Level 2Evidence level
Cohorts
Two or three signals that describe the same subject at once, named as a population a program can count, trend and act on. Five classes: Targeted (Behavior plus Threat), High-impact (Behavior plus Access), Critical (all three), Risky and Vigilant. Two cohorts use a 'not' clause, such as a repeat clicker who never reports. Each cohort is Easy, Medium or Hard to put to work, from how its signals are obtained.
Example
People who click simulations while being targeted by real phishing.
All cohorts
24- Clicks simulations while targeted by real phishing CR-SE-01
- Real-phish clicker with privileged access CR-SE-02
- Social engineering critical triad CR-SE-03
- Silent repeat clicker CR-SE-04
- Help-desk staff deceived by voice simulations CR-SE-05
- Payment approver fooled by impersonation CR-SE-06
- Human sensor CR-SE-07
- Exposed credentials without strong MFA CR-IA-01
- Admin who removed MFA CR-IA-02
- Credential sharer with privilege CR-IA-03
- Dormant privilege, unusual login CR-IA-04
- Keyholder with standing backup access and reuse CR-IA-05
- Bulk mover in a notice period CR-DH-01
- Sensitive sharer with sensitive access CR-DH-02
- EDR tamperer with local admin CR-EP-01
- Malicious-site visitor on a vulnerable device CR-EP-02
- Patch deferrer owning internet-facing systems CR-EP-03
- Risky OAuth grant with sensitive access CR-WC-01
- Shadow AI with sensitive data CR-AU-01
- Over-scoped agent without logging CR-AG-02
- Risky owner of AI agents CR-AG-01
- Exception holder who clicks CR-RR-01
- Overconfident clicker CR-SC-01
- Compromised account with privilege CR-IA-06
"Cohorts" (Level 2), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/levels/cohorts
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.