[{"k":"domain","s":"social-engineering","n":"Social engineering","i":"SE","x":"Email, SMS, voice, QR, deepfakes, help-desk pretexting"},{"k":"domain","s":"identity-and-access","n":"Identity and access","i":"IA","x":"Authentication, MFA, credentials, privilege"},{"k":"domain","s":"data-handling","n":"Data handling","i":"DH","x":"Sharing, movement, DLP, disposal, personal storage"},{"k":"domain","s":"endpoint-and-device","n":"Endpoint and device","i":"EP","x":"EDR, malware, USB, mobile, patching, physical"},{"k":"domain","s":"web-cloud-and-saas","n":"Web, cloud and SaaS","i":"WC","x":"Browsing, shadow IT, OAuth, third-party apps"},{"k":"domain","s":"ai-use","n":"AI use","i":"AU","x":"AI tools, prompts, outputs and the people who use them"},{"k":"domain","s":"ai-agents","n":"AI agents","i":"AG","x":"Agents and service identities, their scopes, logging and owners"},{"k":"domain","s":"security-culture","n":"Security culture","i":"SC","x":"Attitudes, confidence, friction, ambassadors, help-seeking"},{"k":"domain","s":"readiness-and-response","n":"Readiness and response","i":"RR","x":"Training currency, reporting, exercises, exceptions, incidents"},{"k":"dimension","s":"threat","n":"Threat","i":"T","x":"What reaches a person?"},{"k":"dimension","s":"access","n":"Access","i":"A","x":"What could they expose?"},{"k":"dimension","s":"behavior","n":"Behavior","i":"B","x":"What do they do under pressure?"},{"k":"level","s":"signals","n":"Level 1 · Signals","x":"Level 1 signals"},{"k":"level","s":"cohorts","n":"Level 2 · Cohorts","x":"Compound risks"},{"k":"level","s":"sequences","n":"Level 3 · Sequences","x":"Level 3 sequences"},{"k":"level","s":"breach-scenarios","n":"Level 4 · Breach scenarios","x":"Level 4 breach scenarios"},{"k":"stage","s":"clear","n":"Stage 0 · Clear","x":"The person has no active threat, access or risky-behavior signal inside any dwell window."},{"k":"stage","s":"exposed","n":"Stage 1 · Exposed","x":"The person is targeted by a real threat, or holds access an attacker would want, and has shown no risky behavior yet."},{"k":"stage","s":"susceptible","n":"Stage 2 · Susceptible","x":"The person has shown risky behavior in a simulation or in hygiene telemetry, and no real threat has reached them yet."},{"k":"stage","s":"exploited","n":"Stage 3 · Exploited","x":"The person acted on a real threat: a real click, a real consent, a real reply or a real credential submitted."},{"k":"stage","s":"suspected","n":"Stage 4 · Suspected","x":"Signals point to a compromise of the person's account or device that the SOC has not yet confirmed."},{"k":"stage","s":"confirmed","n":"Stage 5 · Confirmed","x":"The SOC opened an incident and attributed it to the person; when it closes, the person returns to Stage 1 for a 90-day watch."},{"k":"subject","s":"person","n":"Person"},{"k":"subject","s":"ai-agent","n":"AI agent"},{"k":"subject","s":"vendor","n":"Vendor"},{"k":"subject","s":"organization","n":"Organization"},{"k":"source","s":"awareness-and-phishing-simulation","n":"Awareness & phishing simulation","i":"SAT","x":"KnowBe4, Proofpoint"},{"k":"source","s":"identity-provider-and-mfa","n":"Identity provider & MFA","i":"IDP","x":"1Password, Duo, Entra ID, Okta"},{"k":"source","s":"email-security","n":"Email security","i":"EMAIL","x":"Abnormal, Defender, Mimecast, Proofpoint TAP"},{"k":"source","s":"endpoint-protection","n":"Endpoint protection","i":"EDR","x":"Carbon Black, CrowdStrike, Sophos"},{"k":"source","s":"web-casb-and-dlp","n":"Web, CASB & DLP","i":"SSE","x":"Code42, Netskope, Zscaler"},{"k":"source","s":"hr-system","n":"HR system","i":"HRIS","x":"SailPoint roster, Workday"},{"k":"source","s":"iga-pam-and-entitlements","n":"IGA, PAM & entitlements","i":"IGA","x":"CyberArk, Okta ISPM, SailPoint"},{"k":"source","s":"siem-soar-and-incident-tickets","n":"SIEM, SOAR & incident tickets","i":"SIEM","x":"Securonix, Sentinel, ServiceNow, Splunk"},{"k":"source","s":"breach-and-dark-web-exposure","n":"Breach & dark-web exposure","i":"EXPO","x":"Enzoic, SpyCloud"},{"k":"source","s":"vulnerability-management","n":"Vulnerability management","i":"VULN","x":"Rapid7, Tenable"},{"k":"source","s":"data-security-posture","n":"Data security posture","i":"DATA","x":"Purview, Varonis"},{"k":"source","s":"it-service-management","n":"IT service management","i":"ITSM","x":"Jira Service Management, ServiceNow"},{"k":"source","s":"finance-and-payments","n":"Finance & payments","i":"ERP","x":"Coupa, NetSuite, SAP"},{"k":"source","s":"device-management-mdm-uem","n":"Device management (MDM/UEM)","i":"MDM","x":"Intune, Jamf"},{"k":"source","s":"badge-and-physical-access","n":"Badge & physical access","i":"PHYS","x":"Genetec, Lenel"},{"k":"source","s":"pulse-survey","n":"Pulse survey","i":"SURVEY"},{"k":"source","s":"help-desk","n":"Help desk","i":"HELP","x":"Jira Service Management, ServiceNow"},{"k":"signal","s":"se-t-01-targeted-by-real-phishing","n":"Targeted by real phishing","i":"SE-T-01","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-t-02-real-phishing-delivered-to-inbox","n":"Real phishing delivered to inbox","i":"SE-T-02","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-t-03-receives-impersonation-attempts","n":"Receives impersonation attempts","i":"SE-T-03","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-t-04-receives-callback-or-voice-phishing","n":"Receives callback or voice phishing","i":"SE-T-04","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-t-05-targeted-by-mobile-or-sms-lures","n":"Targeted by mobile or SMS lures","i":"SE-T-05","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-t-06-account-sending-malicious-or-phishing-mail","n":"Account sending malicious or phishing mail","i":"SE-T-06","d":"SE","x":"Threat · Neutral"},{"k":"signal","s":"se-a-01-publicly-visible-role-exec-finance-hr","n":"Publicly visible role (exec, finance, HR)","i":"SE-A-01","d":"SE","x":"Access · Neutral"},{"k":"signal","s":"se-a-02-holds-payment-approval-authority","n":"Holds payment approval authority","i":"SE-A-02","d":"SE","x":"Access · Neutral"},{"k":"signal","s":"se-a-03-can-reset-passwords-or-mfa-for-others","n":"Can reset passwords or MFA for others","i":"SE-A-03","d":"SE","x":"Access · Neutral"},{"k":"signal","s":"se-b-01-clicks-simulated-phishing-links","n":"Clicks simulated phishing links","i":"SE-B-01","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-02-submits-credentials-to-simulations","n":"Submits credentials to simulations","i":"SE-B-02","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-03-opens-simulated-attachments","n":"Opens simulated attachments","i":"SE-B-03","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-04-clicks-links-in-real-phishing","n":"Clicks links in real phishing","i":"SE-B-04","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-05-deceived-by-voice-simulations","n":"Deceived by voice simulations","i":"SE-B-05","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-06-clicks-sms-simulations","n":"Clicks SMS simulations","i":"SE-B-06","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-07-scans-simulated-qr-codes","n":"Scans simulated QR codes","i":"SE-B-07","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-08-repeat-clicker-3-in-180-days","n":"Repeat clicker (3+ in 180 days)","i":"SE-B-08","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-09-replies-to-or-engages-with-suspicious-senders","n":"Replies to or engages with suspicious senders","i":"SE-B-09","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"se-b-10-reports-simulated-phishing","n":"Reports simulated phishing","i":"SE-B-10","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-11-reports-real-phishing","n":"Reports real phishing","i":"SE-B-11","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-12-reports-within-one-hour-of-delivery","n":"Reports within one hour of delivery","i":"SE-B-12","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-13-identifies-voice-simulations","n":"Identifies voice simulations","i":"SE-B-13","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-14-verifies-requests-out-of-band","n":"Verifies requests out of band","i":"SE-B-14","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-15-deletes-suspicious-mail-without-engaging","n":"Deletes suspicious mail without engaging","i":"SE-B-15","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-16-reports-safe-mail-as-suspicious","n":"Reports safe mail as suspicious","i":"SE-B-16","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-17-reports-sms-and-voice-lures","n":"Reports SMS and voice lures","i":"SE-B-17","d":"SE","x":"Behavior · Vigilant"},{"k":"signal","s":"se-b-18-grants-remote-access-to-an-unverified-party","n":"Grants remote access to an unverified party","i":"SE-B-18","d":"SE","x":"Behavior · Risky"},{"k":"signal","s":"ia-t-01-credentials-leaked-in-a-public-breach","n":"Credentials leaked in a public breach","i":"IA-T-01","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-02-credentials-flagged-as-compromised","n":"Credentials flagged as compromised","i":"IA-T-02","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-03-identity-or-pii-on-the-dark-web","n":"Identity or PII on the dark web","i":"IA-T-03","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-04-targeted-by-malicious-login-attempts","n":"Targeted by malicious login attempts","i":"IA-T-04","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-05-activity-from-anonymous-or-suspicious-ips","n":"Activity from anonymous or suspicious IPs","i":"IA-T-05","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-06-session-token-or-cookie-theft-indicators","n":"Session token or cookie theft indicators","i":"IA-T-06","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-t-07-account-flagged-compromised-by-the-identity-provider","n":"Account flagged compromised by the identity provider","i":"IA-T-07","d":"IA","x":"Threat · Neutral"},{"k":"signal","s":"ia-a-01-holds-admin-or-privileged-roles","n":"Holds admin or privileged roles","i":"IA-A-01","d":"IA","x":"Access · Neutral"},{"k":"signal","s":"ia-a-02-member-of-privileged-security-groups","n":"Member of privileged security groups","i":"IA-A-02","d":"IA","x":"Access · Neutral"},{"k":"signal","s":"ia-a-03-privileges-unused-for-90-days","n":"Privileges unused for 90+ days","i":"IA-A-03","d":"IA","x":"Access · Neutral"},{"k":"signal","s":"ia-a-04-standing-access-to-backup-or-storage-consoles","n":"Standing access to backup or storage consoles","i":"IA-A-04","d":"IA","x":"Access · Neutral"},{"k":"signal","s":"ia-a-05-contingent-worker-or-third-party-identity","n":"Contingent worker or third-party identity","i":"IA-A-05","d":"IA","x":"Access · Neutral"},{"k":"signal","s":"ia-b-01-removes-an-mfa-factor","n":"Removes an MFA factor","i":"IA-B-01","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-02-shares-credentials","n":"Shares credentials","i":"IA-B-02","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-03-exports-credentials-from-a-vault","n":"Exports credentials from a vault","i":"IA-B-03","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-04-signs-in-from-unusual-contexts","n":"Signs in from unusual contexts","i":"IA-B-04","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-05-approves-mfa-after-repeated-prompts","n":"Approves MFA after repeated prompts","i":"IA-B-05","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-06-reuses-passwords-across-systems","n":"Reuses passwords across systems","i":"IA-B-06","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-07-uses-sms-as-the-only-mfa-factor","n":"Uses SMS as the only MFA factor","i":"IA-B-07","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"ia-b-08-enrolls-phishing-resistant-mfa","n":"Enrolls phishing-resistant MFA","i":"IA-B-08","d":"IA","x":"Behavior · Vigilant"},{"k":"signal","s":"ia-b-09-uses-a-password-manager","n":"Uses a password manager","i":"IA-B-09","d":"IA","x":"Behavior · Vigilant"},{"k":"signal","s":"ia-b-10-signs-in-through-sso","n":"Signs in through SSO","i":"IA-B-10","d":"IA","x":"Behavior · Vigilant"},{"k":"signal","s":"ia-b-11-adopts-passwordless-sign-in","n":"Adopts passwordless sign-in","i":"IA-B-11","d":"IA","x":"Behavior · Vigilant"},{"k":"signal","s":"ia-b-12-reviews-and-removes-own-unused-access","n":"Reviews and removes own unused access","i":"IA-B-12","d":"IA","x":"Behavior · Vigilant"},{"k":"signal","s":"ia-b-13-attempts-to-bypass-mfa","n":"Attempts to bypass MFA","i":"IA-B-13","d":"IA","x":"Behavior · Risky"},{"k":"signal","s":"dh-a-01-access-to-sensitive-data-repositories","n":"Access to sensitive data repositories","i":"DH-A-01","d":"DH","x":"Access · Neutral"},{"k":"signal","s":"dh-a-02-in-a-notice-period-or-role-change","n":"In a notice period or role change","i":"DH-A-02","d":"DH","x":"Access · Neutral"},{"k":"signal","s":"dh-a-03-handles-regulated-data-pci-phi-pii","n":"Handles regulated data (PCI, PHI, PII)","i":"DH-A-03","d":"DH","x":"Access · Neutral"},{"k":"signal","s":"dh-b-01-downloads-data-in-bulk-above-own-baseline","n":"Downloads data in bulk above own baseline","i":"DH-B-01","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-02-uploads-data-in-bulk","n":"Uploads data in bulk","i":"DH-B-02","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-03-shares-sensitive-data-externally","n":"Shares sensitive data externally","i":"DH-B-03","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-04-violates-data-handling-policy","n":"Violates data-handling policy","i":"DH-B-04","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-05-attempts-to-bypass-dlp","n":"Attempts to bypass DLP","i":"DH-B-05","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-06-forwards-work-email-to-personal-accounts","n":"Forwards work email to personal accounts","i":"DH-B-06","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-07-misdelivers-email-or-shares-to-the-wrong-party","n":"Misdelivers email or shares to the wrong party","i":"DH-B-07","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-08-stores-work-data-in-personal-cloud","n":"Stores work data in personal cloud","i":"DH-B-08","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"dh-b-09-disposes-of-data-and-devices-securely","n":"Disposes of data and devices securely","i":"DH-B-09","d":"DH","x":"Behavior · Vigilant"},{"k":"signal","s":"dh-b-10-classifies-and-labels-documents","n":"Classifies and labels documents","i":"DH-B-10","d":"DH","x":"Behavior · Vigilant"},{"k":"signal","s":"dh-b-11-completes-data-handling-training","n":"Completes data-handling training","i":"DH-B-11","d":"DH","x":"Behavior · Vigilant"},{"k":"signal","s":"dh-b-12-blocked-data-transfer-attempts","n":"Blocked data transfer attempts","i":"DH-B-12","d":"DH","x":"Behavior · Risky"},{"k":"signal","s":"ep-t-01-malware-detected-on-their-device","n":"Malware detected on their device","i":"EP-T-01","d":"EP","x":"Threat · Neutral"},{"k":"signal","s":"ep-t-02-exploitable-vulnerability-on-their-device","n":"Exploitable vulnerability on their device","i":"EP-T-02","d":"EP","x":"Threat · Neutral"},{"k":"signal","s":"ep-t-03-infostealer-indicators-on-a-device-they-use","n":"Infostealer indicators on a device they use","i":"EP-T-03","d":"EP","x":"Threat · Neutral"},{"k":"signal","s":"ep-t-04-credential-theft-lateral-movement-or-privilege-escalation-alert-on-their-device","n":"Credential-theft, lateral-movement or privilege-escalation alert on their device","i":"EP-T-04","d":"EP","x":"Threat · Neutral"},{"k":"signal","s":"ep-t-05-device-quarantined-or-flagged-compromised","n":"Device quarantined or flagged compromised","i":"EP-T-05","d":"EP","x":"Threat · Neutral"},{"k":"signal","s":"ep-a-01-local-admin-rights-on-endpoints","n":"Local admin rights on endpoints","i":"EP-A-01","d":"EP","x":"Access · Neutral"},{"k":"signal","s":"ep-a-02-owns-internet-facing-or-critical-systems","n":"Owns internet-facing or critical systems","i":"EP-A-02","d":"EP","x":"Access · Neutral"},{"k":"signal","s":"ep-b-01-disables-or-tampers-with-edr","n":"Disables or tampers with EDR","i":"EP-B-01","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-02-connects-usb-storage","n":"Connects USB storage","i":"EP-B-02","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-03-uses-a-rooted-or-jailbroken-device","n":"Uses a rooted or jailbroken device","i":"EP-B-03","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-04-device-fails-mdm-or-encryption-policy","n":"Device fails MDM or encryption policy","i":"EP-B-04","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-05-runs-suspicious-processes-or-unapproved-software","n":"Runs suspicious processes or unapproved software","i":"EP-B-05","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-06-defers-patches-repeatedly","n":"Defers patches repeatedly","i":"EP-B-06","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-07-leaves-devices-unlocked-or-unattended","n":"Leaves devices unlocked or unattended","i":"EP-B-07","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-08-lost-or-stolen-device-reported-late","n":"Lost or stolen device reported late","i":"EP-B-08","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-09-tailgates-or-shares-badge-access","n":"Tailgates or shares badge access","i":"EP-B-09","d":"EP","x":"Behavior · Risky"},{"k":"signal","s":"ep-b-10-installs-updates-promptly","n":"Installs updates promptly","i":"EP-B-10","d":"EP","x":"Behavior · Vigilant"},{"k":"signal","s":"ep-b-11-keeps-a-compliant-protected-device","n":"Keeps a compliant, protected device","i":"EP-B-11","d":"EP","x":"Behavior · Vigilant"},{"k":"signal","s":"ep-b-12-reports-lost-devices-within-24-hours","n":"Reports lost devices within 24 hours","i":"EP-B-12","d":"EP","x":"Behavior · Vigilant"},{"k":"signal","s":"wc-t-01-lookalike-domains-registered-against-the-brand","n":"Lookalike domains registered against the brand","i":"WC-T-01","d":"WC","x":"Threat · Neutral"},{"k":"signal","s":"wc-t-02-third-party-app-they-use-was-breached","n":"Third-party app they use was breached","i":"WC-T-02","d":"WC","x":"Threat · Neutral"},{"k":"signal","s":"wc-a-01-owns-third-party-integrations-or-oauth-apps","n":"Owns third-party integrations or OAuth apps","i":"WC-A-01","d":"WC","x":"Access · Neutral"},{"k":"signal","s":"wc-b-01-visits-known-malicious-websites","n":"Visits known-malicious websites","i":"WC-B-01","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-02-bypasses-web-filtering","n":"Bypasses web filtering","i":"WC-B-02","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-03-visits-unauthorized-websites","n":"Visits unauthorized websites","i":"WC-B-03","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-04-grants-risky-oauth-permissions","n":"Grants risky OAuth permissions","i":"WC-B-04","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-05-uses-unauthorized-saas-apps","n":"Uses unauthorized SaaS apps","i":"WC-B-05","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-06-installs-unvetted-browser-extensions","n":"Installs unvetted browser extensions","i":"WC-B-06","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-07-uses-public-wi-fi-without-vpn","n":"Uses public Wi-Fi without VPN","i":"WC-B-07","d":"WC","x":"Behavior · Risky"},{"k":"signal","s":"wc-b-08-downloads-from-trusted-sources-only","n":"Downloads from trusted sources only","i":"WC-B-08","d":"WC","x":"Behavior · Vigilant"},{"k":"signal","s":"wc-b-09-reviews-and-revokes-own-app-grants","n":"Reviews and revokes own app grants","i":"WC-B-09","d":"WC","x":"Behavior · Vigilant"},{"k":"signal","s":"au-t-01-targeted-by-deepfake-or-ai-generated-lures","n":"Targeted by deepfake or AI-generated lures","i":"AU-T-01","d":"AU","x":"Threat · Neutral"},{"k":"signal","s":"ag-a-01-owns-ai-agents-or-service-identities","n":"Owns AI agents or service identities","i":"AG-A-01","d":"AG","x":"Access · Neutral"},{"k":"signal","s":"au-a-01-administers-an-enterprise-ai-platform","n":"Administers an enterprise AI platform","i":"AU-A-01","d":"AU","x":"Access · Neutral"},{"k":"signal","s":"au-b-01-uses-unauthorized-ai-tools","n":"Uses unauthorized AI tools","i":"AU-B-01","d":"AU","x":"Behavior · Risky"},{"k":"signal","s":"au-b-02-puts-sensitive-data-in-ai-prompts","n":"Puts sensitive data in AI prompts","i":"AU-B-02","d":"AU","x":"Behavior · Risky"},{"k":"signal","s":"au-b-03-uses-personal-accounts-on-ai-platforms","n":"Uses personal accounts on AI platforms","i":"AU-B-03","d":"AU","x":"Behavior · Risky"},{"k":"signal","s":"ag-b-01-grants-agents-broad-or-standing-permissions","n":"Grants agents broad or standing permissions","i":"AG-B-01","d":"AG","x":"Behavior · Risky"},{"k":"signal","s":"au-b-04-uses-the-sanctioned-ai-tools","n":"Uses the sanctioned AI tools","i":"AU-B-04","d":"AU","x":"Behavior · Vigilant"},{"k":"signal","s":"ag-b-02-registers-agents-with-a-named-owner","n":"Registers agents with a named owner","i":"AG-B-02","d":"AG","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-01-training-past-due","n":"Training past due","i":"RR-B-01","d":"RR","x":"Behavior · Risky"},{"k":"signal","s":"rr-b-02-fails-training-assessments","n":"Fails training assessments","i":"RR-B-02","d":"RR","x":"Behavior · Risky"},{"k":"signal","s":"sc-b-01-overconfident-self-rated-ability-exceeds-results","n":"Overconfident: self-rated ability exceeds results","i":"SC-B-01","d":"SC","x":"Behavior · Risky"},{"k":"signal","s":"rr-b-03-repeat-security-related-help-desk-tickets","n":"Repeat security-related help desk tickets","i":"RR-B-03","d":"RR","x":"Behavior · Risky"},{"k":"signal","s":"rr-b-04-completes-security-training","n":"Completes security training","i":"RR-B-04","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-05-completes-role-based-training","n":"Completes role-based training","i":"RR-B-05","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-02-takes-voluntary-training","n":"Takes voluntary training","i":"SC-B-02","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-03-retains-knowledge-over-time","n":"Retains knowledge over time","i":"SC-B-03","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-04-joins-awareness-events-and-exercises","n":"Joins awareness events and exercises","i":"SC-B-04","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-05-responds-to-the-culture-pulse","n":"Responds to the culture pulse","i":"SC-B-05","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-06-asks-security-for-help-before-a-project","n":"Asks security for help before a project","i":"SC-B-06","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-07-serves-as-a-security-ambassador","n":"Serves as a security ambassador","i":"SC-B-07","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-06-reports-a-real-incident-or-near-miss","n":"Reports a real incident or near miss","i":"RR-B-06","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-07-acknowledges-security-policies","n":"Acknowledges security policies","i":"RR-B-07","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-08-starts-assigned-training-promptly","n":"Starts assigned training promptly","i":"RR-B-08","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-09-technical-policy-violations","n":"Technical policy violations","i":"RR-B-09","d":"RR","x":"Behavior · Risky"},{"k":"signal","s":"rr-t-01-incident-opened-and-attributed-to-the-person","n":"Incident opened and attributed to the person","i":"RR-T-01","d":"RR","x":"Threat · Neutral"},{"k":"signal","s":"au-b-05-acts-on-ai-output-without-validation","n":"Acts on AI output without validation","i":"AU-B-05","d":"AU","x":"Behavior · Risky"},{"k":"signal","s":"au-b-06-validates-ai-output-against-trusted-sources","n":"Validates AI output against trusted sources","i":"AU-B-06","d":"AU","x":"Behavior · Vigilant"},{"k":"signal","s":"ag-a-02-agent-holds-broad-or-standing-permissions","n":"Agent holds broad or standing permissions","i":"AG-A-02","d":"AG","x":"Access · Neutral"},{"k":"signal","s":"ag-t-01-agent-credentials-or-tokens-exposed","n":"Agent credentials or tokens exposed","i":"AG-T-01","d":"AG","x":"Threat · Neutral"},{"k":"signal","s":"ag-b-03-launches-an-agent-without-approval","n":"Launches an agent without approval","i":"AG-B-03","d":"AG","x":"Behavior · Risky"},{"k":"signal","s":"ag-b-04-agent-runs-without-logging-enabled","n":"Agent runs without logging enabled","i":"AG-B-04","d":"AG","x":"Behavior · Risky"},{"k":"signal","s":"ag-b-05-agent-acts-outside-its-assigned-role","n":"Agent acts outside its assigned role","i":"AG-B-05","d":"AG","x":"Behavior · Risky"},{"k":"signal","s":"ag-b-06-terminates-an-agent-after-its-task-completes","n":"Terminates an agent after its task completes","i":"AG-B-06","d":"AG","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-08-rates-the-security-team-positively-in-the-pulse","n":"Rates the security team positively in the pulse","i":"SC-B-08","d":"SC","x":"Behavior · Vigilant"},{"k":"signal","s":"sc-b-09-reports-friction-with-security-controls","n":"Reports friction with security controls","i":"SC-B-09","d":"SC","x":"Behavior · Risky"},{"k":"signal","s":"rr-b-10-responds-to-emergency-notification-tests","n":"Responds to emergency notification tests","i":"RR-B-10","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-b-11-participates-in-incident-exercises","n":"Participates in incident exercises","i":"RR-B-11","d":"RR","x":"Behavior · Vigilant"},{"k":"signal","s":"rr-a-01-holds-an-active-policy-exception","n":"Holds an active policy exception","i":"RR-A-01","d":"RR","x":"Access · Neutral"},{"k":"cohort","s":"cr-se-01-clicks-simulations-while-targeted-by-real-phishing","n":"Clicks simulations while targeted by real phishing","i":"CR-SE-01","d":"SE","x":"Targeted"},{"k":"cohort","s":"cr-se-02-real-phish-clicker-with-privileged-access","n":"Real-phish clicker with privileged access","i":"CR-SE-02","d":"SE","x":"High-impact"},{"k":"cohort","s":"cr-se-03-social-engineering-critical-triad","n":"Social engineering critical triad","i":"CR-SE-03","d":"SE","x":"Critical"},{"k":"cohort","s":"cr-se-04-silent-repeat-clicker","n":"Silent repeat clicker","i":"CR-SE-04","d":"SE","x":"Risky"},{"k":"cohort","s":"cr-se-05-help-desk-staff-deceived-by-voice-simulations","n":"Help-desk staff deceived by voice simulations","i":"CR-SE-05","d":"SE","x":"High-impact"},{"k":"cohort","s":"cr-se-06-payment-approver-fooled-by-impersonation","n":"Payment approver fooled by impersonation","i":"CR-SE-06","d":"SE","x":"High-impact"},{"k":"cohort","s":"cr-se-07-human-sensor","n":"Human sensor","i":"CR-SE-07","d":"SE","x":"Vigilant"},{"k":"cohort","s":"cr-ia-01-exposed-credentials-without-strong-mfa","n":"Exposed credentials without strong MFA","i":"CR-IA-01","d":"IA","x":"Targeted"},{"k":"cohort","s":"cr-ia-02-admin-who-removed-mfa","n":"Admin who removed MFA","i":"CR-IA-02","d":"IA","x":"High-impact"},{"k":"cohort","s":"cr-ia-03-credential-sharer-with-privilege","n":"Credential sharer with privilege","i":"CR-IA-03","d":"IA","x":"High-impact"},{"k":"cohort","s":"cr-ia-04-dormant-privilege-unusual-login","n":"Dormant privilege, unusual login","i":"CR-IA-04","d":"IA","x":"High-impact"},{"k":"cohort","s":"cr-ia-05-keyholder-with-standing-backup-access-and-reuse","n":"Keyholder with standing backup access and reuse","i":"CR-IA-05","d":"IA","x":"Critical"},{"k":"cohort","s":"cr-dh-01-bulk-mover-in-a-notice-period","n":"Bulk mover in a notice period","i":"CR-DH-01","d":"DH","x":"High-impact"},{"k":"cohort","s":"cr-dh-02-sensitive-sharer-with-sensitive-access","n":"Sensitive sharer with sensitive access","i":"CR-DH-02","d":"DH","x":"High-impact"},{"k":"cohort","s":"cr-ep-01-edr-tamperer-with-local-admin","n":"EDR tamperer with local admin","i":"CR-EP-01","d":"EP","x":"High-impact"},{"k":"cohort","s":"cr-ep-02-malicious-site-visitor-on-a-vulnerable-device","n":"Malicious-site visitor on a vulnerable device","i":"CR-EP-02","d":"EP","x":"Targeted"},{"k":"cohort","s":"cr-ep-03-patch-deferrer-owning-internet-facing-systems","n":"Patch deferrer owning internet-facing systems","i":"CR-EP-03","d":"EP","x":"High-impact"},{"k":"cohort","s":"cr-wc-01-risky-oauth-grant-with-sensitive-access","n":"Risky OAuth grant with sensitive access","i":"CR-WC-01","d":"WC","x":"High-impact"},{"k":"cohort","s":"cr-au-01-shadow-ai-with-sensitive-data","n":"Shadow AI with sensitive data","i":"CR-AU-01","d":"AU","x":"Risky"},{"k":"cohort","s":"cr-ag-02-over-scoped-agent-without-logging","n":"Over-scoped agent without logging","i":"CR-AG-02","d":"AG","x":"Critical"},{"k":"cohort","s":"cr-ag-01-risky-owner-of-ai-agents","n":"Risky owner of AI agents","i":"CR-AG-01","d":"AG","x":"High-impact"},{"k":"cohort","s":"cr-rr-01-exception-holder-who-clicks","n":"Exception holder who clicks","i":"CR-RR-01","d":"RR","x":"High-impact"},{"k":"cohort","s":"cr-sc-01-overconfident-clicker","n":"Overconfident clicker","i":"CR-SC-01","d":"SC","x":"Risky"},{"k":"cohort","s":"cr-ia-06-compromised-account-with-privilege","n":"Compromised account with privilege","i":"CR-IA-06","d":"IA","x":"Critical"},{"k":"path","s":"sq-ato-01-phish-to-takeover","n":"Phish to takeover","i":"SQ-ATO-01","x":"72 hours"},{"k":"path","s":"sq-ato-02-leak-to-login","n":"Leak to login","i":"SQ-ATO-02","x":"30 days"},{"k":"path","s":"sq-ato-03-mfa-fatigue","n":"MFA fatigue","i":"SQ-ATO-03","x":"24 hours"},{"k":"path","s":"sq-ato-04-help-desk-takeover","n":"Help-desk takeover","i":"SQ-ATO-04","x":"24 hours"},{"k":"path","s":"sq-ran-01-click-to-execution","n":"Click to execution","i":"SQ-RAN-01","x":"7 days"},{"k":"path","s":"sq-ran-02-stealer-to-ransomware","n":"Stealer to ransomware","i":"SQ-RAN-02","x":"95 days"},{"k":"path","s":"sq-dl-01-quiet-exit","n":"Quiet exit","i":"SQ-DL-01","x":"30 days"},{"k":"path","s":"sq-dl-02-shadow-ai-drift","n":"Shadow AI drift","i":"SQ-DL-02","x":"30 days"},{"k":"path","s":"sq-fr-01-approver-under-attack","n":"Approver under attack","i":"SQ-FR-01","x":"14 days"},{"k":"path","s":"sq-prv-01-dormant-to-dangerous","n":"Dormant to dangerous","i":"SQ-PRV-01","x":"14 days"},{"k":"path","s":"sq-oauth-01-consent-to-compromise","n":"Consent to compromise","i":"SQ-OAUTH-01","x":"90 days"},{"k":"outcome","s":"hb-01-phishing-and-social-engineering","n":"Phishing & social engineering","i":"HB-01","x":"DBIR pattern: Social Engineering · VERIS: Social"},{"k":"outcome","s":"hb-02-credential-abuse-and-account-takeover","n":"Credential abuse & account takeover","i":"HB-02","x":"DBIR: Basic Web Application Attacks · VERIS: Hacking"},{"k":"outcome","s":"hb-03-ransomware-and-malware-intrusion","n":"Ransomware & malware intrusion","i":"HB-03","x":"DBIR: System Intrusion · VERIS: Malware"},{"k":"outcome","s":"hb-04-vulnerability-exploitation","n":"Vulnerability exploitation","i":"HB-04","x":"DBIR: System Intrusion · VERIS: Hacking"},{"k":"outcome","s":"hb-05-bec-and-payment-fraud","n":"BEC & payment fraud","i":"HB-05","x":"FBI IC3: BEC · VERIS: Social, pretexting"},{"k":"outcome","s":"hb-06-data-mishandling-and-error","n":"Data mishandling & error","i":"HB-06","x":"DBIR: Miscellaneous Errors · VERIS: Error"},{"k":"outcome","s":"hb-07-insider-and-privilege-misuse","n":"Insider & privilege misuse","i":"HB-07","x":"DBIR: Privilege Misuse · VERIS: Misuse"},{"k":"outcome","s":"hb-08-third-party-oauth-and-supply-chain","n":"Third-party, OAuth & supply chain","i":"HB-08","x":"DBIR third-party involvement · ATT&CK Trusted Relationship"},{"k":"outcome","s":"hb-09-shadow-ai-and-agent-misuse","n":"Shadow AI & agent misuse","i":"HB-09","x":"DBIR 2026 AI findings · NIST AI RMF"},{"k":"outcome","s":"hb-10-lost-and-stolen-devices","n":"Lost & stolen devices","i":"HB-10","x":"DBIR: Lost and Stolen Assets · VERIS: Physical"},{"k":"term","s":"human-risk","n":"Human risk","i":"HRM-CORE-01","x":"core"},{"k":"term","s":"human-risk-management","n":"Human risk management","i":"HRM-CORE-02","x":"core"},{"k":"term","s":"human-risk-management-framework","n":"Human Risk Management Framework","i":"HRM-CORE-03","x":"core"},{"k":"term","s":"threat-access-behavior-model","n":"Threat × Access × Behavior model","i":"HRM-CORE-04","x":"core"},{"k":"term","s":"human-risk-score","n":"Human risk score","i":"HRM-CORE-05","x":"core"},{"k":"term","s":"workforce","n":"Workforce","i":"HRM-CORE-06","x":"core"},{"k":"term","s":"risk-appetite","n":"Risk appetite","i":"HRM-CORE-07","x":"core"},{"k":"term","s":"risky-behavior","n":"Risky behavior","i":"HRM-CORE-08","x":"core"},{"k":"term","s":"vigilant-behavior","n":"Vigilant behavior","i":"HRM-CORE-09","x":"core"},{"k":"term","s":"security-awareness","n":"Security awareness","i":"HRM-CORE-10","x":"core"},{"k":"term","s":"targeted-cohort","n":"Targeted cohort","i":"HRM-CON-01","x":"construct"},{"k":"term","s":"high-impact-cohort","n":"High-impact cohort","i":"HRM-CON-02","x":"construct"},{"k":"term","s":"critical-cohort","n":"Critical cohort","i":"HRM-CON-03","x":"construct"},{"k":"term","s":"risky-cohort","n":"Risky cohort","i":"HRM-CON-04","x":"construct"},{"k":"term","s":"vigilant-cohort","n":"Vigilant cohort","i":"HRM-CON-05","x":"construct"},{"k":"term","s":"sequence","n":"Sequence","i":"HRM-CON-06","x":"construct"},{"k":"term","s":"detection-window","n":"Detection window","i":"HRM-CON-07","x":"construct"},{"k":"term","s":"dwell-window","n":"Dwell window","i":"HRM-CON-08","x":"construct"},{"k":"term","s":"intervention","n":"Intervention","i":"HRM-INT-01","x":"intervention"},{"k":"term","s":"awareness-training","n":"Awareness training","i":"HRM-INT-02","d":"RR","x":"intervention"},{"k":"term","s":"role-based-training","n":"Role-based training","i":"HRM-INT-03","d":"RR","x":"intervention"},{"k":"term","s":"behavior-triggered-training","n":"Behavior-triggered training","i":"HRM-INT-04","x":"intervention"},{"k":"term","s":"phishing-simulation","n":"Phishing simulation","i":"HRM-INT-05","d":"SE","x":"intervention"},{"k":"term","s":"multichannel-simulation","n":"Multichannel simulation","i":"HRM-INT-06","d":"SE","x":"intervention"},{"k":"term","s":"deepfake-simulation","n":"Deepfake simulation","i":"HRM-INT-07","d":"SE","x":"intervention"},{"k":"term","s":"nudge","n":"Nudge","i":"HRM-INT-08","x":"intervention"},{"k":"term","s":"just-in-time-coaching","n":"Just-in-time coaching","i":"HRM-INT-09","x":"intervention"},{"k":"term","s":"microlearning","n":"Microlearning","i":"HRM-INT-10","x":"intervention"},{"k":"term","s":"security-champions-program","n":"Security champions program","i":"HRM-INT-11","d":"SC","x":"intervention"},{"k":"term","s":"policy-acknowledgment","n":"Policy acknowledgment","i":"HRM-INT-12","d":"RR","x":"intervention"},{"k":"term","s":"tabletop-exercise","n":"Tabletop exercise","i":"HRM-INT-13","d":"RR","x":"intervention"},{"k":"term","s":"notification-drill","n":"Notification drill","i":"HRM-INT-14","d":"RR","x":"intervention"},{"k":"term","s":"adaptive-control","n":"Adaptive control","i":"HRM-INT-15","x":"intervention"},{"k":"term","s":"step-up-authentication","n":"Step-up authentication","i":"HRM-INT-16","d":"IA","x":"intervention"},{"k":"term","s":"access-revocation","n":"Access revocation","i":"HRM-INT-17","d":"IA","x":"intervention"},{"k":"term","s":"playbook","n":"Playbook","i":"HRM-INT-18","x":"intervention"},{"k":"term","s":"automated-response","n":"Automated response","i":"HRM-INT-19","x":"intervention"},{"k":"term","s":"targeted-campaign","n":"Targeted campaign","i":"HRM-INT-20","x":"intervention"},{"k":"term","s":"culture-pulse-survey","n":"Culture pulse survey","i":"HRM-INT-21","d":"SC","x":"intervention"},{"k":"term","s":"recognition","n":"Recognition","i":"HRM-INT-22","d":"SC","x":"intervention"},{"k":"term","s":"help-before-you-build-channel","n":"Help-before-you-build channel","i":"HRM-INT-23","d":"SC","x":"intervention"},{"k":"term","s":"exception-review","n":"Exception review","i":"HRM-INT-24","d":"RR","x":"intervention"},{"k":"term","s":"click-rate","n":"Click rate","i":"HRM-MEAS-01","d":"SE","x":"measurement"},{"k":"term","s":"report-rate","n":"Report rate","i":"HRM-MEAS-02","d":"SE","x":"measurement"},{"k":"term","s":"report-to-click-ratio","n":"Report-to-click ratio","i":"HRM-MEAS-03","d":"RR","x":"measurement"},{"k":"term","s":"resilience-ratio","n":"Resilience ratio","i":"HRM-MEAS-04","d":"SE","x":"measurement"},{"k":"term","s":"repeat-clicker","n":"Repeat clicker","i":"HRM-MEAS-05","d":"SE","x":"measurement"},{"k":"term","s":"time-to-report","n":"Time to report","i":"HRM-MEAS-06","d":"RR","x":"measurement"},{"k":"term","s":"training-currency","n":"Training currency","i":"HRM-MEAS-07","d":"RR","x":"measurement"},{"k":"term","s":"phishing-resistant-mfa-coverage","n":"Phishing-resistant MFA coverage","i":"HRM-MEAS-08","d":"IA","x":"measurement"},{"k":"term","s":"visibility-gap","n":"Visibility gap","i":"HRM-MEAS-09","x":"measurement"},{"k":"term","s":"coverage","n":"Coverage","i":"HRM-MEAS-10","x":"measurement"},{"k":"term","s":"grade","n":"Grade","i":"HRM-MEAS-11","x":"measurement"},{"k":"term","s":"hrm-benchmark","n":"HRM Benchmark","i":"HRM-MEAS-12","x":"measurement"},{"k":"term","s":"cohort-minimum","n":"Cohort minimum","i":"HRM-MEAS-13","x":"measurement"},{"k":"term","s":"signal-to-action-time","n":"Signal-to-action time","i":"HRM-MEAS-14","x":"measurement"},{"k":"term","s":"incident-lift","n":"Incident lift","i":"HRM-MEAS-15","x":"measurement"},{"k":"term","s":"avoided-loss","n":"Avoided loss","i":"HRM-MEAS-16","x":"measurement"},{"k":"term","s":"key-risk-indicator","n":"Key risk indicator","i":"HRM-MEAS-17","x":"measurement"},{"k":"term","s":"security-nps","n":"Security NPS","i":"HRM-MEAS-18","d":"SC","x":"measurement"},{"k":"term","s":"perceived-friction-rate","n":"Perceived friction rate","i":"HRM-MEAS-19","d":"SC","x":"measurement"},{"k":"term","s":"confidence-ability-gap","n":"Confidence-ability gap","i":"HRM-MEAS-20","d":"SC","x":"measurement"},{"k":"term","s":"maturity-level","n":"Maturity level","i":"HRM-MEAS-21","x":"measurement"},{"k":"term","s":"practice-score","n":"Practice score","i":"HRM-MEAS-22","x":"measurement"},{"k":"term","s":"human-risk-quantification","n":"Human risk quantification","i":"HRM-MEAS-23","x":"measurement"},{"k":"term","s":"human-element-share","n":"Human element share","i":"HRM-MEAS-24","x":"measurement"},{"k":"term","s":"human-risk-ownership","n":"Human risk ownership","i":"HRM-GOV-01","x":"governance"},{"k":"term","s":"hr-data-use-agreement","n":"HR data-use agreement","i":"HRM-GOV-02","x":"governance"},{"k":"term","s":"person-level-data-governance","n":"Person-level data governance","i":"HRM-GOV-03","x":"governance"},{"k":"term","s":"board-reporting","n":"Board reporting","i":"HRM-GOV-04","x":"governance"},{"k":"term","s":"risk-register-entry","n":"Risk register entry","i":"HRM-GOV-05","x":"governance"},{"k":"term","s":"consent-and-privacy-basis","n":"Consent and privacy basis","i":"HRM-GOV-06","x":"governance"},{"k":"term","s":"standards-crosswalk","n":"Standards crosswalk","i":"HRM-GOV-07","x":"governance"},{"k":"term","s":"nist-csf-tier","n":"NIST CSF tier","i":"HRM-GOV-08","x":"governance"},{"k":"term","s":"implementation-group","n":"Implementation group","i":"HRM-GOV-09","x":"governance"},{"k":"term","s":"audit-evidence","n":"Audit evidence","i":"HRM-GOV-10","x":"governance"},{"k":"term","s":"policy-exception","n":"Policy exception","i":"HRM-GOV-11","d":"RR","x":"governance"},{"k":"term","s":"insider-risk","n":"Insider risk","i":"HRM-GOV-12","x":"governance"},{"k":"term","s":"third-party-risk","n":"Third-party risk","i":"HRM-GOV-13","d":"WC","x":"governance"},{"k":"term","s":"learning-program","n":"Learning program","i":"HRM-GOV-14","x":"governance"},{"k":"term","s":"human-risk-management-platform","n":"Human risk management platform","i":"HRM-TECH-01","x":"technology"},{"k":"term","s":"human-risk-console","n":"Human risk console","i":"HRM-TECH-02","x":"technology"},{"k":"term","s":"connector","n":"Connector","i":"HRM-TECH-03","x":"technology"},{"k":"term","s":"telemetry","n":"Telemetry","i":"HRM-TECH-04","x":"technology"},{"k":"term","s":"identity-provider","n":"Identity provider","i":"HRM-TECH-05","d":"IA","x":"technology"},{"k":"term","s":"email-security-gateway","n":"Email security gateway","i":"HRM-TECH-06","d":"SE","x":"technology"},{"k":"term","s":"endpoint-detection-and-response","n":"Endpoint detection and response","i":"HRM-TECH-07","d":"EP","x":"technology"},{"k":"term","s":"security-service-edge","n":"Security service edge","i":"HRM-TECH-08","d":"WC","x":"technology"},{"k":"term","s":"identity-governance-and-administration","n":"Identity governance and administration","i":"HRM-TECH-09","d":"IA","x":"technology"},{"k":"term","s":"siem","n":"SIEM","i":"HRM-TECH-10","d":"RR","x":"technology"},{"k":"term","s":"breach-exposure-feed","n":"Breach exposure feed","i":"HRM-TECH-11","d":"IA","x":"technology"},{"k":"term","s":"ai-agent-inventory","n":"AI agent inventory","i":"HRM-TECH-12","d":"AG","x":"technology"},{"k":"indicator","s":"i-0001-opens-real-phishing-emails","n":"Opens real phishing emails","i":"I.0001","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0002-receives-real-phishing-emails","n":"Receives real phishing emails","i":"I.0002","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0003-receives-real-phishing-emails-with-malware","n":"Receives real phishing emails with malware","i":"I.0003","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0004-target-of-real-phishing-emails","n":"Target of real phishing emails","i":"I.0004","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0005-clicks-links-in-real-phishing-emails","n":"Clicks links in real phishing emails","i":"I.0005","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0006-enables-phishing-reporter-buttons","n":"Enables phishing reporter buttons","i":"I.0006","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0007-reports-suspected-phishing-or-other-suspicious-emails-to-security-for-ana","n":"Reports suspected phishing or other suspicious emails to security for analysis","i":"I.0007","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0008-reports-suspected-phishing-emails-that-are-tagged-as-suspicious","n":"Reports suspected phishing emails that are tagged as suspicious","i":"I.0008","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0009-reports-real-phishing-emails","n":"Reports real phishing emails","i":"I.0009","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0010-reports-real-phishing-emails-resulting-in-quarantine","n":"Reports real phishing emails resulting in quarantine","i":"I.0010","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0011-reports-legitimate-emails-as-phishing-emails","n":"Reports legitimate emails as phishing emails","i":"I.0011","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0012-reports-suspicious-sms-messages","n":"Reports suspicious SMS messages","i":"I.0012","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0013-replies-to-emails-from-unknown-or-spoofed-senders","n":"Replies to emails from unknown or spoofed senders","i":"I.0013","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0014-forwards-email-messages-to-an-unauthorized-mailbox","n":"Forwards email messages to an unauthorized mailbox","i":"I.0014","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0015-opens-attachments-from-quarantined-email-messages","n":"Opens attachments from quarantined email messages","i":"I.0015","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0016-opens-attachments-from-email-messages-with-unknown-senders","n":"Opens attachments from email messages with unknown senders","i":"I.0016","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0017-deletes-phishing-emails-without-opening","n":"Deletes phishing emails without opening","i":"I.0017","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0018-marks-legitimate-security-alerts-as-junk-messages","n":"Marks legitimate security alerts as junk messages","i":"I.0018","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0019-replies-to-flagged-phishing-emails-after-warning","n":"Replies to flagged phishing emails after warning","i":"I.0019","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0020-downloads-attachments-from-emails-with-mismatched-display-name-and-sender","n":"Downloads attachments from emails with mismatched display name and sender","i":"I.0020","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0021-configures-a-mailbox-rule-that-bypasses-security-controls","n":"Configures a mailbox rule that bypasses security controls","i":"I.0021","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0022-sends-email-messages-to-risky-distribution-lists","n":"Sends email messages to risky distribution lists","i":"I.0022","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0023-sends-files-to-personal-accounts","n":"Sends files to personal accounts","i":"I.0023","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0024-sends-credentials-through-chat-messages","n":"Sends credentials through chat messages","i":"I.0024","d":"IA","x":"Communication Security"},{"k":"indicator","s":"i-0025-shares-meeting-links-on-public-websites","n":"Shares meeting links on public websites","i":"I.0025","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0026-accepts-file-transfers-from-unknown-external-contacts","n":"Accepts file transfers from unknown external contacts","i":"I.0026","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0027-removes-sensitivity-labels-from-email-messages","n":"Removes sensitivity labels from email messages","i":"I.0027","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0028-attempts-to-bypass-attachment-blocking-by-renaming-files","n":"Attempts to bypass attachment blocking by renaming files","i":"I.0028","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0029-adds-potentially-risky-domains-to-safe-senders-list","n":"Adds potentially risky domains to \"safe senders\" list","i":"I.0029","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0030-replies-all-with-external-recipients","n":"Replies all with external recipients","i":"I.0030","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0031-deletes-security-banner-before-sending-messages","n":"Deletes security banner before sending messages","i":"I.0031","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0032-shares-sensitive-content-via-email-messages","n":"Shares sensitive content via email messages","i":"I.0032","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0033-shares-sensitive-data-to-public-folders","n":"Shares sensitive data to public folders","i":"I.0033","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0034-shares-sensitive-content-via-chat","n":"Shares sensitive content via chat","i":"I.0034","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0035-uses-personal-email-for-work-correspondence","n":"Uses personal email for work correspondence","i":"I.0035","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0036-reveals-project-codes-names-or-internal-initiatives-in-public-channels","n":"Reveals project codes names or internal initiatives in public channels","i":"I.0036","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0037-interacts-with-calendar-invites-that-may-pose-security-risk","n":"Interacts with calendar invites that may pose security risk","i":"I.0037","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0038-screenshares-confidential-content-in-virtual-meetings-with-external-parti","n":"Screenshares confidential content in virtual meetings with external participants","i":"I.0038","d":"DH","x":"Communication Security"},{"k":"indicator","s":"i-0039-clicks-links-in-sms-messages-from-unknown-senders-or-as-part-of-sms-phish","n":"Clicks links in SMS messages from unknown senders or as part of SMS phishing simulation","i":"I.0039","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0040-enables-macros-in-untrusted-documents","n":"Enables macros in untrusted documents","i":"I.0040","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0041-accesses-shortened-urls-from-unknown-sources","n":"Accesses shortened URLs from unknown sources","i":"I.0041","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0042-attempts-to-download-content-from-email-messages-with-blocked-external-im","n":"Attempts to download content from email messages with blocked external images","i":"I.0042","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0043-accepts-redirected-links-from-unknown-domains","n":"Accepts redirected links from unknown domains","i":"I.0043","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0044-accepts-shared-file-invites-from-spoofed-domains","n":"Accepts shared file invites from spoofed domains","i":"I.0044","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0045-clicks-unsubscribe-links-in-unsolicited-newsletters","n":"Clicks unsubscribe links in unsolicited newsletters","i":"I.0045","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0046-opens-encrypted-messages-from-unverified-senders","n":"Opens encrypted messages from unverified senders","i":"I.0046","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0047-accepts-voice-call-mfa-code-requests-over-sms","n":"Accepts voice call MFA code requests over SMS","i":"I.0047","d":"IA","x":"Communication Security"},{"k":"indicator","s":"i-0048-shares-otp-or-mfa-codes-via-email-or-chat-messages","n":"Shares OTP or MFA codes via email or chat messages","i":"I.0048","d":"IA","x":"Communication Security"},{"k":"indicator","s":"i-0049-approves-suspicious-or-fraudulent-mfa-requests","n":"Approves suspicious or fraudulent MFA requests","i":"I.0049","d":"IA","x":"Communication Security"},{"k":"indicator","s":"i-0050-disables-or-tampers-with-emails-security-controls","n":"Disables or tampers with emails security controls","i":"I.0050","d":"SE","x":"Communication Security"},{"k":"indicator","s":"i-0051-opens-simulated-phishing-emails-one-or-more-times","n":"Opens simulated phishing emails one or more times","i":"I.0051","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0052-clicks-links-in-simulated-phishing-emails","n":"Clicks links in simulated phishing emails","i":"I.0052","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0053-enters-credentials-on-websites-linked-from-simulated-phishing-emails","n":"Enters credentials on websites linked from simulated phishing emails","i":"I.0053","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0054-opens-file-attachments-to-simulated-phishing-emails","n":"Opens file attachments to simulated phishing emails","i":"I.0054","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0055-fails-to-report-simulated-phishing-emails-after-opening","n":"Fails to report simulated phishing emails after opening","i":"I.0055","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0056-deletes-simulated-phishing-emails-without-reporting","n":"Deletes simulated phishing emails without reporting","i":"I.0056","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0057-responds-to-simulated-phishing-emails","n":"Responds to simulated phishing emails","i":"I.0057","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0058-reports-simulated-phishing-emails","n":"Reports simulated phishing emails","i":"I.0058","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0059-forwards-simulated-phishing-emails-to-security-team","n":"Forwards simulated phishing emails to security team","i":"I.0059","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0060-provides-helpful-feedback-on-simulated-phishing-emails","n":"Provides helpful feedback on simulated phishing emails","i":"I.0060","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0061-opens-simulated-sms-phishing-messages","n":"Opens simulated SMS phishing messages","i":"I.0061","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0062-responds-to-simulated-sms-phishing-messages","n":"Responds to simulated SMS phishing messages","i":"I.0062","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0063-fails-to-report-simulated-sms-phishing-messages","n":"Fails to report simulated SMS phishing messages","i":"I.0063","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0064-reports-simulated-sms-phishing-messages","n":"Reports simulated SMS phishing messages","i":"I.0064","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0065-ignores-or-deletes-simulated-sms-phishing-messages","n":"Ignores or deletes simulated SMS phishing messages","i":"I.0065","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0066-does-not-respond-to-simulated-fraudulent-mfa-prompts","n":"Does not respond to simulated fraudulent MFA prompts","i":"I.0066","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0067-marks-simulated-fraudulent-mfa-prompts-as-mistaken","n":"Marks simulated fraudulent MFA prompts as mistaken","i":"I.0067","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0068-denies-simulated-fraudulent-mfa-prompts-and-reports-them","n":"Denies simulated fraudulent MFA prompts and reports them","i":"I.0068","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0069-responds-promptly-with-correct-action","n":"Responds promptly with correct action","i":"I.0069","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0070-does-not-respond-to-emergency-notification-test","n":"Does not respond to emergency notification test","i":"I.0070","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0071-responds-to-emergency-notification-test","n":"Responds to emergency notification test","i":"I.0071","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0072-verifies-receipt-of-emergency-communications-through-proper-channels","n":"Verifies receipt of emergency communications through proper channels","i":"I.0072","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0073-completes-in-person-trainings","n":"Completes in-person trainings","i":"I.0073","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0074-has-overdue-trainings","n":"Has overdue trainings","i":"I.0074","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0075-fails-to-attempt-assigned-trainings","n":"Fails to attempt assigned trainings","i":"I.0075","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0076-fails-assigned-trainings","n":"Fails assigned trainings","i":"I.0076","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0077-completes-assigned-trainings-late","n":"Completes assigned trainings late","i":"I.0077","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0078-avoids-training","n":"Avoids training","i":"I.0078","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0079-completes-assigned-trainings","n":"Completes assigned trainings","i":"I.0079","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0080-completes-assigned-trainings-on-time","n":"Completes assigned trainings on time","i":"I.0080","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0081-passes-assigned-trainings","n":"Passes assigned trainings","i":"I.0081","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0082-attempts-assigned-trainings","n":"Attempts assigned trainings","i":"I.0082","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0083-re-attempts-failed-trainings","n":"Re-attempts failed trainings","i":"I.0083","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0084-engages-with-optional-trainings","n":"Engages with optional trainings","i":"I.0084","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0085-skips-interactive-training-modules","n":"Skips interactive training modules","i":"I.0085","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0086-completes-collaborative-trainings","n":"Completes collaborative trainings","i":"I.0086","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0087-completes-collaborative-trainings-on-time","n":"Completes collaborative trainings on time","i":"I.0087","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0088-fails-to-complete-collaborative-trainings","n":"Fails to complete collaborative trainings","i":"I.0088","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0089-skips-assigned-trainings","n":"Skips assigned trainings","i":"I.0089","d":"RR","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0090-reports-high-confidence-in-security-self-assessments","n":"Reports high confidence in security self assessments","i":"I.0090","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0091-reports-low-confidence-in-security-self-assessments","n":"Reports low confidence in security self assessments","i":"I.0091","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0092-reports-high-confidence-in-phishing-related-self-assessments","n":"Reports high confidence in phishing-related self assessments","i":"I.0092","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0093-reports-low-confidence-in-phishing-related-self-assessments","n":"Reports low confidence in phishing-related self assessments","i":"I.0093","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0094-reports-high-confidence-in-organizational-security-readiness","n":"Reports high confidence in organizational security readiness","i":"I.0094","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0095-reports-low-confidence-in-organizational-security-readiness","n":"Reports low confidence in organizational security readiness","i":"I.0095","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0096-completes-training-consistently-over-multiple-assigned-trainings","n":"Completes training consistently over multiple assigned trainings","i":"I.0096","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0097-fails-phishing-simulations-less-frequently-over-time","n":"Fails phishing simulations less frequently over time","i":"I.0097","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0098-reports-increased-confidence-in-security-self-assessments","n":"Reports increased confidence in security self assessments","i":"I.0098","d":"SC","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0099-fails-security-simulations-less-frequently-over-time","n":"Fails security simulations less frequently over time","i":"I.0099","d":"SE","x":"Engagement & Awareness"},{"k":"indicator","s":"i-0100-uses-personal-tools-to-access-enterprise-documents","n":"Uses personal tools to access enterprise documents","i":"I.0100","d":"DH","x":"Data Protection"},{"k":"indicator","s":"i-0101-syncs-enterprise-data-to-personal-cloud-storage","n":"Syncs enterprise data to personal cloud storage","i":"I.0101","d":"DH","x":"Data Protection"},{"k":"indicator","s":"i-0102-installs-personal-cloud-backup-tools-on-enterprise-devices","n":"Installs personal cloud backup tools on enterprise devices","i":"I.0102","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0103-copies-enterprise-data-into-personal-ai-chat-tools","n":"Copies enterprise data into personal AI chat tools","i":"I.0103","d":"AU","x":"Data Protection"},{"k":"indicator","s":"i-0104-signs-into-enterprise-apps-from-unmanaged-devices","n":"Signs into enterprise apps from unmanaged devices","i":"I.0104","d":"EP","x":"Data Protection"},{"k":"indicator","s":"i-0105-logs-into-enterprise-services-using-personal-accounts","n":"Logs into enterprise services using personal accounts","i":"I.0105","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0106-shows-simultaneous-logins-from-geographically-distant-ips","n":"Shows simultaneous logins from geographically distant IPs","i":"I.0106","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0107-continues-using-expired-credentials-for-cloud-access","n":"Continues using expired credentials for cloud access","i":"I.0107","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0108-avoids-enterprise-single-sign-on","n":"Avoids enterprise single sign-on","i":"I.0108","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0109-shares-cloud-documents-with-public-links","n":"Shares cloud documents with public links","i":"I.0109","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0110-sets-cloud-file-sharing-to-overly-permissive-levels","n":"Sets cloud file sharing to overly permissive levels","i":"I.0110","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0111-stores-unencrypted-credentials-in-shared-cloud-folders","n":"Stores unencrypted credentials in shared cloud folders","i":"I.0111","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0112-misconfigures-cloud-storage-with-public-access","n":"Misconfigures cloud storage with public access","i":"I.0112","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0113-authorizes-persistent-access-to-third-party-applications","n":"Authorizes persistent access to third-party applications","i":"I.0113","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0114-grants-oauth-access-to-untrusted-vendors","n":"Grants OAuth access to untrusted vendors","i":"I.0114","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0115-installs-unvetted-browser-extensions","n":"Installs unvetted browser extensions","i":"I.0115","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0116-downloads-executable-files-from-suspicious-domains","n":"Downloads executable files from suspicious domains","i":"I.0116","d":"EP","x":"Data Protection"},{"k":"indicator","s":"i-0117-opens-shortened-urls-from-unknown-senders","n":"Opens shortened URLs from unknown senders","i":"I.0117","d":"SE","x":"Data Protection"},{"k":"indicator","s":"i-0118-ignores-browser-warnings-about-insecure-websites","n":"Ignores browser warnings about insecure websites","i":"I.0118","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0119-uses-non-encrypted-http-for-sensitive-web-access","n":"Uses non-encrypted HTTP for sensitive web access","i":"I.0119","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0120-uses-unsupported-browsers-for-sensitive-enterprise-tasks","n":"Uses unsupported browsers for sensitive enterprise tasks","i":"I.0120","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0121-uses-outdated-browsers-to-access-enterprise-web-apps","n":"Uses outdated browsers to access enterprise web apps","i":"I.0121","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0122-accesses-self-hosted-tools-with-expired-ssl-certificates","n":"Accesses self-hosted tools with expired SSL certificates","i":"I.0122","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0123-accesses-enterprise-web-apps-from-high-risk-geolocations","n":"Accesses enterprise web apps from high-risk geolocations","i":"I.0123","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0124-uses-anonymity-tools-to-bypass-security-controls","n":"Uses anonymity tools to bypass security controls","i":"I.0124","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0125-attempts-unauthorized-privilege-escalation-in-cloud-apps","n":"Attempts unauthorized privilege escalation in cloud apps","i":"I.0125","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0126-uploads-sensitive-files-to-unauthorized-web-apps","n":"Uploads sensitive files to unauthorized web apps","i":"I.0126","d":"DH","x":"Data Protection"},{"k":"indicator","s":"i-0127-uses-root-credentials-for-cloud-administrative-access","n":"Uses root credentials for cloud administrative access","i":"I.0127","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0128-uploads-code-to-unsanctioned-repositories","n":"Uploads code to unsanctioned repositories","i":"I.0128","d":"DH","x":"Data Protection"},{"k":"indicator","s":"i-0129-accesses-saas-apps-only-from-managed-devices","n":"Accesses SaaS apps only from managed devices","i":"I.0129","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0130-reports-phishing-emails-without-clicking","n":"Reports phishing emails without clicking","i":"I.0130","d":"SE","x":"Data Protection"},{"k":"indicator","s":"i-0131-stores-sensitive-documents-only-in-approved-cloud-platforms","n":"Stores sensitive documents only in approved cloud platforms","i":"I.0131","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0132-shares-documents-using-view-only-permissions-by-default","n":"Shares documents using view-only permissions by default","i":"I.0132","d":"DH","x":"Data Protection"},{"k":"indicator","s":"i-0133-uses-browser-extensions-only-from-approved-list","n":"Uses browser extensions only from approved list","i":"I.0133","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0134-regularly-uses-browser-password-manager-with-mfa","n":"Regularly uses browser password manager with MFA","i":"I.0134","d":"IA","x":"Data Protection"},{"k":"indicator","s":"i-0135-logs-out-of-sensitive-applications-after-use","n":"Logs out of sensitive applications after use","i":"I.0135","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0136-hovers-over-links-before-clicking","n":"Hovers over links before clicking","i":"I.0136","d":"SE","x":"Data Protection"},{"k":"indicator","s":"i-0137-avoids-repeated-access-attempts-to-restricted-cloud-content","n":"Avoids repeated access attempts to restricted cloud content","i":"I.0137","d":"WC","x":"Data Protection"},{"k":"indicator","s":"i-0138-misuses-elevated-privileges-to-access-sensitive-resources","n":"Misuses elevated privileges to access sensitive resources","i":"I.0138","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0139-abuses-access-privileges-in-ways-that-do-not-comply-with-policy","n":"Abuses access privileges in ways that do not comply with policy","i":"I.0139","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0140-steals-or-harvests-credentials-using-unauthorized-tools","n":"Steals or harvests credentials using unauthorized tools","i":"I.0140","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0141-accesses-protected-resources-from-unusual-locations","n":"Accesses protected resources from unusual locations","i":"I.0141","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0142-uses-injected-credentials-to-access-protected-resources","n":"Uses injected credentials to access protected resources","i":"I.0142","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0143-subverts-access-controls-or-disables-auditing-mechanisms","n":"Subverts access controls or disables auditing mechanisms","i":"I.0143","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0144-manipulates-identity-federation-settings-to-bypass-controls","n":"Manipulates identity federation settings to bypass controls","i":"I.0144","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0145-configures-persistence-mechanisms-to-maintain-unauthorized-access","n":"Configures persistence mechanisms to maintain unauthorized access","i":"I.0145","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0146-uses-cached-or-stolen-credentials-to-gain-unauthorized-access","n":"Uses cached or stolen credentials to gain unauthorized access","i":"I.0146","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0147-relies-on-insecure-or-temporary-credentials-to-maintain-access","n":"Relies on insecure or temporary credentials to maintain access","i":"I.0147","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0148-communicates-with-known-threat-actors","n":"Communicates with known threat actors","i":"I.0148","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0149-engages-in-activity-inconsistent-with-approved-roles","n":"Engages in activity inconsistent with approved roles","i":"I.0149","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0150-modifies-or-deletes-identity-policies-to-gain-unauthorized-access","n":"Modifies or deletes identity policies to gain unauthorized access","i":"I.0150","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0151-accesses-secrets-or-vaults-in-unauthorized-or-unusual-ways","n":"Accesses secrets or vaults in unauthorized or unusual ways","i":"I.0151","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0152-disables-monitoring-or-logging-to-conceal-unauthorized-activity","n":"Disables monitoring or logging to conceal unauthorized activity","i":"I.0152","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0153-uses-weak-or-bypassed-authentication-methods-to-gain-access","n":"Uses weak or bypassed authentication methods to gain access","i":"I.0153","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0154-accesses-protected-resources-at-unusual-volumes-or-frequency","n":"Accesses protected resources at unusual volumes or frequency","i":"I.0154","d":"IA","x":"Identity & Access Risk"},{"k":"indicator","s":"i-0155-processes-source-code-with-unapproved-ai-services","n":"Processes source code with unapproved AI services","i":"I.0155","d":"AU","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0156-accesses-unapproved-cloud-storage-services","n":"Accesses unapproved cloud storage services","i":"I.0156","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0157-uploads-sensitive-data-to-personal-cloud-storage","n":"Uploads sensitive data to personal cloud storage","i":"I.0157","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0158-visits-newly-registered-or-suspicious-domains","n":"Visits newly registered or suspicious domains","i":"I.0158","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0159-installs-vulnerable-browser-extensions","n":"Installs vulnerable browser extensions","i":"I.0159","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0160-circumvents-corporate-proxy-or-vpn","n":"Circumvents corporate proxy or VPN","i":"I.0160","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0161-attempts-to-access-blocked-or-blacklisted-websites","n":"Attempts to access blocked or blacklisted websites","i":"I.0161","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0162-visits-confirmed-malicious-websites","n":"Visits confirmed malicious websites","i":"I.0162","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0163-visits-websites-that-trigger-policy-warnings","n":"Visits websites that trigger policy warnings","i":"I.0163","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0164-visits-websites-categorized-as-ai-tools","n":"Visits websites categorized as AI tools","i":"I.0164","d":"AU","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0165-spends-excessive-time-on-social-media-websites","n":"Spends excessive time on social media websites","i":"I.0165","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0166-visits-websites-in-risky-categories","n":"Visits websites in risky categories","i":"I.0166","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0167-attempts-to-visit-restricted-websites-but-is-blocked","n":"Attempts to visit restricted websites but is blocked","i":"I.0167","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0168-uses-non-business-saas-platforms-excessively","n":"Uses non-business SaaS platforms excessively","i":"I.0168","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0169-transfers-high-volumes-of-files-to-cloud-applications","n":"Transfers high volumes of files to cloud applications","i":"I.0169","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0170-signs-into-corporate-apps-from-unapproved-devices-or-locations","n":"Signs into corporate apps from unapproved devices or locations","i":"I.0170","d":"IA","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0171-uses-multiple-cloud-services-with-overlapping-functionality","n":"Uses multiple cloud services with overlapping functionality","i":"I.0171","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0172-bypasses-sso-to-access-saas-platforms-directly","n":"Bypasses SSO to access SaaS platforms directly","i":"I.0172","d":"IA","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0173-accesses-cloud-applications-exclusively-via-sso","n":"Accesses cloud applications exclusively via SSO","i":"I.0173","d":"IA","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0174-uses-only-approved-saas-platforms","n":"Uses only approved SaaS platforms","i":"I.0174","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0175-reports-suspicious-browser-activity","n":"Reports suspicious browser activity","i":"I.0175","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0176-reports-unauthorized-or-unknown-saas-applications","n":"Reports unauthorized or unknown SaaS applications","i":"I.0176","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0177-regularly-accesses-security-awareness-resources","n":"Regularly accesses security awareness resources","i":"I.0177","d":"SC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0178-submits-help-desk-tickets-for-blocked-or-restricted-services","n":"Submits help desk tickets for blocked or restricted services","i":"I.0178","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0179-signs-into-saas-applications-with-multi-factor-authentication","n":"Signs into SaaS applications with multi-factor authentication","i":"I.0179","d":"IA","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0180-downloads-documents-from-unrecognized-cloud-platforms","n":"Downloads documents from unrecognized cloud platforms","i":"I.0180","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0181-browses-websites-in-approved-safe-categories","n":"Browses websites in approved safe categories","i":"I.0181","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0182-uses-cloud-collaboration-tools-only-during-business-hours","n":"Uses cloud collaboration tools only during business hours","i":"I.0182","d":"WC","x":"Web & Cloud Usage"},{"k":"indicator","s":"i-0183-runs-unsupported-operating-system-versions","n":"Runs unsupported operating system versions","i":"I.0183","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0184-disables-endpoint-security-controls","n":"Disables endpoint security controls","i":"I.0184","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0185-uses-devices-without-full-disk-encryption","n":"Uses devices without full-disk encryption","i":"I.0185","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0186-delays-software-updates-repeatedly","n":"Delays software updates repeatedly","i":"I.0186","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0187-uses-devices-with-excessive-admin-privileges","n":"Uses devices with excessive admin privileges","i":"I.0187","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0188-uses-devices-with-unnecessary-or-risky-software","n":"Uses devices with unnecessary or risky software","i":"I.0188","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0189-uses-devices-with-malware-detections","n":"Uses devices with malware detections","i":"I.0189","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0190-runs-files-from-suspicious-or-unrecognized-usb-devices","n":"Runs files from suspicious or unrecognized USB devices","i":"I.0190","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0191-uses-devices-that-communicate-with-command-and-control-infrastructure","n":"Uses devices that communicate with command-and-control infrastructure","i":"I.0191","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0192-downloads-and-executes-malicious-files","n":"Downloads and executes malicious files","i":"I.0192","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0193-uses-devices-exhibiting-lateral-movement-behaviors","n":"Uses devices exhibiting lateral movement behaviors","i":"I.0193","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0194-uses-devices-missing-critical-patches","n":"Uses devices missing critical patches","i":"I.0194","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0195-runs-unsupported-legacy-applications","n":"Runs unsupported legacy applications","i":"I.0195","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0196-delays-reboots-after-patch-installation","n":"Delays reboots after patch installation","i":"I.0196","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0197-installs-unapproved-software","n":"Installs unapproved software","i":"I.0197","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0198-runs-portable-applications-from-external-drives","n":"Runs portable applications from external drives","i":"I.0198","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0199-uses-personal-devices-for-enterprise-work-without-enrollment","n":"Uses personal devices for enterprise work without enrollment","i":"I.0199","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0200-connects-to-unknown-usb-peripherals","n":"Connects to unknown USB peripherals","i":"I.0200","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0201-uses-devices-that-boot-from-removable-media","n":"Uses devices that boot from removable media","i":"I.0201","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0202-charges-devices-from-untrusted-usb-sources","n":"Charges devices from untrusted USB sources","i":"I.0202","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0203-stores-sensitive-data-in-unprotected-local-folders","n":"Stores sensitive data in unprotected local folders","i":"I.0203","d":"DH","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0204-copies-sensitive-data-to-removable-media","n":"Copies sensitive data to removable media","i":"I.0204","d":"DH","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0205-transfers-sensitive-content-via-clipboard","n":"Transfers sensitive content via clipboard","i":"I.0205","d":"DH","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0206-uses-devices-observed-to-frequently-visit-risky-websites","n":"Uses devices observed to frequently visit risky websites","i":"I.0206","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0207-disables-screen-lock-or-timeout","n":"Disables screen lock or timeout","i":"I.0207","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0208-leaves-devices-unlocked-in-public-or-shared-spaces","n":"Leaves devices unlocked in public or shared spaces","i":"I.0208","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0209-uses-jailbroken-or-rooted-mobile-devices-for-work","n":"Uses jailbroken or rooted mobile devices for work","i":"I.0209","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0210-installs-remote-access-tools-without-approval","n":"Installs remote access tools without approval","i":"I.0210","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0211-runs-browser-based-games-or-crypto-mining-on-work-devices","n":"Runs browser-based games or crypto mining on work devices","i":"I.0211","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0212-operates-outdated-device-models-with-unsupported-hardware","n":"Operates outdated device models with unsupported hardware","i":"I.0212","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0213-installs-software-updates-promptly-after-release","n":"Installs software updates promptly after release","i":"I.0213","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0214-locks-devices-during-inactivity","n":"Locks devices during inactivity","i":"I.0214","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0215-isolates-devices-immediately-after-suspicious-behavior","n":"Isolates devices immediately after suspicious behavior","i":"I.0215","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0216-uninstalls-unused-or-risky-software-proactively","n":"Uninstalls unused or risky software proactively","i":"I.0216","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0217-uses-devices-with-full-disk-encryption","n":"Uses devices with full-disk encryption","i":"I.0217","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0218-uses-only-approved-usb-devices-for-file-transfers","n":"Uses only approved USB devices for file transfers","i":"I.0218","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0219-responds-to-edr-warnings-before-it-intervention","n":"Responds to EDR warnings before IT intervention","i":"I.0219","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0220-avoids-running-executables-from-unverified-sources","n":"Avoids running executables from unverified sources","i":"I.0220","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0221-maintains-baseline-system-configurations","n":"Maintains baseline system configurations","i":"I.0221","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0222-engages-with-endpoint-health-check-tools-proactively","n":"Engages with endpoint health check tools proactively","i":"I.0222","d":"EP","x":"Endpoint & Device Security"},{"k":"indicator","s":"i-0223-badges-in-without-badging-out","n":"Badges in without badging out","i":"I.0223","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0224-badges-out-without-prior-badge-in","n":"Badges out without prior badge in","i":"I.0224","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0225-allows-additional-person-to-enter-without-authorization","n":"Allows additional person to enter without authorization","i":"I.0225","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0226-holds-secure-door-open-beyond-expected-duration","n":"Holds secure door open beyond expected duration","i":"I.0226","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0227-attempts-to-access-unauthorized-areas-with-badge","n":"Attempts to access unauthorized areas with badge","i":"I.0227","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0228-accumulates-excessive-denied-access-attempts","n":"Accumulates excessive denied access attempts","i":"I.0228","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0229-accesses-facilities-more-frequently-than-expected","n":"Accesses facilities more frequently than expected","i":"I.0229","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0230-accesses-facilities-outside-expected-hours","n":"Accesses facilities outside expected hours","i":"I.0230","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0231-accesses-facilities-using-unexpected-badge","n":"Accesses facilities using unexpected badge","i":"I.0231","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0232-accesses-facilities-while-on-leave","n":"Accesses facilities while on leave","i":"I.0232","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0233-accesses-facilities-after-offboarding","n":"Accesses facilities after offboarding","i":"I.0233","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0234-accesses-multiple-facilities-simultaneously","n":"Accesses multiple facilities simultaneously","i":"I.0234","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0235-visits-sensitive-zones-for-unusually-short-durations","n":"Visits sensitive zones for unusually short durations","i":"I.0235","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0236-loiters-in-sensitive-zones-beyond-expected-durations","n":"Loiters in sensitive zones beyond expected durations","i":"I.0236","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0237-appears-onsite-while-also-appearing-remote","n":"Appears onsite while also appearing remote","i":"I.0237","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0238-fails-to-display-badge-when-onsite","n":"Fails to display badge when onsite","i":"I.0238","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0239-sponsors-visitors-more-frequently-than-expected","n":"Sponsors visitors more frequently than expected","i":"I.0239","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0240-attempts-to-sponsor-unauthorized-visitors","n":"Attempts to sponsor unauthorized visitors","i":"I.0240","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0241-fails-to-respond-appropriately-during-security-drills","n":"Fails to respond appropriately during security drills","i":"I.0241","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0242-fails-clean-desk-policy-audit","n":"Fails clean desk policy audit","i":"I.0242","d":"EP","x":"Physical Security"},{"k":"indicator","s":"i-0243-demonstrates-susceptibility-to-authority-exploitation","n":"Demonstrates susceptibility to authority exploitation","i":"I.0243","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0244-demonstrates-susceptibility-to-urgency-and-scarcity-pressure","n":"Demonstrates susceptibility to urgency and scarcity pressure","i":"I.0244","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0245-demonstrates-susceptibility-to-fear-and-intimidation","n":"Demonstrates susceptibility to fear and intimidation","i":"I.0245","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0246-demonstrates-susceptibility-to-trust-and-familiarity-abuse","n":"Demonstrates susceptibility to trust and familiarity abuse","i":"I.0246","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0247-demonstrates-susceptibility-to-reciprocity-and-obligation","n":"Demonstrates susceptibility to reciprocity and obligation","i":"I.0247","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0248-demonstrates-susceptibility-to-curiosity-and-novelty-triggers","n":"Demonstrates susceptibility to curiosity and novelty triggers","i":"I.0248","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0249-demonstrates-susceptibility-to-greed-and-reward-motivation","n":"Demonstrates susceptibility to greed and reward motivation","i":"I.0249","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0250-demonstrates-susceptibility-to-empathy-and-helpfulness","n":"Demonstrates susceptibility to empathy and helpfulness","i":"I.0250","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0251-demonstrates-susceptibility-to-commitment-and-consistency","n":"Demonstrates susceptibility to commitment and consistency","i":"I.0251","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0252-demonstrates-susceptibility-to-social-proof-and-herd-mentality","n":"Demonstrates susceptibility to social proof and herd mentality","i":"I.0252","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0253-demonstrates-susceptibility-to-overconfidence-exploitation","n":"Demonstrates susceptibility to overconfidence exploitation","i":"I.0253","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0254-demonstrates-susceptibility-to-fatigue-and-cognitive-overload","n":"Demonstrates susceptibility to fatigue and cognitive overload","i":"I.0254","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0255-demonstrates-susceptibility-to-fear-of-missing-out-fomo","n":"Demonstrates susceptibility to fear of missing out (FOMO)","i":"I.0255","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0256-demonstrates-susceptibility-to-sympathy-manipulation","n":"Demonstrates susceptibility to sympathy manipulation","i":"I.0256","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0257-demonstrates-susceptibility-to-pretexting-deception","n":"Demonstrates susceptibility to pretexting deception","i":"I.0257","d":"SE","x":"Social Engineering Risks"},{"k":"indicator","s":"i-0258-files-incident-tickets-without-actionable-evidence","n":"Files incident tickets without actionable evidence","i":"I.0258","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0259-misroutes-or-mislabels-incident-severity","n":"Misroutes or mislabels incident severity","i":"I.0259","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0260-misclassifies-or-overuses-incident-reporting-channels","n":"Misclassifies or overuses incident reporting channels","i":"I.0260","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0261-fails-to-recognize-or-detect-security-threats","n":"Fails to recognize or detect security threats","i":"I.0261","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0262-deviates-from-documented-incident-reporting-workflows","n":"Deviates from documented incident reporting workflows","i":"I.0262","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0263-demonstrates-gaps-in-incident-participation-or-coordination","n":"Demonstrates gaps in incident participation or coordination","i":"I.0263","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0264-delays-or-fails-to-complete-assigned-security-training-consistently","n":"Delays or fails to complete assigned security training consistently","i":"I.0264","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0265-circumvents-or-evades-security-training-platforms","n":"Circumvents or evades security training platforms","i":"I.0265","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0266-completes-security-awareness-training-with-low-engagement","n":"Completes security awareness training with low engagement","i":"I.0266","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0267-completes-training-misaligned-with-role-or-risk-responsibilities","n":"Completes training misaligned with role or risk responsibilities","i":"I.0267","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0268-ignores-or-delays-pager-acknowledgments-beyond-sla","n":"Ignores or delays pager acknowledgments beyond SLA","i":"I.0268","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0269-creates-duplicate-incident-tickets-for-the-same-event","n":"Creates duplicate incident tickets for the same event","i":"I.0269","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0270-shares-incident-details-in-public-or-unsanctioned-channels","n":"Shares incident details in public or unsanctioned channels","i":"I.0270","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0271-performs-containment-without-documenting-actions","n":"Performs containment without documenting actions","i":"I.0271","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0272-submits-malformed-or-context-free-indicators","n":"Submits malformed or context-free indicators","i":"I.0272","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0273-mishandles-or-overwrites-incident-evidence","n":"Mishandles or overwrites incident evidence","i":"I.0273","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0274-bypasses-controls-citing-business-urgency-without-approval","n":"Bypasses controls citing business urgency without approval","i":"I.0274","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0275-fails-to-complete-post-incident-actions","n":"Fails to complete post-incident actions","i":"I.0275","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0276-declines-or-minimally-engages-in-incident-simulations","n":"Declines or minimally engages in incident simulations","i":"I.0276","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0277-embeds-secrets-or-pii-in-free-text-fields","n":"Embeds secrets or PII in free-text fields","i":"I.0277","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0278-misses-regulatory-or-customer-notification-triggers","n":"Misses regulatory or customer notification triggers","i":"I.0278","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0279-acknowledges-pager-alerts-within-sla","n":"Acknowledges pager alerts within SLA","i":"I.0279","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0280-escalates-incidents-correctly-on-first-attempt","n":"Escalates incidents correctly on first attempt","i":"I.0280","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0281-attaches-relevant-evidence-to-incident-tickets","n":"Attaches relevant evidence to incident tickets","i":"I.0281","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0282-correlates-related-alerts-into-a-single-incident","n":"Correlates related alerts into a single incident","i":"I.0282","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0283-uses-approved-channels-for-incident-coordination","n":"Uses approved channels for incident coordination","i":"I.0283","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0284-documents-containment-actions-with-timestamps","n":"Documents containment actions with timestamps","i":"I.0284","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0285-provides-high-quality-indicators-of-compromise","n":"Provides high-quality indicators of compromise","i":"I.0285","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0286-follows-playbooks-and-soar-runbooks-as-written","n":"Follows playbooks and SOAR runbooks as written","i":"I.0286","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0287-preserves-chain-of-custody-for-digital-evidence","n":"Preserves chain of custody for digital evidence","i":"I.0287","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0288-requests-emergency-exceptions-with-proper-approval","n":"Requests emergency exceptions with proper approval","i":"I.0288","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0289-completes-post-incident-action-items-on-time","n":"Completes post-incident action items on time","i":"I.0289","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0290-leads-effective-incident-handoffs-across-shifts","n":"Leads effective incident handoffs across shifts","i":"I.0290","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0291-participates-in-incident-simulations-with-high-engagement","n":"Participates in incident simulations with high engagement","i":"I.0291","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0292-uses-secure-storage-for-sensitive-ticket-data","n":"Uses secure storage for sensitive ticket data","i":"I.0292","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0293-requests-timely-legal-compliance-notification-when-required","n":"Requests timely legal/compliance notification when required","i":"I.0293","d":"RR","x":"Incident Response Readiness"},{"k":"indicator","s":"i-0294-uses-shared-home-device-to-access-corporate-systems","n":"Uses shared home device to access corporate systems","i":"I.0294","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0295-logs-in-during-unusual-remote-work-hours","n":"Logs in during unusual remote work hours","i":"I.0295","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0296-generates-repeated-remote-login-failures","n":"Generates repeated remote login failures","i":"I.0296","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0297-shares-corporate-credentials-with-household-members","n":"Shares corporate credentials with household members","i":"I.0297","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0298-fails-device-posture-checks-during-remote-access","n":"Fails device posture checks during remote access","i":"I.0298","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0299-rarely-connects-to-device-management-platform","n":"Rarely connects to device management platform","i":"I.0299","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0300-delays-applying-patches-while-remote","n":"Delays applying patches while remote","i":"I.0300","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0301-disables-device-encryption-outside-office-environments","n":"Disables device encryption outside office environments","i":"I.0301","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0302-uses-unmanaged-personal-device-for-corporate-access","n":"Uses unmanaged personal device for corporate access","i":"I.0302","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0303-copies-corporate-files-to-personal-devices-or-media","n":"Copies corporate files to personal devices or media","i":"I.0303","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0304-accesses-work-apps-from-consumer-devices","n":"Accesses work apps from consumer devices","i":"I.0304","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0305-installs-unapproved-remote-access-tools","n":"Installs unapproved remote access tools","i":"I.0305","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0306-reuses-home-network-credentials-on-corporate-systems","n":"Reuses home network credentials on corporate systems","i":"I.0306","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0307-configures-auto-forwarding-of-work-email-to-personal-accounts","n":"Configures auto-forwarding of work email to personal accounts","i":"I.0307","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0308-shares-sensitive-data-during-screen-sharing-sessions","n":"Shares sensitive data during screen sharing sessions","i":"I.0308","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0309-records-meetings-without-participant-consent","n":"Records meetings without participant consent","i":"I.0309","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0310-posts-sensitive-content-in-unsecured-chat-applications","n":"Posts sensitive content in unsecured chat applications","i":"I.0310","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0311-works-remotely-without-connecting-to-vpn","n":"Works remotely without connecting to VPN","i":"I.0311","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0312-uses-shared-household-accounts-on-corporate-devices","n":"Uses shared household accounts on corporate devices","i":"I.0312","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0313-establishes-simultaneous-vpn-sessions-from-different-locations","n":"Establishes simultaneous VPN sessions from different locations","i":"I.0313","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0314-uses-outdated-or-insecure-vpn-protocols","n":"Uses outdated or insecure VPN protocols","i":"I.0314","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0315-leaves-work-device-unattended-in-public-places","n":"Leaves work device unattended in public places","i":"I.0315","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0316-enables-video-or-audio-in-non-private-settings","n":"Enables video or audio in non-private settings","i":"I.0316","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0317-views-sensitive-data-on-screen-in-public-areas","n":"Views sensitive data on screen in public areas","i":"I.0317","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0318-displays-sensitive-data-on-external-monitors-in-public","n":"Displays sensitive data on external monitors in public","i":"I.0318","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0319-connects-from-unsecured-or-unknown-wi-fi-networks","n":"Connects from unsecured or unknown Wi-Fi networks","i":"I.0319","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0320-connects-from-geolocations-inconsistent-with-work-profile","n":"Connects from geolocations inconsistent with work profile","i":"I.0320","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0321-uses-open-wi-fi-networks-without-vpn","n":"Uses open Wi-Fi networks without VPN","i":"I.0321","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0322-uses-corporate-vpn-consistently-during-remote-work","n":"Uses corporate VPN consistently during remote work","i":"I.0322","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0323-applies-privacy-measures-when-working-in-shared-spaces","n":"Applies privacy measures when working in shared spaces","i":"I.0323","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0324-validates-wi-fi-security-before-connecting-remotely","n":"Validates Wi-Fi security before connecting remotely","i":"I.0324","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0325-avoids-printing-or-transporting-sensitive-documents","n":"Avoids printing or transporting sensitive documents","i":"I.0325","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0326-uses-blurred-or-virtual-backgrounds-during-video-calls","n":"Uses blurred or virtual backgrounds during video calls","i":"I.0326","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0327-connects-regularly-to-device-management-platform-while-remote","n":"Connects regularly to device management platform while remote","i":"I.0327","d":"EP","x":"Remote Work Risk"},{"k":"indicator","s":"i-0328-uses-encrypted-platforms-for-file-sharing","n":"Uses encrypted platforms for file sharing","i":"I.0328","d":"DH","x":"Remote Work Risk"},{"k":"indicator","s":"i-0329-restricts-email-use-to-enterprise-managed-accounts","n":"Restricts email use to enterprise-managed accounts","i":"I.0329","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0330-reviews-remote-work-security-policies-regularly","n":"Reviews remote work security policies regularly","i":"I.0330","d":"RR","x":"Remote Work Risk"},{"k":"indicator","s":"i-0331-keeps-personal-and-corporate-accounts-strictly-separated","n":"Keeps personal and corporate accounts strictly separated","i":"I.0331","d":"IA","x":"Remote Work Risk"},{"k":"indicator","s":"i-0332-appears-in-recent-breach-with-corporate-email","n":"Appears in recent breach with corporate email","i":"I.0332","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0333-appears-in-multiple-breaches-within-recent-time-period","n":"Appears in multiple breaches within recent time period","i":"I.0333","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0334-reuses-exposed-passwords-across-accounts","n":"Reuses exposed passwords across accounts","i":"I.0334","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0335-uses-password-pattern-similar-to-exposed-passwords","n":"Uses password pattern similar to exposed passwords","i":"I.0335","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0336-rotates-credentials-promptly-after-exposures","n":"Rotates credentials promptly after exposures","i":"I.0336","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0337-appears-in-infostealer-logs-with-corporate-cookies","n":"Appears in infostealer logs with corporate cookies","i":"I.0337","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0338-exposes-recovery-codes-or-otp-seeds-in-stealer-logs","n":"Exposes recovery codes or OTP seeds in stealer logs","i":"I.0338","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0339-exposes-corporate-oauth-tokens-or-refresh-tokens","n":"Exposes corporate OAuth tokens or refresh tokens","i":"I.0339","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0340-appears-in-stealer-logs-with-browser-auto-fill-data","n":"Appears in stealer logs with browser auto-fill data","i":"I.0340","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0341-revokes-exposed-sessions-and-tokens-within-sla","n":"Revokes exposed sessions and tokens within SLA","i":"I.0341","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0342-exposes-api-keys-or-cloud-credentials-in-public-repos","n":"Exposes API keys or cloud credentials in public repos","i":"I.0342","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0343-exposes-ssh-private-keys-or-key-material","n":"Exposes SSH private keys or key material","i":"I.0343","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0344-removes-exposed-secrets-within-remediation-sla","n":"Removes exposed secrets within remediation SLA","i":"I.0344","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0345-exposes-personal-identifiers-linked-to-corporate-identity","n":"Exposes personal identifiers linked to corporate identity","i":"I.0345","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0346-exposes-security-questions-and-answers","n":"Exposes security questions and answers","i":"I.0346","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0347-exposes-government-id-images-or-numbers","n":"Exposes government ID images or numbers","i":"I.0347","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0348-appears-in-sim-swap-or-account-takeover-chatter","n":"Appears in SIM-swap or account takeover chatter","i":"I.0348","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0349-requests-takedown-for-personal-data-exposures","n":"Requests takedown for personal data exposures","i":"I.0349","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0350-is-impersonated-by-lookalike-social-or-messaging-accounts","n":"Is impersonated by lookalike social or messaging accounts","i":"I.0350","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0351-is-targeted-in-ransomware-or-extortion-leak-posts","n":"Is targeted in ransomware or extortion leak posts","i":"I.0351","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0352-is-listed-in-company-access-for-sale-offers","n":"Is listed in company access for sale offers","i":"I.0352","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0353-reports-impersonation-promptly-via-official-channels","n":"Reports impersonation promptly via official channels","i":"I.0353","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0354-posts-corporate-data-to-paste-sites-or-public-bins","n":"Posts corporate data to paste sites or public bins","i":"I.0354","d":"DH","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0355-shares-internal-documents-on-public-file-hosts","n":"Shares internal documents on public file hosts","i":"I.0355","d":"DH","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0356-removes-public-links-and-rotates-exposed-data-quickly","n":"Removes public links and rotates exposed data quickly","i":"I.0356","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0357-publishes-contact-details-enabling-high-fidelity-lures","n":"Publishes contact details enabling high-fidelity lures","i":"I.0357","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0358-suppresses-public-footprint-of-sensitive-contact-data","n":"Suppresses public footprint of sensitive contact data","i":"I.0358","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0359-appears-in-breaches-of-critical-third-party-vendors","n":"Appears in breaches of critical third-party vendors","i":"I.0359","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0360-uses-unique-credentials-across-vendor-portals","n":"Uses unique credentials across vendor portals","i":"I.0360","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0361-acknowledges-breach-intel-notifications-within-sla","n":"Acknowledges breach-intel notifications within SLA","i":"I.0361","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0362-ignores-breach-intel-notifications-beyond-sla","n":"Ignores breach-intel notifications beyond SLA","i":"I.0362","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0363-confirms-credential-reset-for-exposed-accounts","n":"Confirms credential reset for exposed accounts","i":"I.0363","d":"IA","x":"Digital Exposure Risk"},{"k":"indicator","s":"i-0364-operates-rooted-or-jailbroken-mobile-device","n":"Operates rooted or jailbroken mobile device","i":"I.0364","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0365-disables-full-disk-encryption-on-mobile-device","n":"Disables full-disk encryption on mobile device","i":"I.0365","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0366-connects-mobile-device-to-untrusted-wi-fi","n":"Connects mobile device to untrusted Wi-Fi","i":"I.0366","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0367-fails-to-maintain-secure-vpn-tunnel-on-mobile-device","n":"Fails to maintain secure VPN tunnel on mobile device","i":"I.0367","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0368-installs-sideloaded-or-unapproved-applications-on-mobile-device","n":"Installs sideloaded or unapproved applications on mobile device","i":"I.0368","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0369-grants-excessive-mobile-app-permissions","n":"Grants excessive mobile app permissions","i":"I.0369","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0370-exhibits-sim-swap-indicators","n":"Exhibits SIM swap indicators","i":"I.0370","d":"IA","x":"Mobile Security"},{"k":"indicator","s":"i-0371-removes-or-tampers-with-mdm-profile","n":"Removes or tampers with MDM profile","i":"I.0371","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0372-operates-mobile-device-from-restricted-geolocation","n":"Operates mobile device from restricted geolocation","i":"I.0372","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0373-lacks-remote-wipe-capability-on-mobile-device","n":"Lacks remote wipe capability on mobile device","i":"I.0373","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0374-runs-mobile-device-with-preinstalled-riskware","n":"Runs mobile device with preinstalled riskware","i":"I.0374","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0375-adheres-to-authorized-mobile-device-maintenance","n":"Adheres to authorized mobile device maintenance","i":"I.0375","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0376-applies-security-patches-on-mobile-device","n":"Applies security patches on mobile device","i":"I.0376","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0377-maintains-secure-bootloader-configuration-on-mobile-device","n":"Maintains secure bootloader configuration on mobile device","i":"I.0377","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0378-practices-safe-public-wi-fi-usage-on-mobile-device","n":"Practices safe public Wi-Fi usage on mobile device","i":"I.0378","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0379-installs-apps-on-mobile-device-only-from-trusted-sources","n":"Installs apps on mobile device only from trusted sources","i":"I.0379","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0380-adheres-to-secure-byod-policies","n":"Adheres to secure BYOD policies","i":"I.0380","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0381-applies-least-privilege-to-app-permissions-on-mobile-device","n":"Applies least privilege to app permissions on mobile device","i":"I.0381","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0382-reports-anomalies-in-sim-configuration-on-mobile-device","n":"Reports anomalies in SIM configuration on mobile device","i":"I.0382","d":"IA","x":"Mobile Security"},{"k":"indicator","s":"i-0383-maintains-mdm-compliance","n":"Maintains MDM compliance","i":"I.0383","d":"EP","x":"Mobile Security"},{"k":"indicator","s":"i-0384-violates-security-contract-clauses","n":"Violates security contract clauses","i":"I.0384","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0385-fails-to-meet-security-standards","n":"Fails to meet security standards","i":"I.0385","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0386-grants-excessive-access-privileges","n":"Grants excessive access privileges","i":"I.0386","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0387-uses-unmonitored-api-integrations","n":"Uses unmonitored API integrations","i":"I.0387","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0388-uses-unapproved-cloud-providers","n":"Uses unapproved cloud providers","i":"I.0388","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0389-disposes-sensitive-data-improperly","n":"Disposes sensitive data improperly","i":"I.0389","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0390-employs-unverified-subcontractors","n":"Employs unverified subcontractors","i":"I.0390","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0391-operates-domain-on-watchlist","n":"Operates domain on watchlist","i":"I.0391","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0392-has-history-of-security-breaches","n":"Has history of security breaches","i":"I.0392","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0393-lacks-continuous-security-monitoring","n":"Lacks continuous security monitoring","i":"I.0393","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0394-supplies-or-operates-vulnerable-software-or-platforms","n":"Supplies or operates vulnerable software or platforms","i":"I.0394","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0395-lacks-secure-development-practices","n":"Lacks secure development practices","i":"I.0395","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0396-faces-financial-or-legal-instability","n":"Faces financial or legal instability","i":"I.0396","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0397-skips-insider-background-screening","n":"Skips insider background screening","i":"I.0397","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0398-exhibits-unusual-access-patterns","n":"Exhibits unusual access patterns","i":"I.0398","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0399-uses-shared-or-generic-credentials","n":"Uses shared or generic credentials","i":"I.0399","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0400-lacks-monitoring-of-insider-activity","n":"Lacks monitoring of insider activity","i":"I.0400","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0401-fails-to-report-employee-departures","n":"Fails to report employee departures","i":"I.0401","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0402-delays-breach-notification","n":"Delays breach notification","i":"I.0402","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0403-transfers-data-without-logging","n":"Transfers data without logging","i":"I.0403","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0404-uses-weak-encryption-standards","n":"Uses weak encryption standards","i":"I.0404","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0405-shares-data-with-unapproved-subprocessors","n":"Shares data with unapproved subprocessors","i":"I.0405","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0406-lacks-audit-trail-for-data-access","n":"Lacks audit trail for data access","i":"I.0406","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0407-fails-to-appropriately-manage-shadow-it-use","n":"Fails to appropriately manage shadow IT use","i":"I.0407","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0408-maintains-third-party-rbac-controls","n":"Maintains third-party RBAC controls","i":"I.0408","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0409-conducts-regular-and-timely-audits","n":"Conducts regular and timely audits","i":"I.0409","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0410-requires-use-of-organization-managed-devices","n":"Requires use of organization-managed devices","i":"I.0410","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0411-meets-contractual-compliance-obligations","n":"Meets contractual compliance obligations","i":"I.0411","d":"WC","x":"Third-Party Risk"},{"k":"indicator","s":"i-0412-fails-to-maintain-adequate-audit-trails-for-sensitive-data-access","n":"Fails to maintain adequate audit trails for sensitive data access","i":"I.0412","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0413-allows-circumvention-of-secure-web-gateways","n":"Allows circumvention of secure web gateways","i":"I.0413","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0414-fails-to-require-acknowledgement-of-acceptable-use-policies","n":"Fails to require acknowledgement of acceptable use policies","i":"I.0414","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0415-does-not-review-or-address-security-training-gaps","n":"Does not review or address security training gaps","i":"I.0415","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0416-fails-to-regularly-audit-access-to-regulated-systems","n":"Fails to regularly audit access to regulated systems","i":"I.0416","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0417-allows-shadow-it-use-without-policy-enforcement","n":"Allows shadow IT use without policy enforcement","i":"I.0417","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0418-allows-transmission-of-business-data-via-personal-channels","n":"Allows transmission of business data via personal channels","i":"I.0418","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0419-lacks-effective-user-behavior-analytics-capability","n":"Lacks effective user behavior analytics capability","i":"I.0419","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0420-lacks-rbac-enforcement-on-ephi-systems","n":"Lacks RBAC enforcement on ePHI systems","i":"I.0420","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0421-lack-modern-authentication-mechanisms-to-effectively-manage-privileged-ac","n":"Lack modern authentication mechanisms to effectively manage privileged accounts","i":"I.0421","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0422-fails-to-participate-in-regular-risk-assessments","n":"Fails to participate in regular risk assessments","i":"I.0422","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0423-lacks-sufficient-review-of-policy-exception-requests","n":"Lacks sufficient review of policy exception requests","i":"I.0423","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0424-grants-policy-exceptions-without-adequate-revocation-process","n":"Grants policy exceptions without adequate revocation process","i":"I.0424","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0425-extends-policy-exceptions-beyond-minimum-requirement","n":"Extends policy exceptions beyond minimum requirement","i":"I.0425","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0426-approves-repeated-exceptions-to-endpoint-protection-policies","n":"Approves repeated exceptions to endpoint protection policies","i":"I.0426","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0427-grants-remote-access-without-conditional-controls","n":"Grants remote access without conditional controls","i":"I.0427","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0428-approved-use-of-personal-devices-without-device-management-or-risk-accept","n":"Approved use of personal devices without device management or risk acceptance","i":"I.0428","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0429-fails-to-centrally-track-policy-exceptions","n":"Fails to centrally track policy exceptions","i":"I.0429","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0430-fails-to-revoke-policy-exceptions-in-a-timely-manner","n":"Fails to revoke policy exceptions in a timely manner","i":"I.0430","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0431-fails-to-escalate-critical-infrastructure-policy-violations","n":"Fails to escalate critical infrastructure policy violations","i":"I.0431","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0432-meets-access-control-target-metrics","n":"Meets access control target metrics","i":"I.0432","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0433-meets-risk-mitigation-target-metrics","n":"Meets risk mitigation target metrics","i":"I.0433","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0434-enforces-automated-process-for-policy-exceptions","n":"Enforces automated process for policy exceptions","i":"I.0434","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0435-conducts-audits-of-subordinate-organizations","n":"Conducts audits of subordinate organizations","i":"I.0435","d":"RR","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0436-participates-in-cybersecurity-culture-initiatives","n":"Participates in cybersecurity culture initiatives","i":"I.0436","d":"SC","x":"Policy & Regulatory Compliance"},{"k":"indicator","s":"i-0437-inputs-secrets-into-ai-prompts","n":"Inputs secrets into AI prompts","i":"I.0437","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0438-submits-enterprise-data-to-unmanaged-ai-platforms","n":"Submits enterprise data to unmanaged AI platforms","i":"I.0438","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0439-inputs-proprietary-code-into-ai-tools","n":"Inputs proprietary code into AI tools","i":"I.0439","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0440-inputs-customer-pii-into-ai-tools","n":"Inputs customer PII into AI tools","i":"I.0440","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0441-inputs-sensitive-hr-or-legal-content-into-ai-tools","n":"Inputs sensitive HR or legal content into AI tools","i":"I.0441","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0442-exposes-sensitive-prompts-during-live-sessions","n":"Exposes sensitive prompts during live sessions","i":"I.0442","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0443-uses-unapproved-ai-applications","n":"Uses unapproved AI applications","i":"I.0443","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0444-uses-personal-ai-accounts-for-work","n":"Uses personal AI accounts for work","i":"I.0444","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0445-authorizes-ai-use-outside-job-scope","n":"Authorizes AI use outside job scope","i":"I.0445","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0446-implements-ai-generated-code-without-validation","n":"Implements AI-generated code without validation","i":"I.0446","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0447-sends-unverified-ai-responses-to-customers","n":"Sends unverified AI responses to customers","i":"I.0447","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0448-uses-ai-to-craft-manipulative-or-misleading-content","n":"Uses AI to craft manipulative or misleading content","i":"I.0448","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0449-inputs-third-party-copyrighted-content-into-ai","n":"Inputs third-party copyrighted content into AI","i":"I.0449","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0450-attempts-to-bypass-ai-safety-controls","n":"Attempts to bypass AI safety controls","i":"I.0450","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0451-employs-ai-jailbreak-techniques","n":"Employs AI jailbreak techniques","i":"I.0451","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0452-probes-ai-models-to-extract-training-data","n":"Probes AI models to extract training data","i":"I.0452","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0453-persists-with-unsafe-ai-prompting","n":"Persists with unsafe AI prompting","i":"I.0453","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0454-deploys-unvetted-open-source-ai-models","n":"Deploys unvetted open-source AI models","i":"I.0454","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0455-disregards-enterprise-ai-policies","n":"Disregards enterprise AI policies","i":"I.0455","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0456-accepts-ai-outputs-without-validation","n":"Accepts AI outputs without validation","i":"I.0456","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0457-reviews-prompts-for-sensitive-data","n":"Reviews prompts for sensitive data","i":"I.0457","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0458-uses-enterprise-approved-ai-platforms","n":"Uses enterprise-approved AI platforms","i":"I.0458","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0459-validates-ai-outputs-against-trusted-sources","n":"Validates AI outputs against trusted sources","i":"I.0459","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0460-discloses-ai-use-in-deliverables","n":"Discloses AI use in deliverables","i":"I.0460","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0461-documents-ai-assisted-decisions","n":"Documents AI-assisted decisions","i":"I.0461","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0462-avoids-ai-generated-content-in-compliance-sensitive-contexts","n":"Avoids AI-generated content in compliance-sensitive contexts","i":"I.0462","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0463-uses-pre-approved-ai-prompt-templates","n":"Uses pre-approved AI prompt templates","i":"I.0463","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0464-participates-in-ai-model-risk-assessments","n":"Participates in AI model risk assessments","i":"I.0464","d":"AU","x":"Human Use of AI"},{"k":"indicator","s":"i-0465-attempts-to-override-ai-guardrails","n":"Attempts to override AI guardrails","i":"I.0465","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0466-launches-ai-agents-without-approval","n":"Launches AI agents without approval","i":"I.0466","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0467-runs-privileged-ai-workflows-without-logging","n":"Runs privileged AI workflows without logging","i":"I.0467","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0468-grants-ai-agents-excessive-permissions","n":"Grants AI agents excessive permissions","i":"I.0468","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0469-grants-ai-agents-unnecessary-write-access","n":"Grants AI agents unnecessary write access","i":"I.0469","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0470-configures-ai-agents-to-bypass-safeguards","n":"Configures AI agents to bypass safeguards","i":"I.0470","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0471-manipulates-ai-models-to-bias-outputs","n":"Manipulates AI models to bias outputs","i":"I.0471","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0472-leaves-unmonitored-ai-agents-in-production","n":"Leaves unmonitored AI agents in production","i":"I.0472","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0473-schedules-autonomous-ai-tasks-without-review","n":"Schedules autonomous AI tasks without review","i":"I.0473","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0474-disables-ai-workflow-logging","n":"Disables AI workflow logging","i":"I.0474","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0475-uses-ai-agents-outside-role-authority","n":"Uses AI agents outside role authority","i":"I.0475","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0476-reports-unsafe-ai-agent-behavior","n":"Reports unsafe AI agent behavior","i":"I.0476","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0477-configures-ai-agents-with-least-privilege","n":"Configures AI agents with least privilege","i":"I.0477","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0478-reviews-ai-agent-logs-regularly","n":"Reviews AI agent logs regularly","i":"I.0478","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0479-seeks-approval-before-launching-autonomous-ai-workflows","n":"Seeks approval before launching autonomous AI workflows","i":"I.0479","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0480-enables-real-time-alerts-for-sensitive-ai-actions","n":"Enables real-time alerts for sensitive AI actions","i":"I.0480","d":"AG","x":"Agentic AI"},{"k":"indicator","s":"i-0481-terminates-ai-agents-after-task-completion","n":"Terminates AI agents after task completion","i":"I.0481","d":"AG","x":"Agentic AI"}]