From a List to a Language: How SebDB Is Becoming a Behavioral Ontology and Answering the Four Questions Your Boss Is About to Ask You

Four people-related questions are increasingly being asked of security teams, yet most human risk management programs struggle to answer them. Which behaviors, and from which groups, are most likely to result in a breach? What is actually changing as a result of our behavioral interventions? Can we measure positive security behaviors, or only identify where they break down? And when we identify a behavioral risk, how precisely and quickly can we respond? The reason these questions are so difficult to answer is not a lack of tools. It is a lack of a shared language. For years, our field has primarily reported simulation click rates, phishing reports, engagement metrics, and training completion rates because that was all our data could support. This session explores how SebDB, the open-source database of security behaviors, is evolving from a simple list into a comprehensive behavioral ontology that maps the relationships among behaviors, threats, risks, and controls. You'll also see how security professionals around the world are using SebDB to answer the most important human risk management questions and describe their programs using the language of risk. Starting with the fundamentals, Oz will walk through the SebDB database and ontology in its simplest form before demonstrating how the same structure enables organizations to move from measuring activities to producing meaningful evidence, one question at a time. SebDB is open, free, and vendor-neutral. You'll leave with a practical framework for answering the four questions, an understanding of how to apply SebDB in your own program, and a clear perspective on why answering these questions is what makes you indispensable.