Level 3Evidence level
Sequences
An ordered run of signals across MITRE ATT&CK tactics inside a detection window, from first exposure to compromise evidence. A completed sequence moves a subject to Stage 4 Suspected. A vigilant behavior at any step breaks the sequence.
Example
Real phish delivered, link clicked, unusual sign-in, new MFA device within 72 hours.
All sequences
11- Phish to takeover SQ-ATO-01
- Leak to login SQ-ATO-02
- MFA fatigue SQ-ATO-03
- Help-desk takeover SQ-ATO-04
- Click to execution SQ-RAN-01
- Stealer to ransomware SQ-RAN-02
- Quiet exit SQ-DL-01
- Shadow AI drift SQ-DL-02
- Approver under attack SQ-FR-01
- Dormant to dangerous SQ-PRV-01
- Consent to compromise SQ-OAUTH-01
"Sequences" (Level 3), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/levels/sequences
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.