KnowledgeDiagrams
Working drawings.
Same Taxonomy, Same Meaning?
The same three labels for an alert. On the third, the two functions are doing different work.
Three Non-Interchangeable Approaches to an Insider Program
The same components in all three. What differs is the order they are put in.
Insider Risk / Threat Convergence
Risk, threat, event and motive run on independent clocks. A case is the moment they line up.
Four Artifacts and a Fifth That Make an Insider Program’s Seam
Each one either exists or it does not, which is the test of whether a program has a seam at all.