Human Risk
Are people making safer decisions, and is the culture and training supporting it? One measured position composed of three strands: observed behaviour, reported culture, and completed learning. Act on the specific behaviour and re-measure the behaviour, not the completion record.
Where the boundary sits.
Human Risk is one domain with three strands. Observed behaviour is what people actually did in the systems. Reported culture is what they say and whether they keep reporting once a campaign ends. Completed learning is the training record, held against the behaviour it was supposed to change. Security Culture and Training & Awareness are dimensions of this position rather than separate domains.
The signals read, and the work prescribed against them.
The summary of each is on the surface. Open one for the specific dimensions behind it.
SignalsWhat IO reads for this domain6 signal and evidence families, correlated deterministically rather than inferred.
- Phishing simulation and real-report telemetry
- Identity and access anomalies
- Reporting volume, quality and rate over time
- Survey and pulse instruments
- LMS assignment, completion and score data
- Helpdesk and incident records naming a human cause
PlaybooksWhat IO prescribes4 representative playbooks, each gated on prerequisites and maturity.
- Reset credentials and revoke active sessions where exposure is live
- Run targeted coaching for the repeat phishing-failure cohort
- Restore reporting confidence in the departments that stopped speaking up
- Replace the training that did not change behaviour
SeatsWho lands here first3 seats read this domain before anyone else does.
- Security awareness
- CPO
- CISO
What has to move for this to have worked.
Cohort click rate on unseen lures
Sustained report rate 60 days after campaign close
Behaviour delta against an untrained control cohort
Sessions that feed this domain.
We deliver these as part of IO Enablement Services.
Beyond the Uniform
Twenty years from military service to enterprise security leadership, and what transfers: judgement under pressure, and the discipline of measuring whether the plan worked.
Bin Laden
How a decade-long hunt was actually run, patience, correlation across fragmented signal, and the cost of acting on the wrong interpretation.
Security & People
Why people are treated as the weakest link, why that framing fails, and what changes when you measure behaviour instead of attendance.
Detections that arrive from tooling rather than a colleague's message, and where the identity pressure is actually landing.
Which AI tools are really in use, what data reaches them, and whether the written guardrails are the ones in force.
Each policy statement tied to evidence that it holds in practice, not to the date it was last approved.
See it before you talk to anyone.
Two quarters of recorded activity across sixteen seats. One click, no install.