Skip to content
HRM Framework 2.0 , home
Start the assessment

Level 1 · Signals137 signals9 risk domains

Signal library

All 137 level-1 signals of the HRM Taxonomy: the measurable units of human risk, per subject, with dimension, polarity and source.

Social engineering

SE · 27 signals
IDSignalDimensionPolaritySource
SE-T-01 Targeted by real phishing Threat Neutral Email security
SE-T-02 Real phishing delivered to inbox Threat Neutral Email security
SE-T-03 Receives impersonation attempts Threat Neutral Email security
SE-T-04 Receives callback or voice phishing Threat Neutral Email security
SE-T-05 Targeted by mobile or SMS lures Threat Neutral Device management (MDM/UEM)
SE-T-06 Account sending malicious or phishing mail Threat Neutral Email security
SE-A-01 Publicly visible role (exec, finance, HR) Access Neutral HR system
SE-A-02 Holds payment approval authority Access Neutral Finance & payments
SE-A-03 Can reset passwords or MFA for others Access Neutral IT service management
SE-B-01 Clicks simulated phishing links Behavior Risky Awareness & phishing simulation
SE-B-02 Submits credentials to simulations Behavior Risky Awareness & phishing simulation
SE-B-03 Opens simulated attachments Behavior Risky Awareness & phishing simulation
SE-B-04 Clicks links in real phishing Behavior Risky Email security
SE-B-05 Deceived by voice simulations Behavior Risky Awareness & phishing simulation
SE-B-06 Clicks SMS simulations Behavior Risky Awareness & phishing simulation
SE-B-07 Scans simulated QR codes Behavior Risky Awareness & phishing simulation
SE-B-08 Repeat clicker (3+ in 180 days) Behavior Risky Awareness & phishing simulation
SE-B-09 Replies to or engages with suspicious senders Behavior Risky Email security
SE-B-10 Reports simulated phishing Behavior Vigilant Awareness & phishing simulation
SE-B-11 Reports real phishing Behavior Vigilant Email security
SE-B-12 Reports within one hour of delivery Behavior Vigilant Email security
SE-B-13 Identifies voice simulations Behavior Vigilant Awareness & phishing simulation
SE-B-14 Verifies requests out of band Behavior Vigilant Finance & payments
SE-B-15 Deletes suspicious mail without engaging Behavior Vigilant Email security
SE-B-16 Reports safe mail as suspicious Behavior Vigilant Email security
SE-B-17 Reports SMS and voice lures Behavior Vigilant Awareness & phishing simulation
SE-B-18 Grants remote access to an unverified party Behavior Risky Help desk

Identity and access

IA · 25 signals
IDSignalDimensionPolaritySource
IA-T-01 Credentials leaked in a public breach Threat Neutral Breach & dark-web exposure
IA-T-02 Credentials flagged as compromised Threat Neutral Breach & dark-web exposure
IA-T-03 Identity or PII on the dark web Threat Neutral Breach & dark-web exposure
IA-T-04 Targeted by malicious login attempts Threat Neutral Identity provider & MFA
IA-T-05 Activity from anonymous or suspicious IPs Threat Neutral Identity provider & MFA
IA-T-06 Session token or cookie theft indicators Threat Neutral Identity provider & MFA
IA-T-07 Account flagged compromised by the identity provider Threat Neutral Identity provider & MFA
IA-A-01 Holds admin or privileged roles Access Neutral Identity provider & MFA
IA-A-02 Member of privileged security groups Access Neutral IGA, PAM & entitlements
IA-A-03 Privileges unused for 90+ days Access Neutral IGA, PAM & entitlements
IA-A-04 Standing access to backup or storage consoles Access Neutral IGA, PAM & entitlements
IA-A-05 Contingent worker or third-party identity Access Neutral HR system
IA-B-01 Removes an MFA factor Behavior Risky Identity provider & MFA
IA-B-02 Shares credentials Behavior Risky Identity provider & MFA
IA-B-03 Exports credentials from a vault Behavior Risky Identity provider & MFA
IA-B-04 Signs in from unusual contexts Behavior Risky Identity provider & MFA
IA-B-05 Approves MFA after repeated prompts Behavior Risky Identity provider & MFA
IA-B-06 Reuses passwords across systems Behavior Risky Breach & dark-web exposure
IA-B-07 Uses SMS as the only MFA factor Behavior Risky Identity provider & MFA
IA-B-08 Enrolls phishing-resistant MFA Behavior Vigilant Identity provider & MFA
IA-B-09 Uses a password manager Behavior Vigilant Identity provider & MFA
IA-B-10 Signs in through SSO Behavior Vigilant Identity provider & MFA
IA-B-11 Adopts passwordless sign-in Behavior Vigilant Identity provider & MFA
IA-B-12 Reviews and removes own unused access Behavior Vigilant IGA, PAM & entitlements
IA-B-13 Attempts to bypass MFA Behavior Risky Identity provider & MFA

Data handling

DH · 15 signals
IDSignalDimensionPolaritySource
DH-A-01 Access to sensitive data repositories Access Neutral Data security posture
DH-A-02 In a notice period or role change Access Neutral HR system
DH-A-03 Handles regulated data (PCI, PHI, PII) Access Neutral Data security posture
DH-B-01 Downloads data in bulk above own baseline Behavior Risky Web, CASB & DLP
DH-B-02 Uploads data in bulk Behavior Risky Web, CASB & DLP
DH-B-03 Shares sensitive data externally Behavior Risky Web, CASB & DLP
DH-B-04 Violates data-handling policy Behavior Risky Web, CASB & DLP
DH-B-05 Attempts to bypass DLP Behavior Risky Endpoint protection
DH-B-06 Forwards work email to personal accounts Behavior Risky Email security
DH-B-07 Misdelivers email or shares to the wrong party Behavior Risky Email security
DH-B-08 Stores work data in personal cloud Behavior Risky Web, CASB & DLP
DH-B-09 Disposes of data and devices securely Behavior Vigilant IT service management
DH-B-10 Classifies and labels documents Behavior Vigilant Data security posture
DH-B-11 Completes data-handling training Behavior Vigilant Awareness & phishing simulation
DH-B-12 Blocked data transfer attempts Behavior Risky Web, CASB & DLP

Endpoint and device

EP · 19 signals
IDSignalDimensionPolaritySource
EP-T-01 Malware detected on their device Threat Neutral Endpoint protection
EP-T-02 Exploitable vulnerability on their device Threat Neutral Vulnerability management
EP-T-03 Infostealer indicators on a device they use Threat Neutral Breach & dark-web exposure
EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device Threat Neutral Endpoint protection
EP-T-05 Device quarantined or flagged compromised Threat Neutral Endpoint protection
EP-A-01 Local admin rights on endpoints Access Neutral Endpoint protection
EP-A-02 Owns internet-facing or critical systems Access Neutral Vulnerability management
EP-B-01 Disables or tampers with EDR Behavior Risky Endpoint protection
EP-B-02 Connects USB storage Behavior Risky Endpoint protection
EP-B-03 Uses a rooted or jailbroken device Behavior Risky Device management (MDM/UEM)
EP-B-04 Device fails MDM or encryption policy Behavior Risky Device management (MDM/UEM)
EP-B-05 Runs suspicious processes or unapproved software Behavior Risky Endpoint protection
EP-B-06 Defers patches repeatedly Behavior Risky Vulnerability management
EP-B-07 Leaves devices unlocked or unattended Behavior Risky Device management (MDM/UEM)
EP-B-08 Lost or stolen device reported late Behavior Risky IT service management
EP-B-09 Tailgates or shares badge access Behavior Risky Badge & physical access
EP-B-10 Installs updates promptly Behavior Vigilant Vulnerability management
EP-B-11 Keeps a compliant, protected device Behavior Vigilant Device management (MDM/UEM)
EP-B-12 Reports lost devices within 24 hours Behavior Vigilant IT service management

Web, cloud and SaaS

WC · 12 signals
IDSignalDimensionPolaritySource
WC-T-01 Lookalike domains registered against the brand Threat Neutral Breach & dark-web exposure
WC-T-02 Third-party app they use was breached Threat Neutral Web, CASB & DLP
WC-A-01 Owns third-party integrations or OAuth apps Access Neutral IGA, PAM & entitlements
WC-B-01 Visits known-malicious websites Behavior Risky Web, CASB & DLP
WC-B-02 Bypasses web filtering Behavior Risky Web, CASB & DLP
WC-B-03 Visits unauthorized websites Behavior Risky Web, CASB & DLP
WC-B-04 Grants risky OAuth permissions Behavior Risky Web, CASB & DLP
WC-B-05 Uses unauthorized SaaS apps Behavior Risky Web, CASB & DLP
WC-B-06 Installs unvetted browser extensions Behavior Risky Web, CASB & DLP
WC-B-07 Uses public Wi-Fi without VPN Behavior Risky Device management (MDM/UEM)
WC-B-08 Downloads from trusted sources only Behavior Vigilant Web, CASB & DLP
WC-B-09 Reviews and revokes own app grants Behavior Vigilant IGA, PAM & entitlements

AI use

AU · 8 signals
IDSignalDimensionPolaritySource
AU-T-01 Targeted by deepfake or AI-generated lures Threat Neutral Email security
AU-A-01 Administers an enterprise AI platform Access Neutral Identity provider & MFA
AU-B-01 Uses unauthorized AI tools Behavior Risky Web, CASB & DLP
AU-B-02 Puts sensitive data in AI prompts Behavior Risky Web, CASB & DLP
AU-B-03 Uses personal accounts on AI platforms Behavior Risky Web, CASB & DLP
AU-B-04 Uses the sanctioned AI tools Behavior Vigilant Web, CASB & DLP
AU-B-05 Acts on AI output without validation Behavior Risky Pulse survey
AU-B-06 Validates AI output against trusted sources Behavior Vigilant Pulse survey

AI agents

AG · 9 signals
IDSignalDimensionPolaritySource
AG-A-01 Owns AI agents or service identities Access Neutral IGA, PAM & entitlements
AG-B-01 Grants agents broad or standing permissions Behavior Risky IGA, PAM & entitlements
AG-B-02 Registers agents with a named owner Behavior Vigilant IGA, PAM & entitlements
AG-A-02 Agent holds broad or standing permissions Access Neutral IGA, PAM & entitlements
AG-T-01 Agent credentials or tokens exposed Threat Neutral Breach & dark-web exposure
AG-B-03 Launches an agent without approval Behavior Risky IGA, PAM & entitlements
AG-B-04 Agent runs without logging enabled Behavior Risky SIEM, SOAR & incident tickets
AG-B-05 Agent acts outside its assigned role Behavior Risky SIEM, SOAR & incident tickets
AG-B-06 Terminates an agent after its task completes Behavior Vigilant IGA, PAM & entitlements

Security culture

SC · 9 signals
IDSignalDimensionPolaritySource
SC-B-01 Overconfident: self-rated ability exceeds results Behavior Risky Pulse survey
SC-B-02 Takes voluntary training Behavior Vigilant Awareness & phishing simulation
SC-B-03 Retains knowledge over time Behavior Vigilant Awareness & phishing simulation
SC-B-04 Joins awareness events and exercises Behavior Vigilant Awareness & phishing simulation
SC-B-05 Responds to the culture pulse Behavior Vigilant Pulse survey
SC-B-06 Asks security for help before a project Behavior Vigilant Help desk
SC-B-07 Serves as a security ambassador Behavior Vigilant Awareness & phishing simulation
SC-B-08 Rates the security team positively in the pulse Behavior Vigilant Pulse survey
SC-B-09 Reports friction with security controls Behavior Risky Pulse survey

Readiness and response

RR · 13 signals
IDSignalDimensionPolaritySource
RR-B-01 Training past due Behavior Risky Awareness & phishing simulation
RR-B-02 Fails training assessments Behavior Risky Awareness & phishing simulation
RR-B-03 Repeat security-related help desk tickets Behavior Risky Help desk
RR-B-04 Completes security training Behavior Vigilant Awareness & phishing simulation
RR-B-05 Completes role-based training Behavior Vigilant Awareness & phishing simulation
RR-B-06 Reports a real incident or near miss Behavior Vigilant SIEM, SOAR & incident tickets
RR-B-07 Acknowledges security policies Behavior Vigilant Awareness & phishing simulation
RR-B-08 Starts assigned training promptly Behavior Vigilant Awareness & phishing simulation
RR-B-09 Technical policy violations Behavior Risky Web, CASB & DLP
RR-T-01 Incident opened and attributed to the person Threat Neutral SIEM, SOAR & incident tickets
RR-B-10 Responds to emergency notification tests Behavior Vigilant Awareness & phishing simulation
RR-B-11 Participates in incident exercises Behavior Vigilant Awareness & phishing simulation
RR-A-01 Holds an active policy exception Access Neutral IT service management

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment