Stages6 stages
Stages
Six stages on the road from exposure to incident, with the rule that moves a person or AI agent in and out of each. The steps of every sequence are placed on them.
The road from exposure to incident
-
Stage 0
Clear
The person has no active threat, access or risky-behavior signal inside any dwell window.
-
Stage 1
Exposed
The person is targeted by a real threat, or holds access an attacker would want, and has shown no risky behavior yet.
-
Stage 2
Susceptible
The person has shown risky behavior in a simulation or in hygiene telemetry, and no real threat has reached them yet.
-
Stage 3
Exploited
The person acted on a real threat: a real click, a real consent, a real reply or a real credential submitted.
-
Stage 4
Suspected
Signals point to a compromise of the person's account or device that the SOC has not yet confirmed.
-
Stage 5
Confirmed
The SOC opened an incident and attributed it to the person; when it closes, the person returns to Stage 1 for a 90-day watch.
0 Clear
0 of 11 sequences reach it- Meaning
- The person has no active threat, access or risky-behavior signal inside any dwell window.
- Enters when
- No active indicators
- Leaves when
- Any Threat, Access or risky Behavior indicator fires
- ATT&CK tactics
- None
1 Exposed
9 of 11 sequences reach it- Meaning
- The person is targeted by a real threat, or holds access an attacker would want, and has shown no risky behavior yet.
- Enters when
- A Threat indicator in the last 90 days, or a standing Access indicator
- Leaves when
- 90 days without a new Threat signal; Access re-evaluated at every sync
- ATT&CK tactics
- Reconnaissance, Resource Development
2 Susceptible
1 of 11 sequences reach it- Meaning
- The person has shown risky behavior in a simulation or in hygiene telemetry, and no real threat has reached them yet.
- Enters when
- A risky Behavior indicator: simulations in the last 180 days, hygiene in the last 90
- Leaves when
- The window passes with no repeat, or a vigilant behavior offsets it
- ATT&CK tactics
- No ATT&CK tactic: the person has not yet met a real attack
3 Exploited
8 of 11 sequences reach it- Meaning
- The person acted on a real threat: a real click, a real consent, a real reply or a real credential submitted.
- Enters when
- A real-threat interaction in the last 30 days
- Leaves when
- 30 days with no repeat drops to Stage 2; a report within 1 hour drops it immediately
- ATT&CK tactics
- Initial Access, Execution
4 Suspected
10 of 11 sequences reach it- Meaning
- Signals point to a compromise of the person's account or device that the SOC has not yet confirmed.
- Enters when
- A sequence completes, or a compromise indicator fires within 14 days of Stage 3
- Leaves when
- SOC closes it as benign, or 14 days pass with no escalation
- ATT&CK tactics
- Credential Access, Persistence, Privilege Escalation, Defense Evasion
5 Confirmed
0 of 11 sequences reach it- Meaning
- The SOC opened an incident and attributed it to the person; when it closes, the person returns to Stage 1 for a 90-day watch.
- Enters when
- Incident opened and attributed to the person
- Leaves when
- Incident closed; the person returns to Stage 1 for a 90-day watch
- ATT&CK tactics
- Collection, Exfiltration, Impact
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.