third party standing access. Threat includes lookalike domains registered against the brand.
Classification
- Dimensions Every signal answers one of 3 questions.
- Evidence levels
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- GV.SC-07
- PR.AA-05
- ID.AM-02
- DE.CM-06
- MITRE ATT&CK
-
- TA0001 Initial Access, TA0003 Persistence · T1199 Trusted Relationship, T1528 Steal Application Access Token, T1550 Use Alternate Authentication Material
Third-party involvement is a breach factor the Verizon DBIR reports on, and MITRE ATT&CK names the route Trusted Relationship (T1199). The consent screen is where a person hands a vendor standing access, so this domain is where supply-chain risk becomes personal.
Three dimensions in web, cloud and saas.
- Threat2 signals
- Threat is what reaches a person through the web and their vendors: lookalike domains registered against the brand and a breach at a third-party app they use.
- Access1 signals
- Access is ownership of third-party integrations and OAuth apps, which gives a person's consent the reach of a standing entitlement.
- Behavior9 signals
- Behavior is where a person goes and what they connect: visiting malicious or unauthorized sites, bypassing web filtering, granting risky OAuth permissions, using unauthorized SaaS, installing unvetted extensions and using public Wi-Fi without a VPN on the risky side; downloading only from trusted sources and revoking their own unused app grants on the vigilant side.
Signals
12 signalsScroll sideways to see every column.
| ID | Signal | Dimension | Polarity | Source |
|---|---|---|---|---|
| WC-T-01 | Lookalike domains registered against the brand | Threat | Neutral | EXPO |
| WC-T-02 | Third-party app they use was breached | Threat | Neutral | SSE |
| WC-A-01 | Owns third-party integrations or OAuth apps | Access | Neutral | IGA |
| WC-B-01 | Visits known-malicious websites | Behavior | Risky | SSE |
| WC-B-02 | Bypasses web filtering | Behavior | Risky | SSE |
| WC-B-03 | Visits unauthorized websites | Behavior | Risky | SSE |
| WC-B-04 | Grants risky OAuth permissions | Behavior | Risky | SSE |
| WC-B-05 | Uses unauthorized SaaS apps | Behavior | Risky | SSE |
| WC-B-06 | Installs unvetted browser extensions | Behavior | Risky | SSE |
| WC-B-07 | Uses public Wi-Fi without VPN | Behavior | Risky | MDM |
| WC-B-08 | Downloads from trusted sources only | Behavior | Vigilant | SSE |
| WC-B-09 | Reviews and revokes own app grants | Behavior | Vigilant | IGA |
Headline metrics and grade bands
3 metricsA to F bands for the numbers a program reports in this domain. Bands marked "framework benchmark" are authored targets until the HRM Benchmark publishes measured values.
Scroll sideways to see every band.
| Metric | Unit | A | B | C | D | Anchor |
|---|---|---|---|---|---|---|
| M-WC-1Risky OAuth grants | % of people with an unresolved high-risk third-party grant | ≤ 0 | ≤ 1 | ≤ 3 | ≤ 7 | DBIR 2026 third-party involvement |
| M-WC-2Unsanctioned apps with corporate data | % of people using unsanctioned high-risk SaaS | ≤ 5 | ≤ 10 | ≤ 20 | ≤ 35 | Framework benchmark |
| M-WC-3Vendor-exposed people | % of people whose accounts sit with a breached vendor, unrotated | ≤ 0 | ≤ 2 | ≤ 5 | ≤ 10 | DBIR 2026 third-party involvement |
Indicator library
69 indicators- I.0102Installs personal cloud backup tools on enterprise devices
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0125Attempts unauthorized privilege escalation in cloud apps
- I.0129Accesses SaaS apps only from managed devices
- I.0131Stores sensitive documents only in approved cloud platforms
- I.0133Uses browser extensions only from approved list
- I.0135Logs out of sensitive applications after use
- I.0137Avoids repeated access attempts to restricted cloud content
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0171Uses multiple cloud services with overlapping functionality
- I.0174Uses only approved SaaS platforms
- I.0175Reports suspicious browser activity
- I.0176Reports unauthorized or unknown SaaS applications
- I.0178Submits help desk tickets for blocked or restricted services
- I.0180Downloads documents from unrecognized cloud platforms
- I.0181Browses websites in approved safe categories
- I.0182Uses cloud collaboration tools only during business hours
- I.0384Violates security contract clauses
- I.0385Fails to meet security standards
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0392Has history of security breaches
- I.0393Lacks continuous security monitoring
- I.0394Supplies or operates vulnerable software or platforms
- I.0395Lacks secure development practices
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0400Lacks monitoring of insider activity
- I.0401Fails to report employee departures
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
- I.0406Lacks audit trail for data access
- I.0407Fails to appropriately manage shadow IT use
- I.0408Maintains third-party RBAC controls
- I.0409Conducts regular and timely audits
- I.0410Requires use of organization-managed devices
- I.0411Meets contractual compliance obligations
Cohorts in this domain
1Sequences that start here
1Cite this term
"Web, cloud and SaaS" (WC), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/domains/web-cloud-and-saas
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.