Indicator library481 indicators16 categories
Indicator library
All 481 indicators of the HRM Taxonomy, organized by category and risk domain. Indicators are detailed observations beneath the signals; only signals carry source and standards mappings.
C.01 Communication security
50 indicators · Social engineering- I.0001Opens real phishing emails
- I.0002Receives real phishing emails
- I.0003Receives real phishing emails with malware
- I.0004Target of real phishing emails
- I.0005Clicks links in real phishing emails
- I.0006Enables phishing reporter buttons
- I.0007Reports suspected phishing or other suspicious emails to security for analysis
- I.0008Reports suspected phishing emails that are tagged as suspicious
- I.0009Reports real phishing emails
- I.0010Reports real phishing emails resulting in quarantine
- I.0011Reports legitimate emails as phishing emails
- I.0012Reports suspicious SMS messages
- I.0013Replies to emails from unknown or spoofed senders
- I.0014Forwards email messages to an unauthorized mailbox
- I.0015Opens attachments from quarantined email messages
- I.0016Opens attachments from email messages with unknown senders
- I.0017Deletes phishing emails without opening
- I.0018Marks legitimate security alerts as junk messages
- I.0019Replies to flagged phishing emails after warning
- I.0020Downloads attachments from emails with mismatched display name and sender
- I.0021Configures a mailbox rule that bypasses security controls
- I.0022Sends email messages to risky distribution lists
- I.0023Sends files to personal accounts
- I.0024Sends credentials through chat messages
- I.0025Shares meeting links on public websites
- I.0026Accepts file transfers from unknown external contacts
- I.0027Removes sensitivity labels from email messages
- I.0028Attempts to bypass attachment blocking by renaming files
- I.0029Adds potentially risky domains to "safe senders" list
- I.0030Replies all with external recipients
- I.0031Deletes security banner before sending messages
- I.0032Shares sensitive content via email messages
- I.0033Shares sensitive data to public folders
- I.0034Shares sensitive content via chat
- I.0035Uses personal email for work correspondence
- I.0036Reveals project codes names or internal initiatives in public channels
- I.0037Interacts with calendar invites that may pose security risk
- I.0038Screenshares confidential content in virtual meetings with external participants
- I.0039Clicks links in SMS messages from unknown senders or as part of SMS phishing simulation
- I.0040Enables macros in untrusted documents
- I.0041Accesses shortened URLs from unknown sources
- I.0042Attempts to download content from email messages with blocked external images
- I.0043Accepts redirected links from unknown domains
- I.0044Accepts shared file invites from spoofed domains
- I.0045Clicks unsubscribe links in unsolicited newsletters
- I.0046Opens encrypted messages from unverified senders
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0050Disables or tampers with emails security controls
C.02 Engagement & awareness
49 indicators · Social engineering- I.0051Opens simulated phishing emails one or more times
- I.0052Clicks links in simulated phishing emails
- I.0053Enters credentials on websites linked from simulated phishing emails
- I.0054Opens file attachments to simulated phishing emails
- I.0055Fails to report simulated phishing emails after opening
- I.0056Deletes simulated phishing emails without reporting
- I.0057Responds to simulated phishing emails
- I.0058Reports simulated phishing emails
- I.0059Forwards simulated phishing emails to security team
- I.0060Provides helpful feedback on simulated phishing emails
- I.0061Opens simulated SMS phishing messages
- I.0062Responds to simulated SMS phishing messages
- I.0063Fails to report simulated SMS phishing messages
- I.0064Reports simulated SMS phishing messages
- I.0065Ignores or deletes simulated SMS phishing messages
- I.0066Does not respond to simulated fraudulent MFA prompts
- I.0067Marks simulated fraudulent MFA prompts as mistaken
- I.0068Denies simulated fraudulent MFA prompts and reports them
- I.0069Responds promptly with correct action
- I.0070Does not respond to emergency notification test
- I.0071Responds to emergency notification test
- I.0072Verifies receipt of emergency communications through proper channels
- I.0073Completes in-person trainings
- I.0074Has overdue trainings
- I.0075Fails to attempt assigned trainings
- I.0076Fails assigned trainings
- I.0077Completes assigned trainings late
- I.0078Avoids training
- I.0079Completes assigned trainings
- I.0080Completes assigned trainings on time
- I.0081Passes assigned trainings
- I.0082Attempts assigned trainings
- I.0083Re-attempts failed trainings
- I.0084Engages with optional trainings
- I.0085Skips interactive training modules
- I.0086Completes collaborative trainings
- I.0087Completes collaborative trainings on time
- I.0088Fails to complete collaborative trainings
- I.0089Skips assigned trainings
- I.0090Reports high confidence in security self assessments
- I.0091Reports low confidence in security self assessments
- I.0092Reports high confidence in phishing-related self assessments
- I.0093Reports low confidence in phishing-related self assessments
- I.0094Reports high confidence in organizational security readiness
- I.0095Reports low confidence in organizational security readiness
- I.0096Completes training consistently over multiple assigned trainings
- I.0097Fails phishing simulations less frequently over time
- I.0098Reports increased confidence in security self assessments
- I.0099Fails security simulations less frequently over time
C.03 Data protection
38 indicators · Web, cloud and SaaS- I.0100Uses personal tools to access enterprise documents
- I.0101Syncs enterprise data to personal cloud storage
- I.0102Installs personal cloud backup tools on enterprise devices
- I.0103Copies enterprise data into personal AI chat tools
- I.0104Signs into enterprise apps from unmanaged devices
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0116Downloads executable files from suspicious domains
- I.0117Opens shortened URLs from unknown senders
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0125Attempts unauthorized privilege escalation in cloud apps
- I.0126Uploads sensitive files to unauthorized web apps
- I.0127Uses root credentials for cloud administrative access
- I.0128Uploads code to unsanctioned repositories
- I.0129Accesses SaaS apps only from managed devices
- I.0130Reports phishing emails without clicking
- I.0131Stores sensitive documents only in approved cloud platforms
- I.0132Shares documents using view-only permissions by default
- I.0133Uses browser extensions only from approved list
- I.0134Regularly uses browser password manager with MFA
- I.0135Logs out of sensitive applications after use
- I.0136Hovers over links before clicking
- I.0137Avoids repeated access attempts to restricted cloud content
C.04 Identity & access risk
17 indicators · Identity and access- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0142Uses injected credentials to access protected resources
- I.0143Subverts access controls or disables auditing mechanisms
- I.0144Manipulates identity federation settings to bypass controls
- I.0145Configures persistence mechanisms to maintain unauthorized access
- I.0146Uses cached or stolen credentials to gain unauthorized access
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0148Communicates with known threat actors
- I.0149Engages in activity inconsistent with approved roles
- I.0150Modifies or deletes identity policies to gain unauthorized access
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0152Disables monitoring or logging to conceal unauthorized activity
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
C.05 Web & cloud usage
28 indicators · Web, cloud and SaaS- I.0155Processes source code with unapproved AI services
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0164Visits websites categorized as AI tools
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0171Uses multiple cloud services with overlapping functionality
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0173Accesses cloud applications exclusively via SSO
- I.0174Uses only approved SaaS platforms
- I.0175Reports suspicious browser activity
- I.0176Reports unauthorized or unknown SaaS applications
- I.0177Regularly accesses security awareness resources
- I.0178Submits help desk tickets for blocked or restricted services
- I.0179Signs into SaaS applications with multi-factor authentication
- I.0180Downloads documents from unrecognized cloud platforms
- I.0181Browses websites in approved safe categories
- I.0182Uses cloud collaboration tools only during business hours
C.06 Endpoint & device security
40 indicators · Endpoint and device- I.0183Runs unsupported operating system versions
- I.0184Disables endpoint security controls
- I.0185Uses devices without full-disk encryption
- I.0186Delays software updates repeatedly
- I.0187Uses devices with excessive admin privileges
- I.0188Uses devices with unnecessary or risky software
- I.0189Uses devices with malware detections
- I.0190Runs files from suspicious or unrecognized USB devices
- I.0191Uses devices that communicate with command-and-control infrastructure
- I.0192Downloads and executes malicious files
- I.0193Uses devices exhibiting lateral movement behaviors
- I.0194Uses devices missing critical patches
- I.0195Runs unsupported legacy applications
- I.0196Delays reboots after patch installation
- I.0197Installs unapproved software
- I.0198Runs portable applications from external drives
- I.0199Uses personal devices for enterprise work without enrollment
- I.0200Connects to unknown USB peripherals
- I.0201Uses devices that boot from removable media
- I.0202Charges devices from untrusted USB sources
- I.0203Stores sensitive data in unprotected local folders
- I.0204Copies sensitive data to removable media
- I.0205Transfers sensitive content via clipboard
- I.0206Uses devices observed to frequently visit risky websites
- I.0207Disables screen lock or timeout
- I.0208Leaves devices unlocked in public or shared spaces
- I.0209Uses jailbroken or rooted mobile devices for work
- I.0210Installs remote access tools without approval
- I.0211Runs browser-based games or crypto mining on work devices
- I.0212Operates outdated device models with unsupported hardware
- I.0213Installs software updates promptly after release
- I.0214Locks devices during inactivity
- I.0215Isolates devices immediately after suspicious behavior
- I.0216Uninstalls unused or risky software proactively
- I.0217Uses devices with full-disk encryption
- I.0218Uses only approved USB devices for file transfers
- I.0219Responds to EDR warnings before IT intervention
- I.0220Avoids running executables from unverified sources
- I.0221Maintains baseline system configurations
- I.0222Engages with endpoint health check tools proactively
C.07 Physical security
20 indicators · Endpoint and device- I.0223Badges in without badging out
- I.0224Badges out without prior badge in
- I.0225Allows additional person to enter without authorization
- I.0226Holds secure door open beyond expected duration
- I.0227Attempts to access unauthorized areas with badge
- I.0228Accumulates excessive denied access attempts
- I.0229Accesses facilities more frequently than expected
- I.0230Accesses facilities outside expected hours
- I.0231Accesses facilities using unexpected badge
- I.0232Accesses facilities while on leave
- I.0233Accesses facilities after offboarding
- I.0234Accesses multiple facilities simultaneously
- I.0235Visits sensitive zones for unusually short durations
- I.0236Loiters in sensitive zones beyond expected durations
- I.0237Appears onsite while also appearing remote
- I.0238Fails to display badge when onsite
- I.0239Sponsors visitors more frequently than expected
- I.0240Attempts to sponsor unauthorized visitors
- I.0241Fails to respond appropriately during security drills
- I.0242Fails clean desk policy audit
C.08 Social engineering risks
15 indicators · Social engineering- I.0243Demonstrates susceptibility to authority exploitation
- I.0244Demonstrates susceptibility to urgency and scarcity pressure
- I.0245Demonstrates susceptibility to fear and intimidation
- I.0246Demonstrates susceptibility to trust and familiarity abuse
- I.0247Demonstrates susceptibility to reciprocity and obligation
- I.0248Demonstrates susceptibility to curiosity and novelty triggers
- I.0249Demonstrates susceptibility to greed and reward motivation
- I.0250Demonstrates susceptibility to empathy and helpfulness
- I.0251Demonstrates susceptibility to commitment and consistency
- I.0252Demonstrates susceptibility to social proof and herd mentality
- I.0253Demonstrates susceptibility to overconfidence exploitation
- I.0254Demonstrates susceptibility to fatigue and cognitive overload
- I.0255Demonstrates susceptibility to fear of missing out (FOMO)
- I.0256Demonstrates susceptibility to sympathy manipulation
- I.0257Demonstrates susceptibility to pretexting deception
C.09 Incident response readiness
36 indicators · Readiness and response- I.0258Files incident tickets without actionable evidence
- I.0259Misroutes or mislabels incident severity
- I.0260Misclassifies or overuses incident reporting channels
- I.0261Fails to recognize or detect security threats
- I.0262Deviates from documented incident reporting workflows
- I.0263Demonstrates gaps in incident participation or coordination
- I.0264Delays or fails to complete assigned security training consistently
- I.0265Circumvents or evades security training platforms
- I.0266Completes security awareness training with low engagement
- I.0267Completes training misaligned with role or risk responsibilities
- I.0268Ignores or delays pager acknowledgments beyond SLA
- I.0269Creates duplicate incident tickets for the same event
- I.0270Shares incident details in public or unsanctioned channels
- I.0271Performs containment without documenting actions
- I.0272Submits malformed or context-free indicators
- I.0273Mishandles or overwrites incident evidence
- I.0274Bypasses controls citing business urgency without approval
- I.0275Fails to complete post-incident actions
- I.0276Declines or minimally engages in incident simulations
- I.0277Embeds secrets or PII in free-text fields
- I.0278Misses regulatory or customer notification triggers
- I.0279Acknowledges pager alerts within SLA
- I.0280Escalates incidents correctly on first attempt
- I.0281Attaches relevant evidence to incident tickets
- I.0282Correlates related alerts into a single incident
- I.0283Uses approved channels for incident coordination
- I.0284Documents containment actions with timestamps
- I.0285Provides high-quality indicators of compromise
- I.0286Follows playbooks and SOAR runbooks as written
- I.0287Preserves chain of custody for digital evidence
- I.0288Requests emergency exceptions with proper approval
- I.0289Completes post-incident action items on time
- I.0290Leads effective incident handoffs across shifts
- I.0291Participates in incident simulations with high engagement
- I.0292Uses secure storage for sensitive ticket data
- I.0293Requests timely legal/compliance notification when required
C.10 Remote work risk
38 indicators · Endpoint and device- I.0294Uses shared home device to access corporate systems
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0298Fails device posture checks during remote access
- I.0299Rarely connects to device management platform
- I.0300Delays applying patches while remote
- I.0301Disables device encryption outside office environments
- I.0302Uses unmanaged personal device for corporate access
- I.0303Copies corporate files to personal devices or media
- I.0304Accesses work apps from consumer devices
- I.0305Installs unapproved remote access tools
- I.0306Reuses home network credentials on corporate systems
- I.0307Configures auto-forwarding of work email to personal accounts
- I.0308Shares sensitive data during screen sharing sessions
- I.0309Records meetings without participant consent
- I.0310Posts sensitive content in unsecured chat applications
- I.0311Works remotely without connecting to VPN
- I.0312Uses shared household accounts on corporate devices
- I.0313Establishes simultaneous VPN sessions from different locations
- I.0314Uses outdated or insecure VPN protocols
- I.0315Leaves work device unattended in public places
- I.0316Enables video or audio in non-private settings
- I.0317Views sensitive data on screen in public areas
- I.0318Displays sensitive data on external monitors in public
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0320Connects from geolocations inconsistent with work profile
- I.0321Uses open Wi-Fi networks without VPN
- I.0322Uses corporate VPN consistently during remote work
- I.0323Applies privacy measures when working in shared spaces
- I.0324Validates Wi-Fi security before connecting remotely
- I.0325Avoids printing or transporting sensitive documents
- I.0326Uses blurred or virtual backgrounds during video calls
- I.0327Connects regularly to device management platform while remote
- I.0328Uses encrypted platforms for file sharing
- I.0329Restricts email use to enterprise-managed accounts
- I.0330Reviews remote work security policies regularly
- I.0331Keeps personal and corporate accounts strictly separated
C.11 Digital exposure risk
32 indicators · Identity and access- I.0332Appears in recent breach with corporate email
- I.0333Appears in multiple breaches within recent time period
- I.0334Reuses exposed passwords across accounts
- I.0335Uses password pattern similar to exposed passwords
- I.0336Rotates credentials promptly after exposures
- I.0337Appears in infostealer logs with corporate cookies
- I.0338Exposes recovery codes or OTP seeds in stealer logs
- I.0339Exposes corporate OAuth tokens or refresh tokens
- I.0340Appears in stealer logs with browser auto-fill data
- I.0341Revokes exposed sessions and tokens within SLA
- I.0342Exposes API keys or cloud credentials in public repos
- I.0343Exposes SSH private keys or key material
- I.0344Removes exposed secrets within remediation SLA
- I.0345Exposes personal identifiers linked to corporate identity
- I.0346Exposes security questions and answers
- I.0347Exposes government ID images or numbers
- I.0348Appears in SIM-swap or account takeover chatter
- I.0349Requests takedown for personal data exposures
- I.0350Is impersonated by lookalike social or messaging accounts
- I.0351Is targeted in ransomware or extortion leak posts
- I.0352Is listed in company access for sale offers
- I.0353Reports impersonation promptly via official channels
- I.0354Posts corporate data to paste sites or public bins
- I.0355Shares internal documents on public file hosts
- I.0356Removes public links and rotates exposed data quickly
- I.0357Publishes contact details enabling high-fidelity lures
- I.0358Suppresses public footprint of sensitive contact data
- I.0359Appears in breaches of critical third-party vendors
- I.0360Uses unique credentials across vendor portals
- I.0361Acknowledges breach-intel notifications within SLA
- I.0362Ignores breach-intel notifications beyond SLA
- I.0363Confirms credential reset for exposed accounts
C.12 Mobile security
20 indicators · Endpoint and device- I.0364Operates rooted or jailbroken mobile device
- I.0365Disables full-disk encryption on mobile device
- I.0366Connects mobile device to untrusted Wi-Fi
- I.0367Fails to maintain secure VPN tunnel on mobile device
- I.0368Installs sideloaded or unapproved applications on mobile device
- I.0369Grants excessive mobile app permissions
- I.0370Exhibits SIM swap indicators
- I.0371Removes or tampers with MDM profile
- I.0372Operates mobile device from restricted geolocation
- I.0373Lacks remote wipe capability on mobile device
- I.0374Runs mobile device with preinstalled riskware
- I.0375Adheres to authorized mobile device maintenance
- I.0376Applies security patches on mobile device
- I.0377Maintains secure bootloader configuration on mobile device
- I.0378Practices safe public Wi-Fi usage on mobile device
- I.0379Installs apps on mobile device only from trusted sources
- I.0380Adheres to secure BYOD policies
- I.0381Applies least privilege to app permissions on mobile device
- I.0382Reports anomalies in SIM configuration on mobile device
- I.0383Maintains MDM compliance
C.13 Third-party risk
28 indicators · Web, cloud and SaaS- I.0384Violates security contract clauses
- I.0385Fails to meet security standards
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0392Has history of security breaches
- I.0393Lacks continuous security monitoring
- I.0394Supplies or operates vulnerable software or platforms
- I.0395Lacks secure development practices
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0400Lacks monitoring of insider activity
- I.0401Fails to report employee departures
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
- I.0406Lacks audit trail for data access
- I.0407Fails to appropriately manage shadow IT use
- I.0408Maintains third-party RBAC controls
- I.0409Conducts regular and timely audits
- I.0410Requires use of organization-managed devices
- I.0411Meets contractual compliance obligations
C.14 Policy & regulatory compliance
25 indicators · Readiness and response- I.0412Fails to maintain adequate audit trails for sensitive data access
- I.0413Allows circumvention of secure web gateways
- I.0414Fails to require acknowledgement of acceptable use policies
- I.0415Does not review or address security training gaps
- I.0416Fails to regularly audit access to regulated systems
- I.0417Allows shadow IT use without policy enforcement
- I.0418Allows transmission of business data via personal channels
- I.0419Lacks effective user behavior analytics capability
- I.0420Lacks RBAC enforcement on ePHI systems
- I.0421Lack modern authentication mechanisms to effectively manage privileged accounts
- I.0422Fails to participate in regular risk assessments
- I.0423Lacks sufficient review of policy exception requests
- I.0424Grants policy exceptions without adequate revocation process
- I.0425Extends policy exceptions beyond minimum requirement
- I.0426Approves repeated exceptions to endpoint protection policies
- I.0427Grants remote access without conditional controls
- I.0428Approved use of personal devices without device management or risk acceptance
- I.0429Fails to centrally track policy exceptions
- I.0430Fails to revoke policy exceptions in a timely manner
- I.0431Fails to escalate critical infrastructure policy violations
- I.0432Meets access control target metrics
- I.0433Meets risk mitigation target metrics
- I.0434Enforces automated process for policy exceptions
- I.0435Conducts audits of subordinate organizations
- I.0436Participates in cybersecurity culture initiatives
C.15 Human use of AI
28 indicators · AI use- I.0437Inputs secrets into AI prompts
- I.0438Submits enterprise data to unmanaged AI platforms
- I.0439Inputs proprietary code into AI tools
- I.0440Inputs customer PII into AI tools
- I.0441Inputs sensitive HR or legal content into AI tools
- I.0442Exposes sensitive prompts during live sessions
- I.0443Uses unapproved AI applications
- I.0444Uses personal AI accounts for work
- I.0445Authorizes AI use outside job scope
- I.0446Implements AI-generated code without validation
- I.0447Sends unverified AI responses to customers
- I.0448Uses AI to craft manipulative or misleading content
- I.0449Inputs third-party copyrighted content into AI
- I.0450Attempts to bypass AI safety controls
- I.0451Employs AI jailbreak techniques
- I.0452Probes AI models to extract training data
- I.0453Persists with unsafe AI prompting
- I.0454Deploys unvetted open-source AI models
- I.0455Disregards enterprise AI policies
- I.0456Accepts AI outputs without validation
- I.0457Reviews prompts for sensitive data
- I.0458Uses enterprise-approved AI platforms
- I.0459Validates AI outputs against trusted sources
- I.0460Discloses AI use in deliverables
- I.0461Documents AI-assisted decisions
- I.0462Avoids AI-generated content in compliance-sensitive contexts
- I.0463Uses pre-approved AI prompt templates
- I.0464Participates in AI model risk assessments
C.16 Agentic AI
17 indicators · AI agents- I.0465Attempts to override AI guardrails
- I.0466Launches AI agents without approval
- I.0467Runs privileged AI workflows without logging
- I.0468Grants AI agents excessive permissions
- I.0469Grants AI agents unnecessary write access
- I.0470Configures AI agents to bypass safeguards
- I.0471Manipulates AI models to bias outputs
- I.0472Leaves unmonitored AI agents in production
- I.0473Schedules autonomous AI tasks without review
- I.0474Disables AI workflow logging
- I.0475Uses AI agents outside role authority
- I.0476Reports unsafe AI agent behavior
- I.0477Configures AI agents with least privilege
- I.0478Reviews AI agent logs regularly
- I.0479Seeks approval before launching autonomous AI workflows
- I.0480Enables real-time alerts for sensitive AI actions
- I.0481Terminates AI agents after task completion
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.