The DICE framework is a behavior-change model built around detect, intervene, change behavior, and evaluate. It helps security teams identify at-risk users, deliver timely guidance, reinforce safer habits through practice, and measure whether the program is producing lasting reductions in human risk.
What the DICE framework does
The DICE framework is a behaviour-change model for security awareness and coaching. Its purpose is not to “teach once and hope”, but to identify where people are most at risk, intervene at the right moment, reinforce safer habits through practice, and evaluate whether behaviour is actually improving over time.
That makes DICE different from awareness programmes that focus only on content delivery. It is built around the idea that human risk is dynamic, so the security team has to observe behaviour, respond proportionately, and measure whether the intervention changed the outcome.
How DICE works in a security programme
The four steps are intentionally sequential. Detect means spotting risky patterns, such as repeated unsafe clicks, poor password habits, or recurring policy exceptions. Intervene means delivering targeted nudges, coaching, or controls when the behaviour matters most. Change behaviour means helping the person adopt a safer routine, usually through repetition and context. Evaluate means checking whether the intervention produced a durable reduction in risk rather than a short-term compliance spike.
In practice, DICE works best when the organisation can connect the model to real signals from security operations, IAM, endpoint, email, or training systems. A behaviour-change model without data degenerates into generic awareness training, which is much harder to prove effective.
Where DICE fits in human-risk management
DICE is most useful where security outcomes depend on repeated human decisions, not just on technology controls. It fits phishing resilience, privileged-user behaviour, policy adherence, secure handling of sensitive data, and other situations where the same mistake can recur unless the organisation changes the underlying habit.
The model also helps teams move from blame to measurement. Instead of asking whether users were “taught”, it asks whether the organisation noticed the risk, intervened in time, and reduced the behaviour that created exposure. That makes it a useful bridge between awareness, coaching, and measurable human-risk reduction.
What DICE does not do
DICE is not a substitute for preventive security controls, and it does not remove the need for technical enforcement. If a risky action can be blocked safely, that control is usually stronger than relying on behaviour change alone. DICE is best understood as a programme layer that complements prevention, especially where user choice still matters.
It also does not guarantee lasting change just because an intervention occurred. If the environment keeps rewarding unsafe shortcuts, or if the message is too generic to be relevant, the same behaviour tends to return. That is why the evaluation step matters as much as detection and intervention.
Risk and Threat Considerations
DICE addresses a real security problem: human behaviour is often the most variable part of the control stack, and recurring unsafe actions can create persistent exposure even when policy exists. Its value is highest when an organisation needs to reduce repeat behaviour, not just record that a campaign happened.
Failure mechanism: If detection is weak, interventions are untargeted, or evaluation is superficial, the programme may create activity without reducing the behaviour that causes risk. Over time, that can leave the same users, workflows, or privilege paths exposed to repeated mistakes or abuse.
Impact: Weak human-risk programmes can increase susceptibility to phishing, unsafe approvals, policy violations, and other behaviours that attackers commonly exploit. The result is not merely lower training effectiveness, but a larger and more persistent operational attack surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | DICE operationalises risk treatment for recurring human behaviour exposure. |
| PR.AT-01 — Awareness and Training | DICE is a behaviour-change model that strengthens training by timing and reinforcement. | |
| Recommendation — Define measurable human-risk objectives and track whether interventions reduce exposure over time. Deliver targeted awareness and training based on observed user risk patterns. | ||
| CIS Controls v8 | 5 — Account Management | DICE often targets risky user behaviour tied to access and account misuse patterns. |
| Recommendation — Use account-focused controls and monitoring to trigger behaviour interventions where misuse appears. | ||
Practitioner Guidance
Why practitioners should care: DICE is most useful when security teams need a repeatable way to turn human-risk signals into targeted action. It helps separate broad awareness activity from interventions that are actually aimed at the behaviour causing exposure.
Common misunderstanding: Many teams treat awareness as a one-time communication problem. DICE assumes the harder problem is sustained behaviour change, which means the programme has to be monitored and adjusted instead of simply delivered.
Practitioner takeaway: Use DICE when you need evidence that a human-risk intervention changed behaviour, not just that it was sent or completed.
Related resources from NHI Mgmt Group
- Guide: IoT Device Identity with TPM and DICE Guide
- What is the Agentic AI identity governance framework organisations should adopt?
- What is the difference between AI framework guidance and runtime security controls?
- How should security teams reduce the impact of an unauthenticated RCE in a web framework?
- When does a framework vulnerability become an identity problem?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org