Keystone 01 · Architecture
SABSA
Traceability · Layering
Two books gave it its structure. The rest gave it its depth. SABSA supplied the architecture — security as a layered system where every control traces back to intent. Covey supplied the behavioural thesis — that the same human system runs two opposite postures depending on the pathway it takes. Everything below those two adds a floor.
These are not entries on a reading list. They are the load-bearing structure — the reason the model has the shape it has.
Adapted from Stephen R. Covey, The 8th Habit: From Effectiveness to Greatness, Figure 6.10. Recreated in the Psyche-Cybersecurity thermal palette: cool steel = the composed, regulated state; warm ember = the reactive, dysregulated one. This structure is the backbone of the Top 10 Human-Layer Threats and Opportunities — threats grounded in the Fragmented Person pathway, opportunities in the Whole Person pathway. Open the full diagram →
Ordered the way the framework reads — outermost and most technical first, deepest and most human last. The spine warms as you go.
The reference text for systems built to hold under adversarial pressure. It anchors the framework’s first principle: defences fail at the layer no one is watching — and in most organisations, no one is watching the human one.
Mitnick’s case files tell the same story every time: the breach didn’t go through the firewall, it went through a person. The evidence base for why the human layer belongs in the model at all.
Formalises human exploitation as a repeatable discipline with its own methodology and kill chain. It treats the person as an attack surface — which is precisely the surface this framework is built to defend.
The documented levers of compliance — reciprocity, authority, scarcity, and the rest. Attackers don’t invent these; they read Cialdini too. The conscious mind’s known, exploitable vulnerabilities.
The Nobel-laureate account of the fast, automatic system that runs most decisions before the slow one wakes up. The framework’s case that the subconscious — not the analyst — is where most security decisions are actually made.
The original framing of the self-image as a servo-mechanism — a control system that runs on feedback and runs the person. The direct conceptual ancestor of treating the mind itself as a stack worth securing, and the reason this discipline carries the name it does.
The argument that belief — not genetics alone — governs how a system behaves under its environment. It underwrites the belief layer: what a person holds as true determines what they will question, trust, and defend. Covey’s cultural software, at the cellular level.
The neuroscience of regulated, resilient states — and the structural changes that make them durable rather than momentary. The nervous-system layer’s core proposition: a regulated operator is a harder target than a dysregulated one.
The definitive account of how trauma lives in the body and hijacks response long before thought arrives. It grounds the deepest floor: the survival circuitry that overrides conscious control — and that a skilled attacker knows how to trip. Where Covey’s Fragmented Person is manufactured.
SABSA built the stack. Covey explained why it has two states. Everything else is depth.
This reading list is maintained and growing — further titles to be added.