Transfer Method × IT Environment — coverage, then priority

Framework & approach credit: Erick Rudiak — erick.rudiak.com/blog

Your DLP coverage matrix (0–5 maturity scale), now with three attacker dimensions layered on per cell: attacker cost, likelihood it's an attacker vs. normal business, and business disruption to block. Switch lenses to recolor the grid. The Priority lens is the punchline — it multiplies likelihood by your coverage gap, so the reddest cells are exactly where spending friction on high-attacker-likelihood traffic pays off first. Click any cell for the detail + controls.

Priority quadrant — where to spend friction

Each method placed by its recommended posture (its likelihood/disruption profile averaged across environments where it applies). This is the strategy view: enforce first where attackers are likely and blocking is cheap; instrument-and-be-surgical where blocking hurts the business.

Click either axis title above for the attacker's step-by-step play on that dimension and the controls that break each step. Click attacker cost here → what "attacker cost" means →. On the Priority lens, click any legend chip (! H M L ·) for what that band means and how to act.

Foundations that make the model executable

Visibility we turn on everywhere (cheap, universal); the other three are the friction dials tuned per cell.