AI safety starts outside the model.

What an unmeasured link costs.

About 60 percent of the breaches in Verizon's 2025 analysis involved a human element: someone clicked, answered a call, made an error or had a credential abused (Verizon, 2025).

• A control in the policy, missing on the server. In February 2024, attackers used stolen credentials on a Change Healthcare remote-access portal that did not have multifactor authentication. Ransomware followed nine days later (Witty, 2024). The parent company's policy already required multifactor authentication on external systems; this legacy server had not yet been brought up to it (UnitedHealth Group, 2024b). UnitedHealth Group reported $872 million in effects from the attack on its first-quarter 2024 operating earnings: $593 million in direct response costs and $279 million in business disruption (UnitedHealth Group, 2024a).
• A help desk that trusted a voice. In September 2023, attackers talked their way past an IT service desk at MGM Resorts (Martin, Gallagher & Manson, 2023). MGM estimated the hit from the disruption at about $100 million to adjusted property EBITDAR (MGM Resorts International, 2023).
• A video call where everyone was fake. In early 2024, a finance employee at Arup in Hong Kong joined a video call in which the senior colleagues were AI-generated, and paid out about US$25 million (Magramo, 2024).
• An answer nobody owned. In 2024, a Canadian tribunal held an airline responsible for what its website chatbot told a grieving customer. The airline had argued the chatbot was responsible for its own actions (Moffatt v. Air Canada, 2024).

In each case the cost landed on a link outside any model score: a person, a process or an owner. A review of the model alone would not have shown how weak that link was.

Where AI risk sits: the system, the people and the organization.

In 2019, our founder set out where AI risk sits and what industrial-organizational psychology brings to each level (Barney, 2019). The frame has three levels, and each needs its own evidence.

• The system. The AI model, the judge that grades it and the tools it can call. AIM measures this level today.
• The people. Operators, reviewers and the employee on the call: their skill, their habits and their moral reasoning under pressure. Designed, not yet measured.
• The team and the organization. Whether team members monitor and back each other up, who holds decision rights, how culture treats a shortcut, and whether a known control is actually in place. Research program.

Security research reaches the same place. Experts mapping pathways to computer security vulnerabilities found that human and organizational factors, from management and policy to training and error, play a significant part (Kraemer, Carayon & Clem, 2009). People who know a protective measure still omit it (Workman, Bommer & Straub, 2008).

Trace the risk from policy to performer.

A measured result deserves trust only if it traces back through an unbroken chain, each link with its error. We apply that idea to the organization itself: purpose, then targets for quality, cost, quantity and cycle time, then processes, tasks and the performers who do them, whether people, AI models, robots or outside providers (Barney, 2013).

Requirements flow down that chain. A safety policy is one of them: this system needs multifactor authentication, this payment needs a second check. Measured capability flows up. Where something flows down and nothing flows up, the link is a guess. A safety review that measures the model and guesses everywhere else has one strong link in a weak chain.

The organizational digital twin is the model that keeps both flows side by side, with an owner who can say when it is no longer fit to decide with. Our paper Engineering the Organizational Constraint describes the method. It is a method today, not a production system.

What AIM shows today.

• Each judge measured at each level. An AI judge can be harsh at one level and lenient at another. We estimate that pattern for each judge, level by level. Correcting for it is modeled today and has not yet passed its gate. How the correction works
• Judges measured twice. Three judges were re-measured in a second paid run, against a margin written down beforehand, and their severity held (2026-10-05). The result and its limits
• A record behind every score. Questions are frozen under fingerprints, and each run checks them before it starts. Each score leads back to its question, its answer key and its grading rule.
• A standard error on every measure. The reasoning ruler passed its precision gate on 2026-08-22. The dated record

Shown today, with dates. These results cover AI judges on text. They do not cover people, teams or robots.

The score informs. A rule and a named person decide.

Judgment can be probabilistic. Actions should not be. In our proposed design, a trigger trips on the lower edge of a measure's standard error, not on a raw score that happens to cross a line, and a named person owns pause and stop. AIM does not enforce, quarantine or stop anything, and it does not sit in the runtime path. The proposed trigger design

Proposed design. Not yet tested on a live system.

Designed, with results pending.

• People, AI models and robot tasks on one linked scale. The ruler describes the task, not the performer, so a person and an AI system can be placed on it in the same unit. The study that links them is registered; its results are pending. No person has been placed on the reasoning ruler yet, and no robot has been measured.
• Capability against limits your committee sets. Each measure carries a standard error, so it can be read against limits a risk committee sets. Capability needs repeated occasions. One run gives precision only.

Research program: the people, team and organization levels.

Industrial-organizational psychology already measures much of what the 2019 frame names: moral reasoning, how teams monitor and back each other up, and culture. Bringing those measures onto the same ruler as the AI system, so a committee can see every link of the chain in one unit, is our research program. It is not our product, and we will publish each step with its status when it exists.

What we do not claim.

• That AIM measures people, teams or culture today. It does not.
• That AIM stops unsafe agents or acts as a runtime control.
• That any committee has set limits with us yet, or that any customer has deployed this.
• Any endorsement, certification or conformity with a standard. AIM is not a NIST standard and claims no endorsement.

Bring one safety decision.

Pick one decision your committee has to defend: a release, a vendor's evidence or a monitor you rely on. In 20 minutes we will map which links behind it are measured, which are guessed, and what it would take to measure the next one.

Book a 20-minute scoping call   Questions AI safety leads ask

Sources.

Barney, M. F. (2013). Leading value creation: Organizational science, bioinspiration, and the Cue See model. Palgrave Macmillan. https://doi.org/10.1057/9781137361509

Barney, M. F. (2019). The reciprocal roles of artificial intelligence and industrial-organizational psychology. In R. N. Landers (Ed.), The Cambridge handbook of technology and employee behavior (pp. 38-56). Cambridge University Press. https://doi.org/10.1017/9781108649636.004

Goodin, D. (2024, April 30). Health care giant comes clean about recent hack and paid ransom. Ars Technica. https://arstechnica.com/security/2024/04/change-healthcare-hacked-through-stolen-password-for-account-with-no-mfa/

Kraemer, S., Carayon, P., & Clem, J. (2009). Human and organizational factors in computer and information security: Pathways to vulnerabilities. Computers & Security, 28(7), 509-520. https://doi.org/10.1016/j.cose.2009.04.006

Magramo, K. (2024, May 16). British engineering giant Arup revealed as $25 million deepfake scam victim. CNN. https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk

Martin, A., Gallagher, R., & Manson, K. (2023, September 16). MGM Resorts hackers broke in after tricking IT service desk. Bloomberg. https://www.bloomberg.com/news/articles/2023-09-16/mgm-resorts-hackers-broke-in-after-tricking-it-service-desk

MGM Resorts International. (2023, October 5). Form 8-K. U.S. Securities and Exchange Commission. https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm

Moffatt v. Air Canada, 2024 BCCRT 149. https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.pdf

UnitedHealth Group. (2024a, April 16). UnitedHealth Group reports first quarter results [Press release]. https://www.unitedhealthgroup.com/content/dam/UHG/PDF/investors/2024/UNH-Q1-2024-Release.pdf

UnitedHealth Group. (2024b). Responses to questions for the record for Andrew Witty. U.S. Senate Committee on Finance. https://www.finance.senate.gov/imo/media/doc/responses_for_questions_for_the_record_to_andrew_witty.pdf

Verizon. (2025). 2025 data breach investigations report. https://www.verizon.com/business/resources/Tccd/reports/2025-dbir-data-breach-investigations-report.pdf

Witty, A. (2024, May 1). Testimony before the House Energy and Commerce Committee, Subcommittee on Oversight and Investigations: Examining the Change Healthcare cyberattack. https://democrats-energycommerce.house.gov/sites/evo-subsites/democrats-energycommerce.house.gov/files/evo-media-document/Testimony_Witty_OI_2024.05.01.pdf

Workman, M., Bommer, W. H., & Straub, D. (2008). Security lapses and the omission of information security measures: A threat control model and empirical test. Computers in Human Behavior, 24(6), 2799-2816. https://doi.org/10.1016/j.chb.2008.04.005