Two lenses on the same human layer.

These are not the same ten threats reshuffled. They are different objects seen from different angles. v0.3 catalogues what the attacker does — the techniques that land, layer by layer. v0.5 catalogues what the human already is — the conditions that make those techniques work at all.

Urgency Hijack is not a rebranded Indulgence. One is a move made against a person; the other is a state the person is already in. Both trees are below in full — read them, then vote for the lens that should lead.

The two trees

Two different questions, each answered with its own ten.

v0.3 asks how does the attack land? and answers with exploitation vectors — each one traceable to a technical control. v0.5 asks why was this person exploitable? and answers with human and cultural conditions — the root causes sitting underneath every vector in v0.3. Different questions produce different lists. The vote is about which question a security audience should be led with.

The same incident, described twice

A finance clerk wires £40k to a fake supplier

v0.3Urgency & Scarcity Hijack. A manufactured deadline pushed the decision out of deliberate reasoning. The attacker's technique — nameable, countable, defensible in a DBIR chart.

… the same clerk, the same wire

v0.5Surrendered Choice & Social Mirror. There was no gap between stimulus and response for judgement to occupy, and their reference point was other people's expectations. The condition that made the technique work.

Neither description is wrong. v0.3 names the move; v0.5 names why the move landed. In practice one sits underneath the other — which is precisely the argument for leading with one or the other, not for merging them.

v0.3 · Layer model

The attacker's move

Question: how does the attack land? The ten exploitation techniques, sorted by the layer of the human system each one reaches. Symptom-side, OWASP-style.

Exploitation vectors

Threats — what the attacker does
- HST-01Authority Compliance deference
- HST-02Urgency & Scarcity conscious window
- HST-03Trust Transference belief system
- HST-04Fear Conditioning fight/flight
- HST-05Reciprocity Loops social contract
- HST-06Cognitive Load capacity
- HST-07Stress Response nervous system
- HST-08Identity & Belonging group identity
- HST-09Normalised Deviance belief drift
- HST-10Vigilance Collapse regulation
Opportunities — the control that blocks it
- HSO-01Verification Reflexes
- HSO-02Nervous-System Regulation
- HSO-03Pause Architecture
- HSO-04Psychological Safety
- HSO-05Belief Audits
- HSO-06Resilience Capacity
- HSO-07Trust Calibration
- HSO-08Decision Hygiene
- HSO-09Meaning & Motivation
- HSO-10Human Sensor Network

+Speaks the buyer's existing language. A CISO recognises every item on sight — no onboarding required.

+Every vector maps to a control that already has an owner and a budget line.

+Maps cleanly onto breach data. You can point at DBIR and show the vector.

−Stops at the symptom. It describes the move, never why the move works — which is the actual claim of the practice.

−Nothing derives the list. Why these ten and not fifteen? No structure answers that.

−Sits adjacent to what awareness training already sells. Harder to argue it's a new category.

Read v0.3 Threats Read v0.3 Opportunities

v0.5 · Pathway model

The human's condition

Question: why was this person exploitable? The ten states and cultural conditions that make the attacker's move work, traced along Covey's two pathways. Cause-side.

Human conditions · Covey

Threats — what the person already is
- Foundation
  - HST-01Surrendered Choice
  - HST-02Outside-In Quick Fix
- Lose Your Voice
  - HST-03Victimism IQ
  - HST-04Indulgence PQ
  - HST-05Social Mirror EQ
  - HST-06Ego SQ
- Keep Others From Their Voice
  - HST-07Low Trust spirit
  - HST-08No Shared Vision mind
  - HST-09Misalignment body
  - HST-10Disempowerment heart
Opportunities — the state that resists it
- Foundation
  - HSO-01Principled Choice
  - HSO-02Inside-Out Hardening
- Find Your Voice
  - HSO-03Vision IQ
  - HSO-04Discipline PQ
  - HSO-05Passion EQ
  - HSO-06Conscience SQ
- Inspire Others
  - HSO-07Modeling spirit
  - HSO-08Pathfinding mind
  - HSO-09Aligning body
  - HSO-10Empowering heart

+Reaches the root cause. This is the layer no existing vendor addresses — the actual differentiated claim.

+The ten are derived, not curated. A model produces them, so the list defends itself.

+Strict 1:1 mirror by construction — every condition has exactly one opposing state.

−Ego, Conscience and Victimism are not words a CISO has in their risk register. Every item needs translating before it can be actioned.

−Leans on a leadership book. Some security buyers will read that as soft, or as consultancy in a new coat.

−Harder to price. A condition has no obvious control owner or budget line.

Read v0.5 Threats Read v0.5 Opportunities

Where the vote stands

Thanks — your vote is recorded.

v0.3 · Layer model0%

v0.5 · Pathway model0%

Beyond the vote

Have a stronger opinion than a button allows?

If you're a CISO or risk leader with a view on which structure would actually survive a board conversation, I'd rather hear it directly than infer it from a tally.