The program steers controls from risk. Signal sequences across five or more risk domains are watched daily, incident lift shows which patterns matter here, and automated playbooks change MFA, access and data controls for defined cohorts. The program reports avoided loss and the lift of its own actions.
How to use this plan
Six practices. For each one, the actions that move you to level 5, Anticipating, then the quick wins to start this quarter: Easy playbooks. Each playbook names an owner, a week window inside the 90 days, and the number that proves it worked. Print it, assign the owners, and run the assessment again in 90 days.
- 6practices
- 6quick wins (Easy playbooks)
- 13weeks
01 · See
Which signals can you see, for whom, and how fresh are they?
At level 4: Daily signals from five or more domains, sequences detected, AI use and AI agents in view.
What moves you to level 5
- Put people, AI agents and vendor accounts on one subject record with the same fields.
- Tie vendor breaches to the people whose accounts are exposed.
- Report signal freshness as a key risk indicator with a target.
- Publish the list of signals no source measures, with a target date for each.
Quick wins this quarter · Easy playbooks
- Measure AI tool use and personal-account loginsEasy · weeks 1–4
Use web and SaaS logs to count AI tool use per person, split by corporate and personal accounts. Shadow AI share is the first AI use signal and it needs no new tool.
MetricShadow AI share by team · owner: Security awareness lead · connector: SSE
02 · Understand
How do you decide who needs attention, and what tells you the decision was right?
At level 4: Incident lift validates patterns; sequences detected and routed; AI cohorts ranked with people.
What moves you to level 5
- Forecast next quarter’s stage 3+ population per priority breach scenario and record the forecast error.
- Agree a loss estimate per priority breach scenario with finance.
- Score AI agents on the same stages as people.
Quick wins this quarter · Easy playbooks
- Retire cohorts with no liftEasy · weeks 2–4
Drop cohorts and sequences with no measured lift after two quarters and record why. Fewer, proven patterns keep the SOC’s attention.
MetricCohorts retired or re-scoped each quarter · owner: CISO
03 · Act
What changes when risk is found, how fast, and who or what makes the change?
At level 4: Playbooks change controls automatically inside a target time; AI agents paused by playbook.
What moves you to level 5
- Let stage drive standing access: remove privilege at stage 3+ inside a set window and restore it when the stage drops.
- Interrupt the sequences for every priority breach scenario before their final step.
- Set a human review threshold for high-impact automated actions.
Quick wins this quarter · Easy playbooks
- Write a reversal rule for every automated actionEasy · weeks 1–3
State who can reverse each automated action, how, and inside what time. Reversal is what makes automation acceptable to IT and HR.
MetricAutomated actions with a documented reversal · owner: CISO
04 · Prove
Can you show, with your own numbers, that risk went down?
At level 4: Incident lift, avoided loss and training hours saved each quarter.
What moves you to level 5
- Define board key risk indicators with a threshold tied to risk appetite.
- Report human risk reduction over 6, 12 and 24 months.
- Have internal audit review the measurement method.
Quick wins this quarter · Easy playbooks
- Draft five board KRIs with thresholdsEasy · weeks 2–4
Pick five numbers (stage 3+ share, time to action, report rate, phishing-resistant MFA, agents with owners) and propose a threshold for each. The draft starts the risk appetite conversation.
MetricKRIs with approved thresholds · owner: CISO
05 · Govern
Who owns human risk, and what decision rights, budget and policy do they hold?
At level 4: An executive forum with decision rights; a risk appetite statement; privacy review on file.
What moves you to level 5
- Name a board member or committee as owner of the human risk KRIs.
- Put security outcomes in executive performance reviews.
- Commission an annual independent review of the model and its automation.
Quick wins this quarter · Easy playbooks
- File a privacy review for each automated actionEasy · weeks 1–4
Record the lawful basis, the data used and the works-council or employee notice for each automated action. The file keeps automation running when HR or legal asks.
MetricAutomated actions with a privacy review on file · owner: HR business partner
06 · Culture
Do people report, ask for help, and tell you the truth about friction?
At level 4: Sentiment joined to behavior per team; policies co-created; AI guidance by role.
What moves you to level 5
- Add security NPS, friction and time to report as board KRIs with thresholds.
- Report executives their own security behaviors each quarter.
- Measure AI agent owners on agent hygiene like any other behavior.
Quick wins this quarter · Easy playbooks
- Publish role-based AI guidance for three teamsEasy · weeks 1–4
Write one page each for developers, finance and customer-facing teams on which AI use is sanctioned and how to check an output. Role guidance gets read; a generic policy gets filed.
MetricShare who check AI output before use · owner: Security awareness lead · connector: SAT
Why one field
The plan is already on this page.
The PDF is the same plan laid out for paper, so you can hand it to the owners. We ask for a work email and nothing else; no sales call unless you book one.
Not your level? Take the assessment: four minutes, and the result links the right playbook.
