Level 4Evidence level
Breach scenarios
The breach scenario the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category and tagged with the SOC incident types that make it a priority. Breach scenarios tie signals, cohorts and sequences to the organization's own incidents, and the list can grow without changing the levels beneath it.
Example
Account takeover, business email compromise, ransomware, data loss.
All breach scenarios
10- Phishing & social engineering HB-01
- Credential abuse & account takeover HB-02
- Ransomware & malware intrusion HB-03
- Vulnerability exploitation HB-04
- BEC & payment fraud HB-05
- Data mishandling & error HB-06
- Insider & privilege misuse HB-07
- Third-party, OAuth & supply chain HB-08
- Shadow AI & agent misuse HB-09
- Lost & stolen devices HB-10
"Breach scenarios" (Level 4), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/levels/breach-scenarios
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.