{"name":"Human Risk Management Framework","version":"2.0.0","released":"2026-10-29","license":"CC BY 4.0","counts":{"signals":137,"cohorts":24,"paths":11,"outcomes":10},"domains":[{"id":"SE","name":"Social engineering","slug":"social-engineering","path":"/taxonomy/domains/social-engineering"},{"id":"IA","name":"Identity and access","slug":"identity-and-access","path":"/taxonomy/domains/identity-and-access"},{"id":"DH","name":"Data handling","slug":"data-handling","path":"/taxonomy/domains/data-handling"},{"id":"EP","name":"Endpoint and device","slug":"endpoint-and-device","path":"/taxonomy/domains/endpoint-and-device"},{"id":"WC","name":"Web, cloud and SaaS","slug":"web-cloud-and-saas","path":"/taxonomy/domains/web-cloud-and-saas"},{"id":"AU","name":"AI use","slug":"ai-use","path":"/taxonomy/domains/ai-use"},{"id":"AG","name":"AI agents","slug":"ai-agents","path":"/taxonomy/domains/ai-agents"},{"id":"SC","name":"Security culture","slug":"security-culture","path":"/taxonomy/domains/security-culture"},{"id":"RR","name":"Readiness and response","slug":"readiness-and-response","path":"/taxonomy/domains/readiness-and-response"}],"dimensions":[{"id":"T","name":"Threat","slug":"threat","path":"/taxonomy/dimensions/threat"},{"id":"A","name":"Access","slug":"access","path":"/taxonomy/dimensions/access"},{"id":"B","name":"Behavior","slug":"behavior","path":"/taxonomy/dimensions/behavior"}],"subjects":[{"id":"person","name":"Person","slug":"person","path":"/taxonomy/subjects/person"},{"id":"agent","name":"AI agent","slug":"ai-agent","path":"/taxonomy/subjects/ai-agent"},{"id":"vendor","name":"Vendor","slug":"vendor","path":"/taxonomy/subjects/vendor"},{"id":"organization","name":"Organization","slug":"organization","path":"/taxonomy/subjects/organization"}],"sources":[{"id":"SAT","name":"Awareness & phishing simulation","slug":"awareness-and-phishing-simulation","path":"/taxonomy/sources/awareness-and-phishing-simulation"},{"id":"IDP","name":"Identity provider & MFA","slug":"identity-provider-and-mfa","path":"/taxonomy/sources/identity-provider-and-mfa"},{"id":"EMAIL","name":"Email security","slug":"email-security","path":"/taxonomy/sources/email-security"},{"id":"EDR","name":"Endpoint protection","slug":"endpoint-protection","path":"/taxonomy/sources/endpoint-protection"},{"id":"SSE","name":"Web, CASB & DLP","slug":"web-casb-and-dlp","path":"/taxonomy/sources/web-casb-and-dlp"},{"id":"HRIS","name":"HR system","slug":"hr-system","path":"/taxonomy/sources/hr-system"},{"id":"IGA","name":"IGA, PAM & entitlements","slug":"iga-pam-and-entitlements","path":"/taxonomy/sources/iga-pam-and-entitlements"},{"id":"SIEM","name":"SIEM, SOAR & incident tickets","slug":"siem-soar-and-incident-tickets","path":"/taxonomy/sources/siem-soar-and-incident-tickets"},{"id":"EXPO","name":"Breach & dark-web exposure","slug":"breach-and-dark-web-exposure","path":"/taxonomy/sources/breach-and-dark-web-exposure"},{"id":"VULN","name":"Vulnerability management","slug":"vulnerability-management","path":"/taxonomy/sources/vulnerability-management"},{"id":"DATA","name":"Data security posture","slug":"data-security-posture","path":"/taxonomy/sources/data-security-posture"},{"id":"ITSM","name":"IT service management","slug":"it-service-management","path":"/taxonomy/sources/it-service-management"},{"id":"ERP","name":"Finance & payments","slug":"finance-and-payments","path":"/taxonomy/sources/finance-and-payments"},{"id":"MDM","name":"Device management (MDM/UEM)","slug":"device-management-mdm-uem","path":"/taxonomy/sources/device-management-mdm-uem"},{"id":"PHYS","name":"Badge & physical access","slug":"badge-and-physical-access","path":"/taxonomy/sources/badge-and-physical-access"},{"id":"SURVEY","name":"Pulse survey","slug":"pulse-survey","path":"/taxonomy/sources/pulse-survey"},{"id":"HELP","name":"Help desk","slug":"help-desk","path":"/taxonomy/sources/help-desk"}],"stages":[{"id":0,"name":"Clear","slug":"clear","path":"/taxonomy/stages/clear"},{"id":1,"name":"Exposed","slug":"exposed","path":"/taxonomy/stages/exposed"},{"id":2,"name":"Susceptible","slug":"susceptible","path":"/taxonomy/stages/susceptible"},{"id":3,"name":"Exploited","slug":"exploited","path":"/taxonomy/stages/exploited"},{"id":4,"name":"Suspected","slug":"suspected","path":"/taxonomy/stages/suspected"},{"id":5,"name":"Confirmed","slug":"confirmed","path":"/taxonomy/stages/confirmed"}],"signals":[{"id":"SE-T-01","name":"Targeted by real phishing","slug":"se-t-01-targeted-by-real-phishing","path":"/taxonomy/signals/se-t-01-targeted-by-real-phishing","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02","HB-03"]},{"id":"SE-T-02","name":"Real phishing delivered to inbox","slug":"se-t-02-real-phishing-delivered-to-inbox","path":"/taxonomy/signals/se-t-02-real-phishing-delivered-to-inbox","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02","HB-03"]},{"id":"SE-T-03","name":"Receives impersonation attempts","slug":"se-t-03-receives-impersonation-attempts","path":"/taxonomy/signals/se-t-03-receives-impersonation-attempts","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-05"]},{"id":"SE-T-04","name":"Receives callback or voice phishing","slug":"se-t-04-receives-callback-or-voice-phishing","path":"/taxonomy/signals/se-t-04-receives-callback-or-voice-phishing","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02"]},{"id":"SE-T-05","name":"Targeted by mobile or SMS lures","slug":"se-t-05-targeted-by-mobile-or-sms-lures","path":"/taxonomy/signals/se-t-05-targeted-by-mobile-or-sms-lures","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"MDM","outcomes":["HB-01","HB-02"]},{"id":"SE-T-06","name":"Account sending malicious or phishing mail","slug":"se-t-06-account-sending-malicious-or-phishing-mail","path":"/taxonomy/signals/se-t-06-account-sending-malicious-or-phishing-mail","domain":"SE","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02"]},{"id":"SE-A-01","name":"Publicly visible role (exec, finance, HR)","slug":"se-a-01-publicly-visible-role-exec-finance-hr","path":"/taxonomy/signals/se-a-01-publicly-visible-role-exec-finance-hr","domain":"SE","dimension":"A","polarity":"neutral","subject":"person","source":"HRIS","outcomes":["HB-01","HB-05"]},{"id":"SE-A-02","name":"Holds payment approval authority","slug":"se-a-02-holds-payment-approval-authority","path":"/taxonomy/signals/se-a-02-holds-payment-approval-authority","domain":"SE","dimension":"A","polarity":"neutral","subject":"person","source":"ERP","outcomes":["HB-05"]},{"id":"SE-A-03","name":"Can reset passwords or MFA for others","slug":"se-a-03-can-reset-passwords-or-mfa-for-others","path":"/taxonomy/signals/se-a-03-can-reset-passwords-or-mfa-for-others","domain":"SE","dimension":"A","polarity":"neutral","subject":"person","source":"ITSM","outcomes":["HB-01","HB-02"]},{"id":"SE-B-01","name":"Clicks simulated phishing links","slug":"se-b-01-clicks-simulated-phishing-links","path":"/taxonomy/signals/se-b-01-clicks-simulated-phishing-links","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02","HB-03"]},{"id":"SE-B-02","name":"Submits credentials to simulations","slug":"se-b-02-submits-credentials-to-simulations","path":"/taxonomy/signals/se-b-02-submits-credentials-to-simulations","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-03","name":"Opens simulated attachments","slug":"se-b-03-opens-simulated-attachments","path":"/taxonomy/signals/se-b-03-opens-simulated-attachments","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-03"]},{"id":"SE-B-04","name":"Clicks links in real phishing","slug":"se-b-04-clicks-links-in-real-phishing","path":"/taxonomy/signals/se-b-04-clicks-links-in-real-phishing","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02","HB-03"]},{"id":"SE-B-05","name":"Deceived by voice simulations","slug":"se-b-05-deceived-by-voice-simulations","path":"/taxonomy/signals/se-b-05-deceived-by-voice-simulations","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-06","name":"Clicks SMS simulations","slug":"se-b-06-clicks-sms-simulations","path":"/taxonomy/signals/se-b-06-clicks-sms-simulations","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-07","name":"Scans simulated QR codes","slug":"se-b-07-scans-simulated-qr-codes","path":"/taxonomy/signals/se-b-07-scans-simulated-qr-codes","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-08","name":"Repeat clicker (3+ in 180 days)","slug":"se-b-08-repeat-clicker-3-in-180-days","path":"/taxonomy/signals/se-b-08-repeat-clicker-3-in-180-days","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-09","name":"Replies to or engages with suspicious senders","slug":"se-b-09-replies-to-or-engages-with-suspicious-senders","path":"/taxonomy/signals/se-b-09-replies-to-or-engages-with-suspicious-senders","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-05"]},{"id":"SE-B-10","name":"Reports simulated phishing","slug":"se-b-10-reports-simulated-phishing","path":"/taxonomy/signals/se-b-10-reports-simulated-phishing","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"SE-B-11","name":"Reports real phishing","slug":"se-b-11-reports-real-phishing","path":"/taxonomy/signals/se-b-11-reports-real-phishing","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02","HB-03","HB-05"]},{"id":"SE-B-12","name":"Reports within one hour of delivery","slug":"se-b-12-reports-within-one-hour-of-delivery","path":"/taxonomy/signals/se-b-12-reports-within-one-hour-of-delivery","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-02","HB-03"]},{"id":"SE-B-13","name":"Identifies voice simulations","slug":"se-b-13-identifies-voice-simulations","path":"/taxonomy/signals/se-b-13-identifies-voice-simulations","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01","HB-02"]},{"id":"SE-B-14","name":"Verifies requests out of band","slug":"se-b-14-verifies-requests-out-of-band","path":"/taxonomy/signals/se-b-14-verifies-requests-out-of-band","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"ERP","outcomes":["HB-05"]},{"id":"SE-B-15","name":"Deletes suspicious mail without engaging","slug":"se-b-15-deletes-suspicious-mail-without-engaging","path":"/taxonomy/signals/se-b-15-deletes-suspicious-mail-without-engaging","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"EMAIL","outcomes":["HB-01"]},{"id":"SE-B-16","name":"Reports safe mail as suspicious","slug":"se-b-16-reports-safe-mail-as-suspicious","path":"/taxonomy/signals/se-b-16-reports-safe-mail-as-suspicious","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"EMAIL","outcomes":["HB-01"]},{"id":"SE-B-17","name":"Reports SMS and voice lures","slug":"se-b-17-reports-sms-and-voice-lures","path":"/taxonomy/signals/se-b-17-reports-sms-and-voice-lures","domain":"SE","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"SE-B-18","name":"Grants remote access to an unverified party","slug":"se-b-18-grants-remote-access-to-an-unverified-party","path":"/taxonomy/signals/se-b-18-grants-remote-access-to-an-unverified-party","domain":"SE","dimension":"B","polarity":"risky","subject":"person","source":"HELP","outcomes":["HB-02","HB-03"]},{"id":"IA-T-01","name":"Credentials leaked in a public breach","slug":"ia-t-01-credentials-leaked-in-a-public-breach","path":"/taxonomy/signals/ia-t-01-credentials-leaked-in-a-public-breach","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"EXPO","outcomes":["HB-02","HB-03"]},{"id":"IA-T-02","name":"Credentials flagged as compromised","slug":"ia-t-02-credentials-flagged-as-compromised","path":"/taxonomy/signals/ia-t-02-credentials-flagged-as-compromised","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"EXPO","outcomes":["HB-02","HB-03"]},{"id":"IA-T-03","name":"Identity or PII on the dark web","slug":"ia-t-03-identity-or-pii-on-the-dark-web","path":"/taxonomy/signals/ia-t-03-identity-or-pii-on-the-dark-web","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"EXPO","outcomes":["HB-02","HB-05"]},{"id":"IA-T-04","name":"Targeted by malicious login attempts","slug":"ia-t-04-targeted-by-malicious-login-attempts","path":"/taxonomy/signals/ia-t-04-targeted-by-malicious-login-attempts","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-T-05","name":"Activity from anonymous or suspicious IPs","slug":"ia-t-05-activity-from-anonymous-or-suspicious-ips","path":"/taxonomy/signals/ia-t-05-activity-from-anonymous-or-suspicious-ips","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-T-06","name":"Session token or cookie theft indicators","slug":"ia-t-06-session-token-or-cookie-theft-indicators","path":"/taxonomy/signals/ia-t-06-session-token-or-cookie-theft-indicators","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-T-07","name":"Account flagged compromised by the identity provider","slug":"ia-t-07-account-flagged-compromised-by-the-identity-provider","path":"/taxonomy/signals/ia-t-07-account-flagged-compromised-by-the-identity-provider","domain":"IA","dimension":"T","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-02","HB-07"]},{"id":"IA-A-01","name":"Holds admin or privileged roles","slug":"ia-a-01-holds-admin-or-privileged-roles","path":"/taxonomy/signals/ia-a-01-holds-admin-or-privileged-roles","domain":"IA","dimension":"A","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-02","HB-03","HB-07"]},{"id":"IA-A-02","name":"Member of privileged security groups","slug":"ia-a-02-member-of-privileged-security-groups","path":"/taxonomy/signals/ia-a-02-member-of-privileged-security-groups","domain":"IA","dimension":"A","polarity":"neutral","subject":"person","source":"IGA","outcomes":["HB-02","HB-03","HB-07"]},{"id":"IA-A-03","name":"Privileges unused for 90+ days","slug":"ia-a-03-privileges-unused-for-90-days","path":"/taxonomy/signals/ia-a-03-privileges-unused-for-90-days","domain":"IA","dimension":"A","polarity":"neutral","subject":"person","source":"IGA","outcomes":["HB-02","HB-07"]},{"id":"IA-A-04","name":"Standing access to backup or storage consoles","slug":"ia-a-04-standing-access-to-backup-or-storage-consoles","path":"/taxonomy/signals/ia-a-04-standing-access-to-backup-or-storage-consoles","domain":"IA","dimension":"A","polarity":"neutral","subject":"person","source":"IGA","outcomes":["HB-03"]},{"id":"IA-A-05","name":"Contingent worker or third-party identity","slug":"ia-a-05-contingent-worker-or-third-party-identity","path":"/taxonomy/signals/ia-a-05-contingent-worker-or-third-party-identity","domain":"IA","dimension":"A","polarity":"neutral","subject":"person","source":"HRIS","outcomes":["HB-02","HB-08"]},{"id":"IA-B-01","name":"Removes an MFA factor","slug":"ia-b-01-removes-an-mfa-factor","path":"/taxonomy/signals/ia-b-01-removes-an-mfa-factor","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-02","name":"Shares credentials","slug":"ia-b-02-shares-credentials","path":"/taxonomy/signals/ia-b-02-shares-credentials","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02","HB-07"]},{"id":"IA-B-03","name":"Exports credentials from a vault","slug":"ia-b-03-exports-credentials-from-a-vault","path":"/taxonomy/signals/ia-b-03-exports-credentials-from-a-vault","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02","HB-07"]},{"id":"IA-B-04","name":"Signs in from unusual contexts","slug":"ia-b-04-signs-in-from-unusual-contexts","path":"/taxonomy/signals/ia-b-04-signs-in-from-unusual-contexts","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02","HB-07"]},{"id":"IA-B-05","name":"Approves MFA after repeated prompts","slug":"ia-b-05-approves-mfa-after-repeated-prompts","path":"/taxonomy/signals/ia-b-05-approves-mfa-after-repeated-prompts","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02","HB-03"]},{"id":"IA-B-06","name":"Reuses passwords across systems","slug":"ia-b-06-reuses-passwords-across-systems","path":"/taxonomy/signals/ia-b-06-reuses-passwords-across-systems","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"EXPO","outcomes":["HB-02","HB-03"]},{"id":"IA-B-07","name":"Uses SMS as the only MFA factor","slug":"ia-b-07-uses-sms-as-the-only-mfa-factor","path":"/taxonomy/signals/ia-b-07-uses-sms-as-the-only-mfa-factor","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-08","name":"Enrolls phishing-resistant MFA","slug":"ia-b-08-enrolls-phishing-resistant-mfa","path":"/taxonomy/signals/ia-b-08-enrolls-phishing-resistant-mfa","domain":"IA","dimension":"B","polarity":"vigilant","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-09","name":"Uses a password manager","slug":"ia-b-09-uses-a-password-manager","path":"/taxonomy/signals/ia-b-09-uses-a-password-manager","domain":"IA","dimension":"B","polarity":"vigilant","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-10","name":"Signs in through SSO","slug":"ia-b-10-signs-in-through-sso","path":"/taxonomy/signals/ia-b-10-signs-in-through-sso","domain":"IA","dimension":"B","polarity":"vigilant","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-11","name":"Adopts passwordless sign-in","slug":"ia-b-11-adopts-passwordless-sign-in","path":"/taxonomy/signals/ia-b-11-adopts-passwordless-sign-in","domain":"IA","dimension":"B","polarity":"vigilant","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"IA-B-12","name":"Reviews and removes own unused access","slug":"ia-b-12-reviews-and-removes-own-unused-access","path":"/taxonomy/signals/ia-b-12-reviews-and-removes-own-unused-access","domain":"IA","dimension":"B","polarity":"vigilant","subject":"person","source":"IGA","outcomes":["HB-07"]},{"id":"IA-B-13","name":"Attempts to bypass MFA","slug":"ia-b-13-attempts-to-bypass-mfa","path":"/taxonomy/signals/ia-b-13-attempts-to-bypass-mfa","domain":"IA","dimension":"B","polarity":"risky","subject":"person","source":"IDP","outcomes":["HB-02"]},{"id":"DH-A-01","name":"Access to sensitive data repositories","slug":"dh-a-01-access-to-sensitive-data-repositories","path":"/taxonomy/signals/dh-a-01-access-to-sensitive-data-repositories","domain":"DH","dimension":"A","polarity":"neutral","subject":"person","source":"DATA","outcomes":["HB-06","HB-07","HB-08"]},{"id":"DH-A-02","name":"In a notice period or role change","slug":"dh-a-02-in-a-notice-period-or-role-change","path":"/taxonomy/signals/dh-a-02-in-a-notice-period-or-role-change","domain":"DH","dimension":"A","polarity":"neutral","subject":"person","source":"HRIS","outcomes":["HB-07"]},{"id":"DH-A-03","name":"Handles regulated data (PCI, PHI, PII)","slug":"dh-a-03-handles-regulated-data-pci-phi-pii","path":"/taxonomy/signals/dh-a-03-handles-regulated-data-pci-phi-pii","domain":"DH","dimension":"A","polarity":"neutral","subject":"person","source":"DATA","outcomes":["HB-06"]},{"id":"DH-B-01","name":"Downloads data in bulk above own baseline","slug":"dh-b-01-downloads-data-in-bulk-above-own-baseline","path":"/taxonomy/signals/dh-b-01-downloads-data-in-bulk-above-own-baseline","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-07"]},{"id":"DH-B-02","name":"Uploads data in bulk","slug":"dh-b-02-uploads-data-in-bulk","path":"/taxonomy/signals/dh-b-02-uploads-data-in-bulk","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-07"]},{"id":"DH-B-03","name":"Shares sensitive data externally","slug":"dh-b-03-shares-sensitive-data-externally","path":"/taxonomy/signals/dh-b-03-shares-sensitive-data-externally","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-07"]},{"id":"DH-B-04","name":"Violates data-handling policy","slug":"dh-b-04-violates-data-handling-policy","path":"/taxonomy/signals/dh-b-04-violates-data-handling-policy","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06"]},{"id":"DH-B-05","name":"Attempts to bypass DLP","slug":"dh-b-05-attempts-to-bypass-dlp","path":"/taxonomy/signals/dh-b-05-attempts-to-bypass-dlp","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"EDR","outcomes":["HB-06","HB-07"]},{"id":"DH-B-06","name":"Forwards work email to personal accounts","slug":"dh-b-06-forwards-work-email-to-personal-accounts","path":"/taxonomy/signals/dh-b-06-forwards-work-email-to-personal-accounts","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"EMAIL","outcomes":["HB-06","HB-07"]},{"id":"DH-B-07","name":"Misdelivers email or shares to the wrong party","slug":"dh-b-07-misdelivers-email-or-shares-to-the-wrong-party","path":"/taxonomy/signals/dh-b-07-misdelivers-email-or-shares-to-the-wrong-party","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"EMAIL","outcomes":["HB-06"]},{"id":"DH-B-08","name":"Stores work data in personal cloud","slug":"dh-b-08-stores-work-data-in-personal-cloud","path":"/taxonomy/signals/dh-b-08-stores-work-data-in-personal-cloud","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-07"]},{"id":"DH-B-09","name":"Disposes of data and devices securely","slug":"dh-b-09-disposes-of-data-and-devices-securely","path":"/taxonomy/signals/dh-b-09-disposes-of-data-and-devices-securely","domain":"DH","dimension":"B","polarity":"vigilant","subject":"person","source":"ITSM","outcomes":["HB-06","HB-10"]},{"id":"DH-B-10","name":"Classifies and labels documents","slug":"dh-b-10-classifies-and-labels-documents","path":"/taxonomy/signals/dh-b-10-classifies-and-labels-documents","domain":"DH","dimension":"B","polarity":"vigilant","subject":"person","source":"DATA","outcomes":["HB-06"]},{"id":"DH-B-11","name":"Completes data-handling training","slug":"dh-b-11-completes-data-handling-training","path":"/taxonomy/signals/dh-b-11-completes-data-handling-training","domain":"DH","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-06"]},{"id":"DH-B-12","name":"Blocked data transfer attempts","slug":"dh-b-12-blocked-data-transfer-attempts","path":"/taxonomy/signals/dh-b-12-blocked-data-transfer-attempts","domain":"DH","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-07"]},{"id":"EP-T-01","name":"Malware detected on their device","slug":"ep-t-01-malware-detected-on-their-device","path":"/taxonomy/signals/ep-t-01-malware-detected-on-their-device","domain":"EP","dimension":"T","polarity":"neutral","subject":"person","source":"EDR","outcomes":["HB-03"]},{"id":"EP-T-02","name":"Exploitable vulnerability on their device","slug":"ep-t-02-exploitable-vulnerability-on-their-device","path":"/taxonomy/signals/ep-t-02-exploitable-vulnerability-on-their-device","domain":"EP","dimension":"T","polarity":"neutral","subject":"person","source":"VULN","outcomes":["HB-03","HB-04"]},{"id":"EP-T-03","name":"Infostealer indicators on a device they use","slug":"ep-t-03-infostealer-indicators-on-a-device-they-use","path":"/taxonomy/signals/ep-t-03-infostealer-indicators-on-a-device-they-use","domain":"EP","dimension":"T","polarity":"neutral","subject":"person","source":"EXPO","outcomes":["HB-02","HB-03"]},{"id":"EP-T-04","name":"Credential-theft, lateral-movement or privilege-escalation alert on their device","slug":"ep-t-04-credential-theft-lateral-movement-or-privilege-escalation-alert-on-their-device","path":"/taxonomy/signals/ep-t-04-credential-theft-lateral-movement-or-privilege-escalation-alert-on-their-device","domain":"EP","dimension":"T","polarity":"neutral","subject":"person","source":"EDR","outcomes":["HB-02","HB-03"]},{"id":"EP-T-05","name":"Device quarantined or flagged compromised","slug":"ep-t-05-device-quarantined-or-flagged-compromised","path":"/taxonomy/signals/ep-t-05-device-quarantined-or-flagged-compromised","domain":"EP","dimension":"T","polarity":"neutral","subject":"person","source":"EDR","outcomes":["HB-03","HB-10"]},{"id":"EP-A-01","name":"Local admin rights on endpoints","slug":"ep-a-01-local-admin-rights-on-endpoints","path":"/taxonomy/signals/ep-a-01-local-admin-rights-on-endpoints","domain":"EP","dimension":"A","polarity":"neutral","subject":"person","source":"EDR","outcomes":["HB-03","HB-04"]},{"id":"EP-A-02","name":"Owns internet-facing or critical systems","slug":"ep-a-02-owns-internet-facing-or-critical-systems","path":"/taxonomy/signals/ep-a-02-owns-internet-facing-or-critical-systems","domain":"EP","dimension":"A","polarity":"neutral","subject":"person","source":"VULN","outcomes":["HB-04"]},{"id":"EP-B-01","name":"Disables or tampers with EDR","slug":"ep-b-01-disables-or-tampers-with-edr","path":"/taxonomy/signals/ep-b-01-disables-or-tampers-with-edr","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"EDR","outcomes":["HB-03"]},{"id":"EP-B-02","name":"Connects USB storage","slug":"ep-b-02-connects-usb-storage","path":"/taxonomy/signals/ep-b-02-connects-usb-storage","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"EDR","outcomes":["HB-06","HB-07","HB-10"]},{"id":"EP-B-03","name":"Uses a rooted or jailbroken device","slug":"ep-b-03-uses-a-rooted-or-jailbroken-device","path":"/taxonomy/signals/ep-b-03-uses-a-rooted-or-jailbroken-device","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"MDM","outcomes":["HB-03","HB-10"]},{"id":"EP-B-04","name":"Device fails MDM or encryption policy","slug":"ep-b-04-device-fails-mdm-or-encryption-policy","path":"/taxonomy/signals/ep-b-04-device-fails-mdm-or-encryption-policy","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"MDM","outcomes":["HB-03","HB-10"]},{"id":"EP-B-05","name":"Runs suspicious processes or unapproved software","slug":"ep-b-05-runs-suspicious-processes-or-unapproved-software","path":"/taxonomy/signals/ep-b-05-runs-suspicious-processes-or-unapproved-software","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"EDR","outcomes":["HB-03"]},{"id":"EP-B-06","name":"Defers patches repeatedly","slug":"ep-b-06-defers-patches-repeatedly","path":"/taxonomy/signals/ep-b-06-defers-patches-repeatedly","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"VULN","outcomes":["HB-04"]},{"id":"EP-B-07","name":"Leaves devices unlocked or unattended","slug":"ep-b-07-leaves-devices-unlocked-or-unattended","path":"/taxonomy/signals/ep-b-07-leaves-devices-unlocked-or-unattended","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"MDM","outcomes":["HB-10"]},{"id":"EP-B-08","name":"Lost or stolen device reported late","slug":"ep-b-08-lost-or-stolen-device-reported-late","path":"/taxonomy/signals/ep-b-08-lost-or-stolen-device-reported-late","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"ITSM","outcomes":["HB-10"]},{"id":"EP-B-09","name":"Tailgates or shares badge access","slug":"ep-b-09-tailgates-or-shares-badge-access","path":"/taxonomy/signals/ep-b-09-tailgates-or-shares-badge-access","domain":"EP","dimension":"B","polarity":"risky","subject":"person","source":"PHYS","outcomes":["HB-10"]},{"id":"EP-B-10","name":"Installs updates promptly","slug":"ep-b-10-installs-updates-promptly","path":"/taxonomy/signals/ep-b-10-installs-updates-promptly","domain":"EP","dimension":"B","polarity":"vigilant","subject":"person","source":"VULN","outcomes":["HB-04"]},{"id":"EP-B-11","name":"Keeps a compliant, protected device","slug":"ep-b-11-keeps-a-compliant-protected-device","path":"/taxonomy/signals/ep-b-11-keeps-a-compliant-protected-device","domain":"EP","dimension":"B","polarity":"vigilant","subject":"person","source":"MDM","outcomes":["HB-03","HB-10"]},{"id":"EP-B-12","name":"Reports lost devices within 24 hours","slug":"ep-b-12-reports-lost-devices-within-24-hours","path":"/taxonomy/signals/ep-b-12-reports-lost-devices-within-24-hours","domain":"EP","dimension":"B","polarity":"vigilant","subject":"person","source":"ITSM","outcomes":["HB-10"]},{"id":"WC-T-01","name":"Lookalike domains registered against the brand","slug":"wc-t-01-lookalike-domains-registered-against-the-brand","path":"/taxonomy/signals/wc-t-01-lookalike-domains-registered-against-the-brand","domain":"WC","dimension":"T","polarity":"neutral","subject":"person","source":"EXPO","outcomes":["HB-01","HB-05"]},{"id":"WC-T-02","name":"Third-party app they use was breached","slug":"wc-t-02-third-party-app-they-use-was-breached","path":"/taxonomy/signals/wc-t-02-third-party-app-they-use-was-breached","domain":"WC","dimension":"T","polarity":"neutral","subject":"person","source":"SSE","outcomes":["HB-08"]},{"id":"WC-A-01","name":"Owns third-party integrations or OAuth apps","slug":"wc-a-01-owns-third-party-integrations-or-oauth-apps","path":"/taxonomy/signals/wc-a-01-owns-third-party-integrations-or-oauth-apps","domain":"WC","dimension":"A","polarity":"neutral","subject":"person","source":"IGA","outcomes":["HB-08"]},{"id":"WC-B-01","name":"Visits known-malicious websites","slug":"wc-b-01-visits-known-malicious-websites","path":"/taxonomy/signals/wc-b-01-visits-known-malicious-websites","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-03"]},{"id":"WC-B-02","name":"Bypasses web filtering","slug":"wc-b-02-bypasses-web-filtering","path":"/taxonomy/signals/wc-b-02-bypasses-web-filtering","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-03"]},{"id":"WC-B-03","name":"Visits unauthorized websites","slug":"wc-b-03-visits-unauthorized-websites","path":"/taxonomy/signals/wc-b-03-visits-unauthorized-websites","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-03","HB-09"]},{"id":"WC-B-04","name":"Grants risky OAuth permissions","slug":"wc-b-04-grants-risky-oauth-permissions","path":"/taxonomy/signals/wc-b-04-grants-risky-oauth-permissions","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-08"]},{"id":"WC-B-05","name":"Uses unauthorized SaaS apps","slug":"wc-b-05-uses-unauthorized-saas-apps","path":"/taxonomy/signals/wc-b-05-uses-unauthorized-saas-apps","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-08","HB-09"]},{"id":"WC-B-06","name":"Installs unvetted browser extensions","slug":"wc-b-06-installs-unvetted-browser-extensions","path":"/taxonomy/signals/wc-b-06-installs-unvetted-browser-extensions","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-08"]},{"id":"WC-B-07","name":"Uses public Wi-Fi without VPN","slug":"wc-b-07-uses-public-wi-fi-without-vpn","path":"/taxonomy/signals/wc-b-07-uses-public-wi-fi-without-vpn","domain":"WC","dimension":"B","polarity":"risky","subject":"person","source":"MDM","outcomes":["HB-02","HB-10"]},{"id":"WC-B-08","name":"Downloads from trusted sources only","slug":"wc-b-08-downloads-from-trusted-sources-only","path":"/taxonomy/signals/wc-b-08-downloads-from-trusted-sources-only","domain":"WC","dimension":"B","polarity":"vigilant","subject":"person","source":"SSE","outcomes":["HB-03"]},{"id":"WC-B-09","name":"Reviews and revokes own app grants","slug":"wc-b-09-reviews-and-revokes-own-app-grants","path":"/taxonomy/signals/wc-b-09-reviews-and-revokes-own-app-grants","domain":"WC","dimension":"B","polarity":"vigilant","subject":"person","source":"IGA","outcomes":["HB-08"]},{"id":"AU-T-01","name":"Targeted by deepfake or AI-generated lures","slug":"au-t-01-targeted-by-deepfake-or-ai-generated-lures","path":"/taxonomy/signals/au-t-01-targeted-by-deepfake-or-ai-generated-lures","domain":"AU","dimension":"T","polarity":"neutral","subject":"person","source":"EMAIL","outcomes":["HB-01","HB-05"]},{"id":"AG-A-01","name":"Owns AI agents or service identities","slug":"ag-a-01-owns-ai-agents-or-service-identities","path":"/taxonomy/signals/ag-a-01-owns-ai-agents-or-service-identities","domain":"AG","dimension":"A","polarity":"neutral","subject":"agent","source":"IGA","outcomes":["HB-08","HB-09"]},{"id":"AU-A-01","name":"Administers an enterprise AI platform","slug":"au-a-01-administers-an-enterprise-ai-platform","path":"/taxonomy/signals/au-a-01-administers-an-enterprise-ai-platform","domain":"AU","dimension":"A","polarity":"neutral","subject":"person","source":"IDP","outcomes":["HB-09"]},{"id":"AU-B-01","name":"Uses unauthorized AI tools","slug":"au-b-01-uses-unauthorized-ai-tools","path":"/taxonomy/signals/au-b-01-uses-unauthorized-ai-tools","domain":"AU","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-09"]},{"id":"AU-B-02","name":"Puts sensitive data in AI prompts","slug":"au-b-02-puts-sensitive-data-in-ai-prompts","path":"/taxonomy/signals/au-b-02-puts-sensitive-data-in-ai-prompts","domain":"AU","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06","HB-09"]},{"id":"AU-B-03","name":"Uses personal accounts on AI platforms","slug":"au-b-03-uses-personal-accounts-on-ai-platforms","path":"/taxonomy/signals/au-b-03-uses-personal-accounts-on-ai-platforms","domain":"AU","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-09"]},{"id":"AG-B-01","name":"Grants agents broad or standing permissions","slug":"ag-b-01-grants-agents-broad-or-standing-permissions","path":"/taxonomy/signals/ag-b-01-grants-agents-broad-or-standing-permissions","domain":"AG","dimension":"B","polarity":"risky","subject":"agent","source":"IGA","outcomes":["HB-08","HB-09"]},{"id":"AU-B-04","name":"Uses the sanctioned AI tools","slug":"au-b-04-uses-the-sanctioned-ai-tools","path":"/taxonomy/signals/au-b-04-uses-the-sanctioned-ai-tools","domain":"AU","dimension":"B","polarity":"vigilant","subject":"person","source":"SSE","outcomes":["HB-09"]},{"id":"AG-B-02","name":"Registers agents with a named owner","slug":"ag-b-02-registers-agents-with-a-named-owner","path":"/taxonomy/signals/ag-b-02-registers-agents-with-a-named-owner","domain":"AG","dimension":"B","polarity":"vigilant","subject":"agent","source":"IGA","outcomes":["HB-09"]},{"id":"RR-B-01","name":"Training past due","slug":"rr-b-01-training-past-due","path":"/taxonomy/signals/rr-b-01-training-past-due","domain":"RR","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-06"]},{"id":"RR-B-02","name":"Fails training assessments","slug":"rr-b-02-fails-training-assessments","path":"/taxonomy/signals/rr-b-02-fails-training-assessments","domain":"RR","dimension":"B","polarity":"risky","subject":"person","source":"SAT","outcomes":["HB-01","HB-06"]},{"id":"SC-B-01","name":"Overconfident: self-rated ability exceeds results","slug":"sc-b-01-overconfident-self-rated-ability-exceeds-results","path":"/taxonomy/signals/sc-b-01-overconfident-self-rated-ability-exceeds-results","domain":"SC","dimension":"B","polarity":"risky","subject":"person","source":"SURVEY","outcomes":["HB-01"]},{"id":"RR-B-03","name":"Repeat security-related help desk tickets","slug":"rr-b-03-repeat-security-related-help-desk-tickets","path":"/taxonomy/signals/rr-b-03-repeat-security-related-help-desk-tickets","domain":"RR","dimension":"B","polarity":"risky","subject":"person","source":"HELP","outcomes":["HB-02","HB-06"]},{"id":"RR-B-04","name":"Completes security training","slug":"rr-b-04-completes-security-training","path":"/taxonomy/signals/rr-b-04-completes-security-training","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01","HB-06"]},{"id":"RR-B-05","name":"Completes role-based training","slug":"rr-b-05-completes-role-based-training","path":"/taxonomy/signals/rr-b-05-completes-role-based-training","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01","HB-05","HB-07"]},{"id":"SC-B-02","name":"Takes voluntary training","slug":"sc-b-02-takes-voluntary-training","path":"/taxonomy/signals/sc-b-02-takes-voluntary-training","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"SC-B-03","name":"Retains knowledge over time","slug":"sc-b-03-retains-knowledge-over-time","path":"/taxonomy/signals/sc-b-03-retains-knowledge-over-time","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"SC-B-04","name":"Joins awareness events and exercises","slug":"sc-b-04-joins-awareness-events-and-exercises","path":"/taxonomy/signals/sc-b-04-joins-awareness-events-and-exercises","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"SC-B-05","name":"Responds to the culture pulse","slug":"sc-b-05-responds-to-the-culture-pulse","path":"/taxonomy/signals/sc-b-05-responds-to-the-culture-pulse","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SURVEY","outcomes":["HB-01"]},{"id":"SC-B-06","name":"Asks security for help before a project","slug":"sc-b-06-asks-security-for-help-before-a-project","path":"/taxonomy/signals/sc-b-06-asks-security-for-help-before-a-project","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"HELP","outcomes":["HB-01","HB-08"]},{"id":"SC-B-07","name":"Serves as a security ambassador","slug":"sc-b-07-serves-as-a-security-ambassador","path":"/taxonomy/signals/sc-b-07-serves-as-a-security-ambassador","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"RR-B-06","name":"Reports a real incident or near miss","slug":"rr-b-06-reports-a-real-incident-or-near-miss","path":"/taxonomy/signals/rr-b-06-reports-a-real-incident-or-near-miss","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SIEM","outcomes":["HB-01","HB-06","HB-10"]},{"id":"RR-B-07","name":"Acknowledges security policies","slug":"rr-b-07-acknowledges-security-policies","path":"/taxonomy/signals/rr-b-07-acknowledges-security-policies","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-06"]},{"id":"RR-B-08","name":"Starts assigned training promptly","slug":"rr-b-08-starts-assigned-training-promptly","path":"/taxonomy/signals/rr-b-08-starts-assigned-training-promptly","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-01"]},{"id":"RR-B-09","name":"Technical policy violations","slug":"rr-b-09-technical-policy-violations","path":"/taxonomy/signals/rr-b-09-technical-policy-violations","domain":"RR","dimension":"B","polarity":"risky","subject":"person","source":"SSE","outcomes":["HB-06"]},{"id":"RR-T-01","name":"Incident opened and attributed to the person","slug":"rr-t-01-incident-opened-and-attributed-to-the-person","path":"/taxonomy/signals/rr-t-01-incident-opened-and-attributed-to-the-person","domain":"RR","dimension":"T","polarity":"neutral","subject":"person","source":"SIEM","outcomes":["HB-01","HB-02","HB-03","HB-04","HB-05","HB-06","HB-07","HB-08","HB-09","HB-10"]},{"id":"AU-B-05","name":"Acts on AI output without validation","slug":"au-b-05-acts-on-ai-output-without-validation","path":"/taxonomy/signals/au-b-05-acts-on-ai-output-without-validation","domain":"AU","dimension":"B","polarity":"risky","subject":"person","source":"SURVEY","outcomes":["HB-09"]},{"id":"AU-B-06","name":"Validates AI output against trusted sources","slug":"au-b-06-validates-ai-output-against-trusted-sources","path":"/taxonomy/signals/au-b-06-validates-ai-output-against-trusted-sources","domain":"AU","dimension":"B","polarity":"vigilant","subject":"person","source":"SURVEY","outcomes":["HB-09"]},{"id":"AG-A-02","name":"Agent holds broad or standing permissions","slug":"ag-a-02-agent-holds-broad-or-standing-permissions","path":"/taxonomy/signals/ag-a-02-agent-holds-broad-or-standing-permissions","domain":"AG","dimension":"A","polarity":"neutral","subject":"agent","source":"IGA","outcomes":["HB-08","HB-09"]},{"id":"AG-T-01","name":"Agent credentials or tokens exposed","slug":"ag-t-01-agent-credentials-or-tokens-exposed","path":"/taxonomy/signals/ag-t-01-agent-credentials-or-tokens-exposed","domain":"AG","dimension":"T","polarity":"neutral","subject":"agent","source":"EXPO","outcomes":["HB-02","HB-08"]},{"id":"AG-B-03","name":"Launches an agent without approval","slug":"ag-b-03-launches-an-agent-without-approval","path":"/taxonomy/signals/ag-b-03-launches-an-agent-without-approval","domain":"AG","dimension":"B","polarity":"risky","subject":"agent","source":"IGA","outcomes":["HB-08","HB-09"]},{"id":"AG-B-04","name":"Agent runs without logging enabled","slug":"ag-b-04-agent-runs-without-logging-enabled","path":"/taxonomy/signals/ag-b-04-agent-runs-without-logging-enabled","domain":"AG","dimension":"B","polarity":"risky","subject":"agent","source":"SIEM","outcomes":["HB-08","HB-09"]},{"id":"AG-B-05","name":"Agent acts outside its assigned role","slug":"ag-b-05-agent-acts-outside-its-assigned-role","path":"/taxonomy/signals/ag-b-05-agent-acts-outside-its-assigned-role","domain":"AG","dimension":"B","polarity":"risky","subject":"agent","source":"SIEM","outcomes":["HB-08","HB-09"]},{"id":"AG-B-06","name":"Terminates an agent after its task completes","slug":"ag-b-06-terminates-an-agent-after-its-task-completes","path":"/taxonomy/signals/ag-b-06-terminates-an-agent-after-its-task-completes","domain":"AG","dimension":"B","polarity":"vigilant","subject":"agent","source":"IGA","outcomes":["HB-08","HB-09"]},{"id":"SC-B-08","name":"Rates the security team positively in the pulse","slug":"sc-b-08-rates-the-security-team-positively-in-the-pulse","path":"/taxonomy/signals/sc-b-08-rates-the-security-team-positively-in-the-pulse","domain":"SC","dimension":"B","polarity":"vigilant","subject":"person","source":"SURVEY","outcomes":["HB-01","HB-06"]},{"id":"SC-B-09","name":"Reports friction with security controls","slug":"sc-b-09-reports-friction-with-security-controls","path":"/taxonomy/signals/sc-b-09-reports-friction-with-security-controls","domain":"SC","dimension":"B","polarity":"risky","subject":"person","source":"SURVEY","outcomes":["HB-01","HB-06"]},{"id":"RR-B-10","name":"Responds to emergency notification tests","slug":"rr-b-10-responds-to-emergency-notification-tests","path":"/taxonomy/signals/rr-b-10-responds-to-emergency-notification-tests","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-06","HB-10"]},{"id":"RR-B-11","name":"Participates in incident exercises","slug":"rr-b-11-participates-in-incident-exercises","path":"/taxonomy/signals/rr-b-11-participates-in-incident-exercises","domain":"RR","dimension":"B","polarity":"vigilant","subject":"person","source":"SAT","outcomes":["HB-06","HB-10"]},{"id":"RR-A-01","name":"Holds an active policy exception","slug":"rr-a-01-holds-an-active-policy-exception","path":"/taxonomy/signals/rr-a-01-holds-an-active-policy-exception","domain":"RR","dimension":"A","polarity":"neutral","subject":"person","source":"ITSM","outcomes":["HB-04","HB-06"]}],"cohorts":[{"id":"CR-SE-01","name":"Clicks simulations while targeted by real phishing","slug":"cr-se-01-clicks-simulations-while-targeted-by-real-phishing","path":"/taxonomy/cohorts/cr-se-01-clicks-simulations-while-targeted-by-real-phishing","class":"Targeted","domain":"SE","signals":["SE-B-01","SE-T-01"],"outcomes":["HB-01","HB-02"]},{"id":"CR-SE-02","name":"Real-phish clicker with privileged access","slug":"cr-se-02-real-phish-clicker-with-privileged-access","path":"/taxonomy/cohorts/cr-se-02-real-phish-clicker-with-privileged-access","class":"High-impact","domain":"SE","signals":["SE-B-04","IA-A-01"],"outcomes":["HB-02","HB-03"]},{"id":"CR-SE-03","name":"Social engineering critical triad","slug":"cr-se-03-social-engineering-critical-triad","path":"/taxonomy/cohorts/cr-se-03-social-engineering-critical-triad","class":"Critical","domain":"SE","signals":["SE-B-01","SE-T-01","IA-A-01"],"outcomes":["HB-01","HB-02"]},{"id":"CR-SE-04","name":"Silent repeat clicker","slug":"cr-se-04-silent-repeat-clicker","path":"/taxonomy/cohorts/cr-se-04-silent-repeat-clicker","class":"Risky","domain":"SE","signals":["SE-B-08","SE-B-10"],"outcomes":["HB-01"]},{"id":"CR-SE-05","name":"Help-desk staff deceived by voice simulations","slug":"cr-se-05-help-desk-staff-deceived-by-voice-simulations","path":"/taxonomy/cohorts/cr-se-05-help-desk-staff-deceived-by-voice-simulations","class":"High-impact","domain":"SE","signals":["SE-B-05","SE-A-03"],"outcomes":["HB-02"]},{"id":"CR-SE-06","name":"Payment approver fooled by impersonation","slug":"cr-se-06-payment-approver-fooled-by-impersonation","path":"/taxonomy/cohorts/cr-se-06-payment-approver-fooled-by-impersonation","class":"High-impact","domain":"SE","signals":["SE-B-01","SE-A-02"],"outcomes":["HB-05"]},{"id":"CR-SE-07","name":"Human sensor","slug":"cr-se-07-human-sensor","path":"/taxonomy/cohorts/cr-se-07-human-sensor","class":"Vigilant","domain":"SE","signals":["SE-T-01","SE-B-12"],"outcomes":["HB-01"]},{"id":"CR-IA-01","name":"Exposed credentials without strong MFA","slug":"cr-ia-01-exposed-credentials-without-strong-mfa","path":"/taxonomy/cohorts/cr-ia-01-exposed-credentials-without-strong-mfa","class":"Targeted","domain":"IA","signals":["IA-T-01","IA-B-08"],"outcomes":["HB-02"]},{"id":"CR-IA-02","name":"Admin who removed MFA","slug":"cr-ia-02-admin-who-removed-mfa","path":"/taxonomy/cohorts/cr-ia-02-admin-who-removed-mfa","class":"High-impact","domain":"IA","signals":["IA-B-01","IA-A-01"],"outcomes":["HB-02","HB-07"]},{"id":"CR-IA-03","name":"Credential sharer with privilege","slug":"cr-ia-03-credential-sharer-with-privilege","path":"/taxonomy/cohorts/cr-ia-03-credential-sharer-with-privilege","class":"High-impact","domain":"IA","signals":["IA-B-02","IA-A-02"],"outcomes":["HB-07"]},{"id":"CR-IA-04","name":"Dormant privilege, unusual login","slug":"cr-ia-04-dormant-privilege-unusual-login","path":"/taxonomy/cohorts/cr-ia-04-dormant-privilege-unusual-login","class":"High-impact","domain":"IA","signals":["IA-B-04","IA-A-03"],"outcomes":["HB-07"]},{"id":"CR-IA-05","name":"Keyholder with standing backup access and reuse","slug":"cr-ia-05-keyholder-with-standing-backup-access-and-reuse","path":"/taxonomy/cohorts/cr-ia-05-keyholder-with-standing-backup-access-and-reuse","class":"Critical","domain":"IA","signals":["IA-B-06","IA-A-04","IA-T-01"],"outcomes":["HB-03"]},{"id":"CR-DH-01","name":"Bulk mover in a notice period","slug":"cr-dh-01-bulk-mover-in-a-notice-period","path":"/taxonomy/cohorts/cr-dh-01-bulk-mover-in-a-notice-period","class":"High-impact","domain":"DH","signals":["DH-B-01","DH-A-02"],"outcomes":["HB-07"]},{"id":"CR-DH-02","name":"Sensitive sharer with sensitive access","slug":"cr-dh-02-sensitive-sharer-with-sensitive-access","path":"/taxonomy/cohorts/cr-dh-02-sensitive-sharer-with-sensitive-access","class":"High-impact","domain":"DH","signals":["DH-B-03","DH-A-01"],"outcomes":["HB-06","HB-07"]},{"id":"CR-EP-01","name":"EDR tamperer with local admin","slug":"cr-ep-01-edr-tamperer-with-local-admin","path":"/taxonomy/cohorts/cr-ep-01-edr-tamperer-with-local-admin","class":"High-impact","domain":"EP","signals":["EP-B-01","EP-A-01"],"outcomes":["HB-03"]},{"id":"CR-EP-02","name":"Malicious-site visitor on a vulnerable device","slug":"cr-ep-02-malicious-site-visitor-on-a-vulnerable-device","path":"/taxonomy/cohorts/cr-ep-02-malicious-site-visitor-on-a-vulnerable-device","class":"Targeted","domain":"EP","signals":["WC-B-01","EP-T-02"],"outcomes":["HB-03","HB-04"]},{"id":"CR-EP-03","name":"Patch deferrer owning internet-facing systems","slug":"cr-ep-03-patch-deferrer-owning-internet-facing-systems","path":"/taxonomy/cohorts/cr-ep-03-patch-deferrer-owning-internet-facing-systems","class":"High-impact","domain":"EP","signals":["EP-B-06","EP-A-02"],"outcomes":["HB-04"]},{"id":"CR-WC-01","name":"Risky OAuth grant with sensitive access","slug":"cr-wc-01-risky-oauth-grant-with-sensitive-access","path":"/taxonomy/cohorts/cr-wc-01-risky-oauth-grant-with-sensitive-access","class":"High-impact","domain":"WC","signals":["WC-B-04","DH-A-01"],"outcomes":["HB-08"]},{"id":"CR-AU-01","name":"Shadow AI with sensitive data","slug":"cr-au-01-shadow-ai-with-sensitive-data","path":"/taxonomy/cohorts/cr-au-01-shadow-ai-with-sensitive-data","class":"Risky","domain":"AU","signals":["AU-B-01","AU-B-02"],"outcomes":["HB-09"]},{"id":"CR-AG-02","name":"Over-scoped agent without logging","slug":"cr-ag-02-over-scoped-agent-without-logging","path":"/taxonomy/cohorts/cr-ag-02-over-scoped-agent-without-logging","class":"Critical","domain":"AG","signals":["AG-A-02","AG-B-04"],"outcomes":["HB-08","HB-09"]},{"id":"CR-AG-01","name":"Risky owner of AI agents","slug":"cr-ag-01-risky-owner-of-ai-agents","path":"/taxonomy/cohorts/cr-ag-01-risky-owner-of-ai-agents","class":"High-impact","domain":"AG","signals":["SE-B-04","AG-A-01"],"outcomes":["HB-08","HB-09"]},{"id":"CR-RR-01","name":"Exception holder who clicks","slug":"cr-rr-01-exception-holder-who-clicks","path":"/taxonomy/cohorts/cr-rr-01-exception-holder-who-clicks","class":"High-impact","domain":"RR","signals":["RR-A-01","SE-B-04"],"outcomes":["HB-01","HB-04"]},{"id":"CR-SC-01","name":"Overconfident clicker","slug":"cr-sc-01-overconfident-clicker","path":"/taxonomy/cohorts/cr-sc-01-overconfident-clicker","class":"Risky","domain":"SC","signals":["SC-B-01","SE-B-01"],"outcomes":["HB-01"]},{"id":"CR-IA-06","name":"Compromised account with privilege","slug":"cr-ia-06-compromised-account-with-privilege","path":"/taxonomy/cohorts/cr-ia-06-compromised-account-with-privilege","class":"Critical","domain":"IA","signals":["IA-T-07","IA-A-01"],"outcomes":["HB-02","HB-07"]}],"paths":[{"id":"SQ-ATO-01","name":"Phish to takeover","slug":"sq-ato-01-phish-to-takeover","path":"/taxonomy/sequences/sq-ato-01-phish-to-takeover","domain":"SE","domains":{"SE":3,"IA":2},"outcome":"HB-02","window":"72 hours","steps":[{"signal":"SE-T-02","stage":1,"name":"Real phish delivered","tactic":"Initial Access"},{"signal":"SE-B-04","stage":3,"name":"Link clicked","tactic":"Execution"},{"signal":"IA-B-04","stage":4,"name":"Unusual login","tactic":"Persistence"},{"signal":"IA-B-05","stage":4,"name":"New MFA device","tactic":"Persistence"},{"signal":"SE-T-06","stage":4,"name":"Malicious mail sent from the account","tactic":"Lateral Movement"}]},{"id":"SQ-ATO-02","name":"Leak to login","slug":"sq-ato-02-leak-to-login","path":"/taxonomy/sequences/sq-ato-02-leak-to-login","domain":"IA","domains":{"IA":3},"outcome":"HB-02","window":"30 days","steps":[{"signal":"IA-T-01","stage":1,"name":"Credential leaked","tactic":"Reconnaissance"},{"signal":"IA-T-04","stage":1,"name":"Failed-login spike","tactic":"Credential Access"},{"signal":"IA-B-04","stage":4,"name":"Unusual successful login","tactic":"Initial Access"}]},{"id":"SQ-ATO-03","name":"MFA fatigue","slug":"sq-ato-03-mfa-fatigue","path":"/taxonomy/sequences/sq-ato-03-mfa-fatigue","domain":"IA","domains":{"IA":3},"outcome":"HB-02","window":"24 hours","steps":[{"signal":"IA-T-04","stage":1,"name":"Repeated MFA prompts","tactic":"Credential Access"},{"signal":"IA-B-05","stage":3,"name":"Odd-hour approval","tactic":"Credential Access"},{"signal":"IA-B-05","stage":4,"name":"New factor registered","tactic":"Persistence"}]},{"id":"SQ-ATO-04","name":"Help-desk takeover","slug":"sq-ato-04-help-desk-takeover","path":"/taxonomy/sequences/sq-ato-04-help-desk-takeover","domain":"SE","domains":{"SE":2,"IA":2},"outcome":"HB-02","window":"24 hours","steps":[{"signal":"SE-T-04","stage":1,"name":"Voice pretext","tactic":"Initial Access"},{"signal":"SE-A-03","stage":3,"name":"MFA reset ticket","tactic":"Credential Access"},{"signal":"IA-B-05","stage":4,"name":"New device","tactic":"Persistence"},{"signal":"IA-A-01","stage":4,"name":"Admin login","tactic":"Privilege Escalation"}]},{"id":"SQ-RAN-01","name":"Click to execution","slug":"sq-ran-01-click-to-execution","path":"/taxonomy/sequences/sq-ran-01-click-to-execution","domain":"SE","domains":{"SE":1,"WC":1,"EP":3},"outcome":"HB-03","window":"7 days","steps":[{"signal":"SE-B-04","stage":3,"name":"Real phish clicked","tactic":"Initial Access"},{"signal":"WC-B-01","stage":3,"name":"Malicious site","tactic":"Execution"},{"signal":"EP-B-05","stage":4,"name":"Suspicious process","tactic":"Execution"},{"signal":"EP-T-04","stage":4,"name":"Credential-theft alert","tactic":"Credential Access"},{"signal":"EP-B-01","stage":4,"name":"EDR tampered","tactic":"Defense Impairment"}]},{"id":"SQ-RAN-02","name":"Stealer to ransomware","slug":"sq-ran-02-stealer-to-ransomware","path":"/taxonomy/sequences/sq-ran-02-stealer-to-ransomware","domain":"EP","domains":{"EP":1,"IA":3},"outcome":"HB-03","window":"95 days","steps":[{"signal":"EP-T-03","stage":1,"name":"Infostealer on device","tactic":"Credential Access"},{"signal":"IA-T-02","stage":1,"name":"Credentials for sale","tactic":"Resource Development"},{"signal":"IA-B-04","stage":4,"name":"Login from new geography","tactic":"Initial Access"},{"signal":"IA-A-04","stage":4,"name":"Backup console access","tactic":"Impact"}]},{"id":"SQ-DL-01","name":"Quiet exit","slug":"sq-dl-01-quiet-exit","path":"/taxonomy/sequences/sq-dl-01-quiet-exit","domain":"DH","domains":{"DH":3},"outcome":"HB-07","window":"30 days","steps":[{"signal":"DH-A-02","stage":1,"name":"Notice or role change","tactic":"Reconnaissance"},{"signal":"DH-B-01","stage":3,"name":"Bulk download above baseline","tactic":"Collection"},{"signal":"DH-B-08","stage":4,"name":"Personal cloud or USB","tactic":"Exfiltration"}]},{"id":"SQ-DL-02","name":"Shadow AI drift","slug":"sq-dl-02-shadow-ai-drift","path":"/taxonomy/sequences/sq-dl-02-shadow-ai-drift","domain":"AU","domains":{"AU":3},"outcome":"HB-09","window":"30 days","steps":[{"signal":"AU-B-01","stage":2,"name":"Unauthorized AI tool","tactic":"Collection"},{"signal":"AU-B-03","stage":2,"name":"Personal account login","tactic":"Collection"},{"signal":"AU-B-02","stage":3,"name":"Sensitive data in prompt","tactic":"Exfiltration"}]},{"id":"SQ-FR-01","name":"Approver under attack","slug":"sq-fr-01-approver-under-attack","path":"/taxonomy/sequences/sq-fr-01-approver-under-attack","domain":"SE","domains":{"SE":3,"DH":1},"outcome":"HB-05","window":"14 days","steps":[{"signal":"SE-T-03","stage":1,"name":"Impersonation delivered","tactic":"Initial Access"},{"signal":"SE-B-09","stage":3,"name":"Replied to sender","tactic":"Execution"},{"signal":"DH-B-06","stage":4,"name":"Forwarding rule created","tactic":"Collection"},{"signal":"SE-A-02","stage":4,"name":"Payee change approved","tactic":"Impact"}]},{"id":"SQ-PRV-01","name":"Dormant to dangerous","slug":"sq-prv-01-dormant-to-dangerous","path":"/taxonomy/sequences/sq-prv-01-dormant-to-dangerous","domain":"IA","domains":{"IA":3,"DH":1},"outcome":"HB-07","window":"14 days","steps":[{"signal":"IA-A-03","stage":1,"name":"Unused privilege","tactic":"Reconnaissance"},{"signal":"IA-B-04","stage":4,"name":"Unusual login","tactic":"Initial Access"},{"signal":"IA-A-02","stage":4,"name":"New cloud role","tactic":"Privilege Escalation"},{"signal":"DH-B-01","stage":4,"name":"Bulk access","tactic":"Collection"}]},{"id":"SQ-OAUTH-01","name":"Consent to compromise","slug":"sq-oauth-01-consent-to-compromise","path":"/taxonomy/sequences/sq-oauth-01-consent-to-compromise","domain":"WC","domains":{"WC":2,"IA":1,"DH":1},"outcome":"HB-08","window":"90 days","steps":[{"signal":"WC-B-04","stage":3,"name":"Risky consent granted","tactic":"Initial Access"},{"signal":"WC-T-02","stage":1,"name":"Vendor breached","tactic":"Resource Development"},{"signal":"IA-B-04","stage":4,"name":"Token used off-hours","tactic":"Persistence"},{"signal":"DH-B-01","stage":4,"name":"Bulk export","tactic":"Exfiltration"}]}],"outcomes":[{"id":"HB-01","name":"Phishing & social engineering","slug":"hb-01-phishing-and-social-engineering","path":"/taxonomy/breach-scenarios/hb-01-phishing-and-social-engineering","domains":{"SE":24,"WC":1,"AU":1,"RR":7,"SC":9}},{"id":"HB-02","name":"Credential abuse & account takeover","slug":"hb-02-credential-abuse-and-account-takeover","path":"/taxonomy/breach-scenarios/hb-02-credential-abuse-and-account-takeover","domains":{"SE":17,"IA":23,"EP":2,"WC":1,"RR":2,"AG":1}},{"id":"HB-03","name":"Ransomware & malware intrusion","slug":"hb-03-ransomware-and-malware-intrusion","path":"/taxonomy/breach-scenarios/hb-03-ransomware-and-malware-intrusion","domains":{"SE":8,"IA":7,"EP":11,"WC":4,"RR":1}},{"id":"HB-04","name":"Vulnerability exploitation","slug":"hb-04-vulnerability-exploitation","path":"/taxonomy/breach-scenarios/hb-04-vulnerability-exploitation","domains":{"EP":5,"RR":2}},{"id":"HB-05","name":"BEC & payment fraud","slug":"hb-05-bec-and-payment-fraud","path":"/taxonomy/breach-scenarios/hb-05-bec-and-payment-fraud","domains":{"SE":6,"IA":1,"WC":1,"AU":1,"RR":2}},{"id":"HB-06","name":"Data mishandling & error","slug":"hb-06-data-mishandling-and-error","path":"/taxonomy/breach-scenarios/hb-06-data-mishandling-and-error","domains":{"DH":14,"EP":1,"AU":1,"RR":11,"SC":2}},{"id":"HB-07","name":"Insider & privilege misuse","slug":"hb-07-insider-and-privilege-misuse","path":"/taxonomy/breach-scenarios/hb-07-insider-and-privilege-misuse","domains":{"IA":8,"DH":9,"EP":1,"RR":2}},{"id":"HB-08","name":"Third-party, OAuth & supply chain","slug":"hb-08-third-party-oauth-and-supply-chain","path":"/taxonomy/breach-scenarios/hb-08-third-party-oauth-and-supply-chain","domains":{"IA":1,"DH":1,"WC":6,"AG":8,"SC":1,"RR":1}},{"id":"HB-09","name":"Shadow AI & agent misuse","slug":"hb-09-shadow-ai-and-agent-misuse","path":"/taxonomy/breach-scenarios/hb-09-shadow-ai-and-agent-misuse","domains":{"WC":2,"AG":8,"AU":7,"RR":1}},{"id":"HB-10","name":"Lost & stolen devices","slug":"hb-10-lost-and-stolen-devices","path":"/taxonomy/breach-scenarios/hb-10-lost-and-stolen-devices","domains":{"DH":1,"EP":9,"WC":1,"RR":4}}]}