ABOUT

What people do decides whether controls work. It shapes the vulnerabilities that exist. And it's what every intervention is aiming at.

Yet most organisations have no systematic way to reason about behavioural risk.

Project NEXUS is building that foundation. It maps behaviour to threats, vulnerabilities, controls and risk outcomes, and gives the field a common language for how behaviour shapes security outcomes. Vendor-neutral, openly licensed, and built in the open by a working group of senior practitioners and researchers.

Where we've got to

17 June. The first working group met in London. Practitioners spent the morning reflecting on the behavioural security ontology core to NEXUS, with a particular focus on its behavioural domain.

‍6 July. We published the readout. Every decision, every point still in dispute, out in the open.

‍16 July. The first online session opened the work to everyone else, and people who weren't in the room fed in. Watch it back >
‍
1 October. The second working group met in London to agree shared definitions of asset, threat and vulnerability, and how behaviour connects them.

What’s next

Next up is the open session on 3 November. It's online, it's open to everyone, and it's where you react to what the London working group agreed.

3 November, online
15:00 to 16:00 GMT
One hour

‍In July we opened the first session up to everyone who wasn't in the room. We're doing it again.

‍The London working group has worked through linking behaviour, threats, vulnerabilities and assets. Some definitions have landed. Others are still contested.

Whether or not you were in that room, this is where you react to the group's thinking and add your own, before the ontology evolves further.

We open with a short introduction to the ontology, so everyone starts on the same footing.

Then what the group covered and where the thinking landed.

Save your place

Who's in the working group

CISOs, human risk managers and senior security culture practitioners, testing the framework against real applications and stress testing what's been drawn.

Between sessions

Everyone who signs up gets the readouts. Key decisions, the updated framework, and a way to feed in your own view. You don't have to attend anything to receive them.

Contribution and recognition

This is vendor-neutral research with open-source licensing. All contributors are offered the opportunity to be publicly recognised for their role in developing the ontology.

Behaviour is where every security domain connects

Project NEXUS is an initiative focused on developing a behavioural security ontology that maps how human behaviour connects to threats, vulnerabilities, controls, and risk outcomes.

Where we've got to

Who's in the working group

Between sessions

Contribution and recognition

Express interest