Over 50 key behaviours measured out of the box.

SebDB

To begin it's best to brush up on which security behaviours are most important to your organisation. Head over to SebDB, the world’s cyber security behaviour database.

Security behaviours

Below is a list of all of our security behaviours you can track with each integration.

Security behaviour	Data source
`SB087` Reports a suspicious message	Cofense Triage
`SB024` Keeps software up-to-date	Crowdstrike
`SB213` Uses a device that has not been compromised	Crowdstrike
`SB005` Authenticates with SSO	Google Workspace
`SB018` Uses only an approved or official browser extension	Google Workspace
`SB087` Reports a suspicious message	Google Workspace
`SB213` Uses a device that has not been compromised	Google Workspace
`SB171` Uses a work email address that has not been compromised	Have i been pwned?
`SB013` Reports a security incident	Incident.io Coming Soon
`SB024` Keeps software up-to-date	Kandji Coming Soon
`SB159` Clicks only a legitimate link	KnowBe4 PhishER Coming Soon
`SB164` Opens an attachment only in a legitimate message	KnowBe4 PhishER Coming Soon
`SB024` Keeps software up-to-date	Lookout Coming Soon
`SB036` Secures a device when not in use	Lookout Coming Soon
`SB154` Visits only an approved or official website	Lookout Coming Soon
`SB159` Clicks only a legitimate link	Lookout Coming Soon
`SB189` Uses an approved application on a work device	Lookout Coming Soon
`SB203` Authenticates with biometrics	Lookout Coming Soon
`SB213` Uses a device that has not been compromised	Lookout Coming Soon
`SB001` Authenticated with MFA	Microsoft 365
`SB005` Authenticates with SSO	Microsoft 365
`SB087` Reports a suspicious message	Microsoft 365
`SB189` Uses an approved application on a work device	Microsoft 365
`SB019` Downloads content only from an approved or official website	Microsoft Defender*
`SB022` Uses antivirus on a device	Microsoft Defender*
`SB032` Inserts only an approved removable media into a device	Microsoft Defender*
`SB083` Checks a message for malicious content before sharing	Microsoft Defender*
`SB154` Visits only an approved or official website	Microsoft Defender*
`SB159` Clicks only a legitimate link	Microsoft Defender*
`SB213` Uses a device that has not been compromised	Microsoft Defender*
`SB024` Keeps software up-to-date	Microsoft Intune
`SB044` Enables full-disk or device encryption	Microsoft Intune
`SB094` Works only on an approved device	Microsoft Intune
`SB150` Uses a password (or passphrase) that has not been compromised	Microsoft Entra ID Protection
`SB010` Keeps a password (or passphrase) private	Microsoft Purview DLP
`SB091` Shares sensitive information only with an approved recipient	Microsoft Purview DLP
`SB185` shares sensitive information only in an approved communication channel	Microsoft Purview DLP
`SB159` Does not click a phishing link	Mimecast
`SB083` Checks a message for malicious content before sharing	Proofpoint
`SB159` Does not click a phishing link	Proofpoint
`SB015` Completes security awareness training	SAP Success Factors
`SB010` Keeps a password (or passphrase) private	Slack
`SB083` Checks a message for malicious content before sharing	Slack
`SB185` shares sensitive information only in an approved communication channel	Slack
`SB001` Authenticated with MFA	Splunk Coming Soon
`SB003` Authenticates with a strong password (or passphrase)	Splunk Coming Soon
`SB009` Deactivates or deletes unneeded account	Splunk Coming Soon
`SB010` Keeps a password (or passphrase) private	Splunk Coming Soon
`SB013` Reports a security incident	Splunk Coming Soon
`SB014` Asks for security-related help	Splunk Coming Soon
`SB019` Downloads content only from an approved or official website	Splunk Coming Soon
`SB023` Uses a firewall on a device	Splunk Coming Soon
`SB024` Keeps software up-to-date	Splunk Coming Soon
`SB055` Reads and agrees to organisational security policies	Splunk Coming Soon
`SB083` Checks a message for malicious content before sharing	Splunk Coming Soon
`SB087` Reports a suspicious message	Splunk Coming Soon
`SB091` Shares sensitive information only with an approved recipient	Splunk Coming Soon
`SB094` Works only on an approved device	Splunk Coming Soon
`SB150` Uses a password (or passphrase) that has not been compromised	Splunk Coming Soon
`SB152` Authenticates with shared login details only when approved	Splunk Coming Soon
`SB154` Visits only an approved or official website	Splunk Coming Soon
`SB156` Shares sensitive information only on an approved or official website or application	Splunk Coming Soon
`SB159` Clicks only a legitimate link	Splunk Coming Soon
`SB163` Opens only a legitimate message	Splunk Coming Soon
`SB164` Opens an attachment only in a legitimate message	Splunk Coming Soon
`SB173` Uses a work email address only for a work purpose	Splunk Coming Soon
`SB178` Shares a device only with an approved individual	Splunk Coming Soon
`SB185` shares sensitive information only in an approved communication channel	Splunk Coming Soon
`SB203` Authenticates with biometrics	Splunk Coming Soon
`SB154` Visits only an approved or official website	Zscaler NSS Coming Soon