Team Decision Dynamics

5 automated security scanners

Tribal Knowledge Dependence

Purpose: The Tribal Knowledge Dependence Scanner is designed to identify undocumented procedures, key person dependencies, and institutional memory gaps within an organization by analyzing publicly available content such as press releases, security incident pages, and blog posts. This tool helps in understanding the reliance on specific individuals for critical knowledge and processes, ensuring a more robust and decentralized organizational structure.

What It Detects:

Undocumented Procedures: The scanner detects vague or non-specific language indicating undocumented procedures, as well as instances where lack of formal documentation is suggested (e.g., “we have always done it this way”).
Key Person Dependencies: It recognizes frequent mentions of specific individuals in critical roles without reference to documented processes and identifies phrases like “John Doe was responsible for” or “Jane Smith handled”.
Institutional Memory Gaps: The scanner identifies situations where the organization heavily relies on individual knowledge, indicated by language suggesting that only certain individuals possess crucial information (e.g., “only Tom knows how this works”).

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: Identifying undocumented procedures, key person dependencies, and institutional memory gaps is crucial as it helps in reducing organizational risks associated with loss of critical knowledge, improving process standardization, and enhancing resilience against individual departures or changes in personnel.

Risk Levels:

Critical: Conditions where the scanner identifies a significant portion of the organization’s operations relying on a single person’s knowledge without documentation.
High: Situations where key processes are only vaguely described or not documented at all, potentially leading to operational disruptions if those individuals were unavailable.
Medium: Instances where informal descriptions and anecdotal evidence dominate process discussions, suggesting potential gaps in formalized procedures.
Low: Minor instances of vague language that could be clarified through a more detailed review or documentation efforts.
Info: Informative findings regarding the general use of informal language in describing processes without concrete details.

Example Findings:

“We have always done it this way.” - Indicates a lack of formalized procedures documented for routine tasks, which could lead to inconsistencies and errors if not corrected.
“Only Tom knows how this works.” - Suggests a significant institutional memory gap where critical knowledge is held by an individual (Tom), potentially leading to high risk if he were unavailable or leaves the organization.

Metrics-Driven Distortion

Purpose: The Metrics-Driven Distortion Scanner is designed to analyze breach disclosure language and metric-driven decision-making to detect Key Performance Indicator (KPI) optimization over security, which may include metric gaming and dashboard-driven decisions that prioritize short-term metrics at the expense of long-term security.

What It Detects:

Blame Deflection Patterns: The scanner identifies linguistic patterns such as nation-state actor claims without evidence, highly sophisticated or advanced descriptors without technical justification, and zero-day exploit attribution without clear CVE details.
Passive Voice Usage: It detects phrases indicating passive voice construction which may obfuscate the severity of incidents or imply a lack of proactive action by the organization.
Minimization of Impact: The scanner flags statements that minimize the scope or severity of incidents, potentially downplaying the seriousness of breaches or cyber threats faced by the company.

Inputs Required:

domain (string): Primary domain to analyze, which helps in searching for breach disclosure statements on the company’s website.
company_name (string): Company name used for searching specific terms related to incidents and breaching within their official documents or communications.

Business Impact: This scanner is crucial as it aids in identifying potential misalignments between short-term performance metrics and long-term security strategies, which can lead to a neglect of critical security measures. Such misalignments may result in increased vulnerability to cyber threats and could potentially harm the company’s reputation if not managed effectively.

Risk Levels:

Critical: Findings that directly indicate systemic failures or significant negligence in handling cybersecurity risks, such as clear evidence of metric gaming for short-term gains at the expense of security infrastructure.
High: Situations where there is a high likelihood of misalignment between metrics and actual security posture, potentially masking deeper issues like inadequate incident response mechanisms or lack of transparency regarding breaches.
Medium: Where indicators suggest a moderate deviation from optimal security practices, such as passive language used in breach disclosures that could be interpreted as minimizing the impact of incidents.
Low: Informal mentions of breaches without clear evidence of strategic misalignment or excessive focus on short-term metrics, which may not pose immediate high risks but should still be monitored for trends.
Info: Routine findings such as standard passive language in disclosures that do not necessarily indicate significant deviation from expected security practices.

Example Findings:

A disclosure stating “we discovered a data breach” without providing specific details or context could be flagged by the scanner, indicating potential minimization of impact and lack of proactive communication strategies.
An assertion about being “state-sponsored” without supporting evidence might raise concerns about blame deflection and strategic misrepresentation in reporting security incidents.

Group Security Decisions

Purpose: The Group Security Decisions Scanner is designed to analyze breach disclosure language in order to detect and uncover patterns such as blame deflection, passive voice usage, minimization tactics, responsibility diffusion, and focus on technology failures. Its primary objective is to help organizations identify organizational dishonesty and prevent learning from security incidents by identifying patterns of insincerity and systemic issues.

What It Detects:

Blame Deflection Patterns: This includes nation-state actor claims, sophistication claims without technical justification, third-party vendor blame, and employee scapegoating.
Passive Voice Usage: This involves the use of passive construction frequency and agent omission in descriptions.
Minimization Tactics: These include limited impact statements, no evidence claims, and abundance of caution language.
Responsibility Diffusion: This is characterized by vague descriptors and an emphasis on outsourcing or third-party involvement rather than internal controls.
Technology Failure Focus: This includes the prominence of product/vendor names without addressing configuration issues, focus on zero-day exploits, and emphasis on software flaws over other factors like policy gaps or human error.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com, which helps in identifying incident disclosures across the company’s website structure.
company_name (string): The name of the company for searching relevant statements during analysis, aiding in the context and specificity of findings.

Business Impact: This scanner is crucial for organizations aiming to enhance their security posture by proactively addressing potential issues related to insincerity and systemic failures within the organization. It helps in preventing future incidents by identifying patterns that could lead to dishonesty and lack of accountability.

Risk Levels:

Critical: Findings indicating direct threats from nation-state actors or highly sophisticated breaches with no technical justification, leading to immediate regulatory or legal repercussions.
High: Significant risks associated with data breaches affecting a substantial number of users without adequate internal controls or clear evidence of vendor/product failures.
Medium: Issues that may lead to moderate risk such as passive voice usage in breach disclosures, potentially masking actual responsibility and contributing to organizational opacity.
Low: Minor issues like the use of vague terms or minimal impact statements indicating a small scale of incident, which might not pose significant risks but could indicate procedural gaps.
Info: Informal findings that provide supplementary information about typical procedures or lack thereof in handling security incidents without immediate risk implications.

Example Findings:

“A sophisticated nation-state actor was behind the breach.” - This finding highlights a critical issue with high severity, directly linking the incident to a highly capable and malicious party.
“No evidence of unauthorized access was found.” - A medium-severity risk indicating potential minimization tactics that might obfuscate actual consequences or efforts to conceal an incident.

Crisis Response Psychology

Purpose: The Crisis Response Psychology Scanner is designed to analyze breach disclosure language and identify specific linguistic patterns that suggest panic-driven decisions, tunnel vision, and emotionally-driven actions. This tool helps organizations recognize and mitigate risks associated with inadequate or biased communication during security incidents by detecting blame deflection, passive voice usage, minimization tactics, third-party blame patterns, and employee scapegoating.

What It Detects:

Blame Deflection Patterns:
- Phrases like “nation-state actor,” “state-sponsored,” indicating external blame without evidence.
- Terms such as “highly sophisticated,” “unprecedented level,” suggesting advanced capabilities rather than basic vulnerabilities.
- References to “zero-day” exploits without specific CVE details.
Passive Voice Usage:
- Sentences like “systems were accessed,” “data was compromised,” which avoid direct accountability.
- Descriptions that omit the actor responsible for the breach, such as “the data has been determined to be compromised.”
Minimization Tactics:
- Phrases like “limited number of affected users,” “no evidence of significant impact,” downplaying the severity.
- Expressions such as “out of an abundance of caution,” indicating overreaction or lack of clear information.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations understand the psychological biases in their crisis response communications, which can lead to inadequate or biased decision-making during security incidents. Correcting these patterns can significantly improve an organization’s ability to manage crises effectively and protect its reputation and operations.

Risk Levels:

Critical: Findings that directly point to systemic issues without any mitigating factors are considered critical. These include sophisticated nation-state attacks or breaches with no evidence of impact but high claims of severity.
High: High-severity findings involve significant risk, such as widespread data compromise or direct threats to physical safety.
Medium: Medium-severity findings indicate a moderate level of risk that could affect operations or reputation.
Low: Low-severity findings are typically informational and do not pose immediate risks but can be indicators for continuous improvement in communication strategies.
Info: Informational findings provide context on the status quo without significant impact, useful for strategic planning.

Example Findings:

“The breach was framed as a state-sponsored attack despite lacking concrete evidence.”
“Statements minimize the impact by emphasizing only limited user data affected and no financial loss reported.”

This structured output aids organizations in identifying areas where their crisis response communications may be biased or inadequate, enabling targeted improvements to enhance overall crisis management effectiveness.

Status Quo Security Bias

Purpose: The Status Quo Security Bias Scanner is designed to identify resistance to new security controls, entrenchment of legacy systems, and avoidance of change within an organization by analyzing the language used in breach disclosures, press releases, and other public communications.

What It Detects:

Blame Deflection Patterns: The scanner identifies patterns such as nation-state actor claims, state-sponsored attacks, highly sophisticated attackers, unprecedented breaches, and zero-day exploits.
Passive Voice Usage: It detects the use of passive voice in statements about system access, data compromise, information acquisition, and determinations made.
Minimization of Impact: The scanner looks for indications of limited affected parties, lack of broader issue evidence, abundance of caution statements, and potentially affected users.
Third-Party Blame Patterns: It detects vendor/partner responsibility shifting, supply chain attack framing, managed service provider blame, contractor/consultant scapegoating, and outsourcing as a primary explanation.
Employee Scapegoating: The scanner identifies rogue employee or insider framing, individual termination announcements, systemic control failure acknowledgment, HR action emphasis over security gaps, and isolated incident framing.

Inputs Required:

domain (string): Primary domain to analyze, which helps in searching the company site for incident disclosures.
company_name (string): Company name is used for statement searching to contextualize the analysis within the organization’s communication history.

Business Impact: This scanner is crucial as it helps in understanding the organizational stance on security incidents and breaches, which can influence strategic decisions regarding technology investments, risk management, and compliance efforts.

Risk Levels:

Critical: Conditions that could lead to immediate regulatory non-compliance or significant financial damage are considered critical.
High: Situations where unauthorized access to sensitive data or system compromises pose a high risk of harm are identified as high severity.
Medium: Issues requiring attention but not immediately threatening major consequences fall under medium risk.
Low: Informal findings that do not significantly impact security posture, compliance, or operational integrity are considered low risk.
Info: General informational findings that provide context but do not directly affect the core business operations.

Example Findings:

“The company has been observed to frame breaches as isolated incidents rather than acknowledging systemic vulnerabilities.”
“Statements consistently minimize the impact of data compromises, suggesting a culture of caution over transparency.”

This structured output provides clear insights into potential security biases and helps in crafting targeted mitigation strategies.