For the programme lead who needs the detail and history behind the numbers to give the business assurance.
Base gives you the Behaviour Index from the quarterly Team Pulse and shows where things stand today. Measure & Evidence adds Programme Capability, the measure of how well the programme is run, and keeps the whole record: every reading from your first quarter onward, tested for whether a movement is real, and turned into reports for the people who fund the programme.
Most Champions programmes report what they did: sessions run, emails sent, Champions recruited. Sponsors nod, then ask the question those numbers can't answer. Is behaviour actually changing?
A rise of three points might be progress, or it might be noise. To tell which, you need the same measure taken the same way every quarter, a record long enough to compare against, and an honest test of whether a movement is bigger than the instrument's own error. That is the gap between activity and evidence.
Measure & Evidence keeps the record, tests it, and turns it into reports you can take into the room.
Illustrative data. The module's screens may present things differently.
See your human risk the way attackers and auditors see it.
Most cyber attacks still run through a person: a click, an approval, a shared password, a file uploaded to the wrong place. Compliance Lens maps the behaviours your programme is building onto the frameworks your security team and auditors already use, so you can show where your people are a strength and where they are still a gap.
Start with MITRE ATT&CK®. Compliance Lens draws the ATT&CK matrix filtered to the attack techniques that depend on human action, such as phishing, MFA fatigue, malicious attachments, credential misuse and data leaking through web services. Each technique shows one of three states:
One view of your human evidence, read against every framework you report to.
| Framework or standard | What the lens reads against | Status |
|---|---|---|
| MITRE ATT&CK® | Attack techniques that depend on human action | Available |
| CIS Controls v8 | Control 14: Security Awareness and Skills Training | Available |
| NIST CSF 2.0 | PR.AT: Awareness and Training | Available |
| NCSC Cyber Assessment Framework | B6: Staff Awareness and Training | Available |
| ISO/IEC 27001:2022 | Annex A 6.3: Information security awareness, education and training | Available |
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Measure & Evidence needs nothing beyond Base, and Network Optimisation builds on it.
Already in Base. The quarterly Team Pulse, the Behaviour Index it produces, its breakdown by division, business unit and team, and intervention retrospectives that compare before and after are all part of the base platform. Every instrument that feeds a measure runs in Base, so nothing you buy changes how a number is calculated. This module adds Programme Capability, the long record, and the tools to test it and present it.
Every quarter of Team Pulse you run on Base is kept, so the history is already there when you add Measure & Evidence. Existing customers can request a trial of the module from Admin > Platform Modules.