I’ve been sitting with a pattern that keeps showing up in incident reviews and near-misses. A lot of security breakdowns aren’t purely technical. They happen when otherwise capable people are operating in very human states — rushing to ship, tired at the end of the day, clearing alerts on autopilot, or making changes under pressure. We all recognize this intuitively. But we rarely model it. The Human-State Exploitability Model (HSEM) is my attempt to make this layer more explicit and measurable. The current direction is: • Build a taxonomy of cognitive/behavioral states that meaningfully affect security outcomes • Map observable signals in technical environments to those states • Estimate the exploitability uplift associated with each condition • Produce a Human-State Exploitability Score (HSES) that can feed into quantitative risk models This is still early thinking, and I expect many blind spots. Sharing this here to pressure-test the idea with people who have seen these failure modes up close — security engineers, SREs, human factors folks, and anyone who has run postmortems where the root cause wasn’t just “the system failed,” but “we were human that day.” Curious where this resonates — and where it breaks.

Human Exploitability System

What if a person in the organization goes rogue?

What if a person in the organization goes rogue?