Level 1Evidence level
Signals
One observable unit of evidence about one subject from one source: a real phish delivered, a simulated link clicked, a privileged role held. Each of the 137 signals belongs to one risk domain and one dimension (Threat, Access or Behavior) and carries a polarity, a data source, a dwell window and mappings to NIST CSF 2.0 and, where a technique applies, MITRE ATT&CK. The 481 library indicators sit beneath the signals as detailed observations.
Example
A phishing message received, a simulation clicked, or a privileged role held.
First twelve signals (see the full library)
12- Targeted by real phishing SE-T-01
- Real phishing delivered to inbox SE-T-02
- Receives impersonation attempts SE-T-03
- Receives callback or voice phishing SE-T-04
- Targeted by mobile or SMS lures SE-T-05
- Account sending malicious or phishing mail SE-T-06
- Publicly visible role (exec, finance, HR) SE-A-01
- Holds payment approval authority SE-A-02
- Can reset passwords or MFA for others SE-A-03
- Clicks simulated phishing links SE-B-01
- Submits credentials to simulations SE-B-02
- Opens simulated attachments SE-B-03
"Signals" (Level 1), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/levels/signals
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.