Parkerian Hexad

Parkerian Hexad and the limits of the CIA triad

The Parkerian hexad is best understood as a refinement of classic information security thinking, not a replacement for it. It keeps confidentiality, integrity and availability, but argues that those three properties do not fully describe what an organisation can lose when information is compromised, especially when control of data, source trust or practical usefulness changes without a simple confidentiality or integrity failure.

That distinction matters because many incidents are not just about disclosure or corruption. A system can be unavailable yet still retain value, or data can be copied, redirected or impersonated in ways that leave its bits intact but still produce a security loss. The hexad exists to make those cases easier to name and analyse.

The three added properties: possession or control, authenticity and utility

In the hexad, possession or control captures whether an actor can physically or logically hold or direct information. Authenticity asks whether data, messages or entities are genuinely what they claim to be. Utility asks whether information remains usable for its intended purpose. Together, these dimensions fill gaps that the CIA triad can leave open in fraud, impersonation, replay, data handling and information-use decisions.

These additions are especially helpful when a compromise does not obviously change confidentiality, integrity or availability. A copied secret may not be altered, but losing exclusive control of it still changes the security outcome. Likewise, a forged record can be “available” and even internally consistent while still being worthless because its authenticity has been destroyed.

Why the model matters in security analysis

The main value of the Parkerian hexad is precision. It gives practitioners a more exact vocabulary for classifying incidents, scoping controls and explaining why a given event is harmful even when the traditional triad feels incomplete. That is useful in security design, threat modelling, incident review and in conversations with non-specialists who assume the triad covers every important harm.

The model also helps avoid false negatives in analysis. If teams only ask whether confidentiality, integrity or availability was violated, they can miss control loss, provenance failure or unusable information. The hexad encourages a broader but still disciplined view of what “security loss” means for data and systems.

How to apply the hexad in practice

Use the hexad as an analysis lens when you are classifying a control objective, documenting an incident, or deciding what exactly must be protected. It is most helpful when the question is not simply “was data exposed?” but “was it controlled, trusted, or still useful for its intended purpose?” That framing can change what evidence you look for and which safeguards you prioritise.

Its strength is conceptual clarity, not operational prescription. In practice, organisations still need to translate the model into concrete controls for access, validation, provenance, availability and recovery. The hexad simply gives those controls a more complete set of security outcomes to defend.

Practitioner Guidance

Why practitioners should care: The hexad is useful when a triad-based review would understate the impact of an incident or control weakness. It helps security teams distinguish between data that was exposed, data that was controlled by the wrong party, and data that is no longer trustworthy or useful.

Common misunderstanding: Some teams treat the Parkerian hexad as if it replaces the CIA triad. In practice, it is better viewed as a richer classification model that sharpens analysis when classic CIA language is too coarse.

Related resources from NHI Mgmt Group

• Guide: CIA Triad Guide