The DICE framework is a behavior-change model built around detect, intervene, change behavior, and evaluate. It helps security teams identify at-risk users, deliver timely guidance, reinforce safer habits through practice, and measure whether the program is producing lasting reductions in human risk.
What the DICE Framework Does
The DICE framework is a behavior-change model for security awareness work: detect who is at risk, intervene with timely guidance, change behavior through practice, and evaluate whether the intervention produces durable improvement.
It is useful when a team needs more than one-off training. DICE treats risky behavior as something you can observe, influence, and measure over time, rather than as a static awareness problem.
Why It Matters in Security Programs
DICE matters because many security failures begin with repeated human behaviors, not a single policy gap. The model helps teams focus on the small set of people and behaviors that are most likely to create exposure, then target support where it can change outcomes.
This makes the framework especially practical for phishing susceptibility, unsafe handling of sensitive information, weak authentication habits, and other recurring behaviors that can be reduced through reinforcement, coaching, and follow-up measurement.
Used well, DICE shifts security awareness from broad messaging to risk-based behavior management. That gives programs a clearer line between intervention effort and measurable reduction in human-driven incidents.
How the Model Is Applied
Detect means identifying the users, teams, or behaviors that show elevated risk, usually through telemetry, simulation results, or observed control failures. Intervene means delivering guidance when the risk is actionable, not after the damage is done.
Change behavior is the practice step, where repetition and reinforcement matter more than generic reminders. Evaluate closes the loop by checking whether the original behavior improved and whether the intervention meaningfully reduced the underlying risk.
The practical value of the model is that each stage can be tuned independently. A team can improve detection without overtraining everyone, or change intervention design without changing the risk signal that triggers it.
Where DICE Fits in a Security Awareness Program
DICE fits best as a program structure for human risk reduction, not as a replacement for policy, technical controls, or incident response. It works alongside awareness content, simulations, and governance processes when the goal is to reduce unsafe user behavior that remains after baseline controls are in place.
It is also a useful way to keep awareness programs honest about outcomes. If a campaign does not change behavior, or the behavior changes but the risk persists, the program needs refinement rather than more messaging.
For teams building a broader awareness strategy, DICE provides a simple operational loop: find the risk, act on it, verify the change, and keep only the interventions that measurably improve security behavior.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-17 — Incident Response Management | DICE supports measuring and improving human behaviors that influence incident response outcomes. |
| Recommendation — Use human-risk findings to tune response playbooks and training where user behavior is a recurring failure point. | ||
| NIST CSF 2.0 | PR.AT-01 — Awareness and Training Policy and Program | DICE is a behavior-change model for security awareness and training programs. |
| GV.RM-01 — Risk Management Roles, Responsibilities, and Authorities | DICE requires assigning ownership for identifying, intervening on, and evaluating human risk. | |
| DE.CM-09 — Personnel Activity Monitoring | DICE depends on observing user behavior patterns to detect elevated risk and verify improvement. | |
| Recommendation — Apply PR.AT-01 to run awareness as a measured behavior-change program rather than one-time instruction. Assign clear accountability for detecting, remediating, and measuring high-risk user behavior. Use monitored behavior signals to identify risky patterns and confirm whether interventions work. | ||
Related resources from NHI Mgmt Group
- What is the Agentic AI identity governance framework organisations should adopt?
- What is the difference between AI framework guidance and runtime security controls?
- How should security teams reduce the impact of an unauthenticated RCE in a web framework?
- When does a framework vulnerability become an identity problem?
