Science Risk Assessment Methods

People are dying while we wait for the next crisis. We already have the technology to see it coming. Behavioral health still runs on a "break-fix" model. Wait for crisis. React to crisis. Repeat. We're playing defense. And we're losing. It's time to play offense. Risk stratification is how we shift from reactive care to proactive care. From crisis response to crisis prevention. From hoping we catch people in time to knowing who needs help before they fall. Within 5 years, this must become standard of care. Here's what this can look like using 3 risk tiers: 1/ High Risk = Imminent danger. Suicide attempt, overdose, or psychiatric hospitalization likely within days to weeks. Requires intensive intervention now. 2/ Rising Risk = Trajectory toward crisis. Invisible to traditional screening but flagged by predictive models. This is where we intercept. Before decompensation. 3/ Low Risk = Stable, but not static. Monitoring ensures early detection if status changes. Risk of what, exactly? We need to define the outcomes we're predicting: → Suicide attempt → Overdose → ER utilization → Psychiatric hospitalization Over what timeline? → Imminent (days to weeks) → Short-term (1-3 months) → Medium-term (6-12 months) → Long-term (1+ years) The technology exists. Predictive analytics. Machine learning. NLP scanning clinical notes for early warning signs. Within five years, failure to risk-stratify a behavioral health population should carry the same weight as failing to triage an ER. We have the data. We have the tools. The only missing piece is the will to play offense. What's stopping us?

The Wolfsberg Group’s latest statement marks a shift away from traditional, rules-based transaction monitoring towards a risk-driven, innovation-focused framework for detecting suspicious activity. FIs have long relied on legacy transaction monitoring systems with static rules, generating large volumes of low-quality alerts and leading to inefficiencies in both detection and investigation. 3 pillars underpin this transition: 1. Effective transition and validation – Recalibrating monitoring systems around risk-based outcomes, ensuring alignment with revised performance indicators such as precision rate, recall rate, and SAR quality metrics. 2. Balancing model risk with financial crime risk – Avoiding the traditional “one-size-fits-all” governance approach by differentiating prudential risk from financial crime detection imperatives. 3. Explainability and transparency – Ensuring senior management, investigators, and regulators can understand, challenge, and rely upon AI-driven monitoring outcomes. Legacy monitoring models traditionally relied on broad “drag-net” scenarios, prioritizing defensive SAR filings over risk-based intelligence. Wolfsberg urges FIs to move towards: • Precision and recall rates to measure detection quality rather than alert quantity. • Expanded risk indicator coverage integrating behavioral, transactional, and non-financial data points for holistic risk assessment. • Law enforcement feedback loops to align FI monitoring outputs with national security and financial crime prevention. One of the most significant barriers to innovation identified by the #Wolfsberg is the overly rigid model risk #governance frameworks applied equally across prudential, credit, and financial crime models. Traditional Model Risk Management practices, designed for capital adequacy or credit risk, impose long, resource-intensive validation cycles unsuited to the dynamic nature of financial crime risks. Wolfsberg advocates for: • Proportional oversight based on risk materiality, system reliance, and FCC typology coverage. • Streamlined independent validation across 2/3rd line functions to reduce duplication between audit, assurance, and MRM reviews. • Agile model deployment frameworks enabling FIs to introduce new typologies rapidly in response to emerging threats while maintaining control integrity and ensuring that #AI-driven models remain transparent to regulators, investigators, and senior management. 3 dimensions of explainability emerge: 1. #Risk coverage mapping – Demonstrating how typologies, indicators, and data features link to detected risks. 2. Model design and calibration transparency – Explaining how supervised, unsupervised, and rules-based methods interact in hybrid monitoring models. 3. Investigator usability – Equipping analysts with model-driven risk narratives, visualization tools, and feature-importance explanations to support case investigations. #financialcrime #compliance #regulatory

🔍 Safety Spotlight | Behavior-Based Safety (BBS): Turning Actions Into a Culture of Protection In high-risk sectors like oil & gas, construction, and heavy industry, it’s often not the absence of systems but unsafe behaviors that lead to incidents. That’s where Behavior-Based Safety (BBS) becomes a game-changer. BBS isn’t just another checklist — it’s a people-driven, process-supported system that empowers workers to observe, correct, and promote safe behavior on-site. ✅ What Is Behavior-Based Safety (BBS)? BBS is a proactive approach focused on: 1. Identifying at-risk behaviors before they lead to accidents. 2. Reinforcing safe actions through peer observations and feedback. 3. Building a culture of accountability and awareness — not fear or punishment. 🧠 Why It Matters: 1. Studies show that 80–90% of workplace incidents involve human behavior. 2. Traditional safety systems often overlook how decisions are made under pressure. 3. BBS fills that gap by targeting the root causes: habits, perception, and communication. 🛠️ Core Elements of a Strong BBS Program: 1. Observation Without Blame: Trained workers observe daily tasks to spot safe/unsafe behaviors and share feedback — respectfully and constructively. 2. Real-Time Coaching: Immediate correction or reinforcement helps workers build muscle memory for safe actions. 3. Behavior Checklists: Customized observation checklists help track high-risk job behaviors specific to the site or task. 4. Data Collection & Trends: All observations are logged and analyzed to identify frequent unsafe actions or environments — guiding future training or design changes. 5. Positive Reinforcement: Instead of penalizing mistakes, BBS celebrates safe actions — making safety personally rewarding. 6. Employee Ownership: BBS succeeds when employees feel responsible for each other — not just themselves. It turns "Safety is your job" into “Safety is our job.” 🚧 Example in Action: Imagine a welder preparing to enter a confined space. A peer observer notices he skipped atmospheric monitoring. Instead of issuing a reprimand, the observer steps in, discusses the risk, and they both fix the issue. Not only is the hazard averted — but a learning moment is created. That’s BBS at work. 🔄 Leadership’s Role in BBS: - Empower teams to observe without fear. - Walk the talk: supervisors must model the behaviors they expect. - Use data not to punish, but to improve systems and training. 💡 Final Thought: "Safety isn’t a rulebook — it’s a mindset. BBS turns that mindset into habit, and habit into a culture." Have you implemented BBS in your workplace? What strategies helped build trust and participation on your teams? 👇 Share your stories — your insight could help someone create a safer workplace today. #BehaviorBasedSafety #SafetyCulture #BBS #HumanFactors #WorkplaceSafety #HSELeadership #ZeroInjuries #OilAndGasSafety #ConstructionHSE #IndustrialSafety #PeerToPeerSafety #ProactiveSafety

#RiskManagement "To move from simplistic risk scores to consequence-led narratives, Boards must shift their focus from numerical ratings to a detailed understanding of how failure manifests and propagates through interconnected systems. Analysis tells us that this transition involves several specific strategic actions: > Articulate Consequence Pathways and Scenarios: Rather than relying on a single colour-coded square, every risk report should describe escalation scenarios and failure pathways. This means explaining the second- and third-order effects of a disruption—for example, how a telecommunications failure might cascade into transport-signalling issues, financial transaction interruptions, and emergency-response degradation. > Implement Systemic Dependency Mapping: Boards should require visual maps of upstream and downstream dependencies across infrastructure, suppliers, digital systems, and regulatory interfaces. Understanding these links is essential for moving beyond a "single-point" view of hazards to a systemic view of consequences. > Include Explicit Uncertainty Statements: To counter the "veneer of certainty" provided by risk scores, reports must articulate the strength of knowledge underpinning the assessment. This includes being transparent about knowledge gaps, assumptions, evidence quality, and model limitations. Weak knowledge should never be hidden behind a definitive risk score. > Adopt Operational Language over Matrix Language: Leadership should move away from abstract terms like "likelihood" and "residual score" and instead speak in terms of operational reality. This involves asking questions about control fragility, escalation speed, resilience capacity, and the tolerability of consequences. > Link Risk to Resilience Capability: Risk discussions should not occur in isolation; they should be integrated with assessments of the organisation's preparedness, response capability, and recovery capacity. A narrative might explain that while a specific risk is high, the organisation's strong resilience pathways make it strategically acceptable. > Focus on Decision Quality: The narrative's ultimate goal is to support decision-making under uncertainty. Instead of asking "What is the risk rating?", Boards should ask: "What leadership decision does this analysis support?"." Tony Ridley, MSc CSyP FSyI SRMCP Risk, Security, Safety, Resilience & Management Sciences Risk Management Security Management Crisis Management #risk #risks #enterpriserisk #enterprisesecurityriskmanagement #intelligence #threatlintelligence #riskmanagement #riskanalysis #riskassessment #riskmanagementframework #operationalriskmanagement #projectriskmanagement #projectrisk #operationalresilience #resilience #operationalrisk #riskintelligence #governance #crisis #crisismanagement #complexity #chaos #crisisleadership #crisisplan #crisismanagementplan #stress #governance #decisionmaking #riskmanagement #riskinformed #securitymanagement

Most organisations talk about AI risk as if it were a property of the model itself. In practice, risk emerges from what the system is allowed to do, what it can touch, and how badly things go wrong when it fails. That distinction sits at the heart of the Cloud Security Alliance’s Capabilities-Based Risk Assessment (CBRA) for AI Systems. The paper argues that conventional, one-size-fits-all AI risk frameworks are no longer sufficient. As generative and agentic systems move from advisory roles into decision-making and execution, risk must be assessed by consequences, not intentions. What CBRA changes • Risk is assessed by capabilities rather than labels or use cases • AI systems are evaluated through four multiplicative dimensions: system criticality, autonomy, access permissions, and impact radius • The result is a composite risk score that reflects both technical power and real-world consequence • Risk is not static and must be re-scored at onboarding, renewal, and after material system changes The four questions that matter • How critical is this AI system to revenue, safety, security, or regulatory obligations • How autonomously can it perceive, decide, and act without human approval • What data, systems, identities, or policies can it read, write, or change • How far damage could spread in a single adverse scenario Why this matters Agentic AI collapses distance between decision and execution. A system that can chain tools, modify policies, or operate across environments does not need malicious intent to cause harm. Small design choices around permissions or autonomy can radically change the risk profile. CBRA makes one point repeatedly: reducing risk does not always mean slowing innovation. Narrowing access, enforcing guardrails, and limiting blast radius can materially compress risk even as AI systems scale. From theory to governance CBRA aligns risk levels with proportional controls through the CSA AI Controls Matrix. Low-risk systems receive baseline safeguards. Medium-risk systems require enhanced monitoring, validation, and governance. High-risk systems demand comprehensive controls, independent assessment, and continuous oversight. High-consequence AI is treated like critical infrastructure. Low-consequence AI is allowed to move faster without becoming a free-for-all. The takeaway The most dangerous AI systems are not always the most sophisticated ones. They are the ones given autonomy, access, and reach without a clear understanding of what happens when they fail. CBRA offers a way to ask the uncomfortable question early: not what the AI is meant to do, but what it could do if things go wrong.

That is an insightful post; thank you for elevating this conversation. From a Cyberpsychology and Forensic Cyberpsychology standpoint, human-centered risk is fundamentally a behavioral challenge before it is a technical one. Controls and security awareness training remain vital "hygiene," but they address only the how of an attack. To outpace the threat, it's crucial to delve into the why, including cognitive biases, emotional triggers, and social dynamics that drive individuals to become inadvertent or deliberate threat actors. In practice, this means enhancing traditional SOC telemetry with what my field refers to as behavioral threat intelligence (BTI). By integrating digital forensics artifacts (logins, file movements, anomaly scores) with empirically validated behavioral markers, we can surface intent before it manifests as harm. Models such as the Adversary Behavior Analysis Model (ABAM) and the Cyber Forensics Behavioral Analysis" (CFBA) framework operationalize this fusion, enabling security teams to: - Profile motivation (grievance, ideology, profit, curiosity) rather than relying solely on role‑based access assumptions. - Detect cognitive fatigue or moral disengagement in employees, early indicators of risky click paths, and policy violations. - Map social engineering pressure points by analyzing how attackers exploit trust dynamics inside supply‑chain and hiring workflows. It's essential to tailor interventions (such as coaching, peer support, or investigative escalation) proportionate to both the technical severity and psychological drivers. This personalized approach is key to effectively managing cybersecurity risks. When we treat human risk as a continuum of behavioral signals rather than a binary of compliant versus malicious, we create response playbooks that are preventative, proportionate, and humane. The outcome is a workforce that is not merely "aware" but actively engaged in its cyber resilience. That culture, more than any single control, is what closes today's widening gap between threat velocity and organizational readiness. #Cyberpsychology #ForensicCyberpsychology #BehavioralThreatIntelligence #HumanCentricSecurity #CognitiveSecurity #InsiderThreats #HumanRisk #CyberBehavioralScience #SecurityAwareness #IntentBasedDefense #CyberResilience #SecurityCulture #ThreatModeling #DigitalForensics #CybersecurityLeadership #NeurodiversityInSecurity #CyberDeception #AdaptiveDefense #DarkTriadAnalysis #BehavioralAnalytics Landon W. Prof. Mary Aiken

We are measuring activity. We need to be measuring risk. I’ve recently analyzed insights from ~2,500 conversations with security leaders who are building and operationalizing Human Risk Management (HRM) programs. The data reveals a painful reality: Most teams are stuck in a "compliance trap." They are running lean teams, drowning in manual workflows, and relying on "fragile reporting"—metrics like click rates and training completion that crumble under executive scrutiny. The most successful program owners are making a critical pivot. They are stopping the attempt to "boil the ocean" by training 100% of employees on everything. Instead, they are operationalizing a High-Risk Employee Model. They are moving beyond generic phishing simulations to look at the intersection of three specific variables: 1. Susceptibility (Likelihood): Who is actually exhibiting risky behavior? (Not just in phishing, but in Data Loss, AI usage, and Web browsing). 2. Targeting (Context): Who is being attacked? 3. Elevated Access (Impact): If this specific person clicks or pastes code into a public LLM, does it take down the business? The result? Instead of reporting "We have a 4% click rate," they can tell leadership: "We identified 50 high-access users who were susceptible to specific threats. After targeted intervention, risk in this critical group dropped by 40%." That is the difference between "activity" and "business impact." If you are struggling to defend your budget or gain traction with the Board, stop reporting on the 90% who are doing fine. Focus on the 10% who represent your true risk exposure. How are you shifting your metrics from "Compliance" to "Risk"? #HumanRiskManagement #CISO #SecurityAwareness #RiskManagement #Leadership

We’ve been spending more time exploring how security awareness training is evolving in the age of AI and I wanted to write up some of my thoughts so far (link the comments). The timing feels right. There’s clearly a refresh cycle underway as legacy SAT contracts are getting reevaluated, and a new generation of vendors is starting to raise meaningful capital. What’s driving the shift? Unsurprisingly, AI has changed the threat model. Attacks today are more personalized, more real-time, and far harder to protect against while humans still remain the ultimate threat vector. In Hong Kong, a finance clerk joined what looked like a normal video call with their CFO. It wasn’t. The backdrop, the voice, the mannerisms, AI-generated. $25M lost across 15 wire transfers. Months later, someone used an AI-cloned voice of Senator Marco Rubio to impersonate him in a Signal call to U.S. officials. These aren’t hypothetical risks anymore. They’re live, evolving threat vectors. Meanwhile, many legacy approaches to SAT - quarterly videos, static phishing templates-are struggling to keep pace. That’s opening the door to something new: platforms focused on behavioral risk over one-size-fits-all awareness. We’re seeing a few consistent patterns among emerging vendors: 👉 Risk scoring at the individual level, combining identity, behavior, and context 👉 Just-in-time nudges tied to specific risky actions (e.g., clicking on a suspicious link) 👉 Integration with IAM and IT systems to enable dynamic access decisions 👉 Auto-generated simulations based on live threat intelligence 👉 Personalized learning paths based on user performance and behavior over time The common thread is a shift from content to telemetry, measuring and influencing human behavior the way we do with infrastructure or endpoints. It’s still early, and there’s a lot to unpack. But the broader story is one we’ve seen before: when the environment changes, so must the tools. In a world where generative AI makes deception cheap and fast, understanding how human risk gets modeled, managed, and mitigated will likely be an important part of the modern security stack.