Prototype in active development: structure, examples, and profiles will evolve as the framework matures.
All security functions

Function

Security Education & Behavior Change

This category exists to close the implementation gap between known risks and actual user/team behavior. It includes security curricula, simulation exercises, and campaign design that changes day-to-day decisions. It is distinct from research (new findings), response (active incident handling), and tooling (software infrastructure).