HRM-CORE-04Term
Threat × Access × Behavior model
The risk model behind the taxonomy. Threat is what reaches a person, Access is what the person could expose, Behavior is what the person does. Risk rises with the product of the three; vigilant behavior lowers it.
Example
An analyst sees that a help-desk agent (Access) who received a callback phishing attempt (Threat) also failed a voice simulation (Behavior), and ranks that person first.
Also called
3How analysts, standards and vendors name the same idea.
- attacked, vulnerable, privilegedProofpointHuman Risk Factors: how attacked (probability), how vulnerable (likelihood), how privileged (impact).
- HRM inputsForresterIdentity data, security behaviors and events, digital footprint and exposure, security awareness.
- Threat, Behavior, IdentityLiving SecurityThe three Human Risk Index components; Identity covers what the taxonomy calls Access.
Sources
3Related terms
6"Threat × Access × Behavior model" (HRM-CORE-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/terms/threat-access-behavior-model
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.