The program joins what reaches a person, what they could expose and what they do, on one record per person. Cohorts that combine the three dimensions are counted and trended, breach scenarios are ranked by the organization’s own incidents, and campaigns target the riskiest cohorts.
How to use this plan
Six practices. For each one, the actions that move you to level 4, Steering, then the quick wins to start this quarter: Easy playbooks. Each playbook names an owner, a week window inside the 90 days, and the number that proves it worked. Print it, assign the owners, and run the assessment again in 90 days.
- 6practices
- 6quick wins (Easy playbooks)
- 13weeks
01 · See
Which signals can you see, for whom, and how fresh are they?
At level 3: Threat, access and behavior joined per person across four or more domains.
What moves you to level 4
- Connect endpoint, web and SaaS, and data sources to reach five or more domains.
- Move the top sources from monthly extracts to daily feeds.
- Add breach-exposure data so leaked credentials are known per person.
- Measure AI tool use per person, including personal-account logins.
Quick wins this quarter · Easy playbooks
- Set a dwell window and a staleness flag per signalEasy · weeks 1–3
Give each signal a window (threat 90 days, simulated behavior 180 days, real interaction 30 days) and flag any source silent for seven days. Stale signals put people at the wrong stage.
MetricShare of signals with a window and a freshness flag · owner: Security awareness lead
02 · Understand
How do you decide who needs attention, and what tells you the decision was right?
At level 3: Cohorts across threat, access and behavior; breach scenarios ranked by own incidents; a stage per person.
What moves you to level 4
- Define sequences (ordered signals inside a window) for the top three breach scenarios.
- Measure incident lift: the incident rate inside a cohort against the rest of the workforce.
- Add AI use and AI agent cohorts next to people cohorts.
Quick wins this quarter · Easy playbooks
- Compute a stage per person from active signalsEasy · weeks 1–3
Place each person on the road from Clear to Confirmed by the furthest active signal. One number per person makes the cohort review fast.
MetricStage 3+ people per priority breach scenario · owner: Security awareness lead
03 · Act
What changes when risk is found, how fast, and who or what makes the change?
At level 3: Campaigns target the riskiest cohorts; written playbooks with owners and time limits.
What moves you to level 4
- Automate the two highest-volume playbooks end to end.
- Add a playbook that interrupts a sequence with step-up MFA at a named step.
- Add a playbook for sensitive data in AI prompts.
Quick wins this quarter · Easy playbooks
- Measure time from signal to action per playbookEasy · weeks 1–3
Timestamp each trigger and each completed action, and publish the median per playbook. The median is the number that proves playbooks run.
MetricMedian time from signal to action · owner: Security awareness lead
04 · Prove
Can you show, with your own numbers, that risk went down?
At level 3: Stage 3+ per breach scenario and cohort sizes against targets, mapped to the control framework.
What moves you to level 4
- Measure incident lift and count avoided incidents.
- Compute training hours saved by targeting.
- Add security NPS and perceived friction to the report.
- Build a one-page executive summary.
Quick wins this quarter · Easy playbooks
- Compute training hours saved by targetingEasy · weeks 1–3
Compare hours delivered under the targeted schedule with the old whole-workforce schedule. Saved hours is a number the CFO reads.
MetricTraining hours saved per quarter · owner: Security awareness lead · connector: SAT
05 · Govern
Who owns human risk, and what decision rights, budget and policy do they hold?
At level 3: CISO staff own it; monthly review with SOC, IT and HR; targets; agents have owners.
What moves you to level 4
- Give the review written decision rights over the controls playbooks change.
- Add Finance and Legal to the forum.
- Draft the human risk appetite statement.
Quick wins this quarter · Easy playbooks
- Require a named human owner for every AI agentEasy · weeks 1–4
Add owner, scope and retirement date as required fields for any agent or service identity. Ownership is the base of agent governance.
MetricAgents with no owner · owner: Identity team
06 · Culture
Do people report, ask for help, and tell you the truth about friction?
At level 3: Quarterly pulse; champions in each unit; report rate above click rate; help requests counted.
What moves you to level 4
- Join pulse results to behavior results per team.
- Measure the gap between self-rated ability and simulation results.
- Co-create the next policy with employee feedback.
- Publish role-based AI guidance for developers, finance and customer-facing teams.
Quick wins this quarter · Easy playbooks
- Measure the confidence-ability gapEasy · weeks 1–3
Compare self-rated ability from the pulse with simulation results per team. Overconfident teams are the coaching target.
MetricConfidence-ability gap in points · owner: Security awareness lead · connector: SURVEY
Why one field
The plan is already on this page.
The PDF is the same plan laid out for paper, so you can hand it to the owners. We ask for a work email and nothing else; no sales call unless you book one.
Not your level? Take the assessment: four minutes, and the result links the right playbook.
