AMI3A: Know Your Security State. Know What to Do Next.
AMI3A is a security decision model that helps an organization determine whether it is vulnerable, under attack, or compromised—and follow a structured path toward prevention, defense, and recovery.
Security becomes actionable when the current state is clear.
Tools generate findings, alerts, and evidence. AMI3A organizes that information around three operational questions so the security team can establish where it is in the lifecycle and choose the appropriate response.
From Potential Exposure to Confirmed Impact
Each AMI state asks a different question, uses different evidence, and leads to a different operational objective.
Am I Vulnerable?
- What weaknesses exist?
- How likely are they to be exploited?
- What is the business risk?
Focus: Exposure reduction and prevention.
Explore Vulnerability Management →Am I Under Attack?
- Is an attack happening now?
- What is the attacker doing?
- How do we detect, mitigate, and stop it?
Focus: Real-time defense and incident response.
Explore Attack Detection & Mitigation →Am I Compromised?
- Has the attacker succeeded?
- What assets, data, or systems were affected?
- What is the business impact and recovery path?
Focus: Containment, eradication, and recovery.
Explore Incident Response & Recovery →Potential → Attack → Compromise
AMI3A follows the movement of a security condition through the operational lifecycle. The objective changes as the state changes.
AmiVul
Understand exposure and prevent exploitation.
Operational objective: PreventAmiUA
Recognize active behavior and stop the threat.
Operational objective: DefendAmiComp
Determine impact, contain damage, and restore the environment.
Operational objective: RecoverAAA: Analyze → Action → Acknowledge
Identifying the security state is not enough. Each AMI state is executed through the AAA loop: understand the situation, take corrective action, and confirm what the action actually achieved.
The loop keeps the team focused on evidence and outcomes rather than allowing an alert, task, or mitigation to be mistaken for a completed response.
How AMI3A Maps to SIRT Functions
Different teams may own different stages, but the states remain connected. Together they create a continuous defensive operating model.
PSIRT
Handles vulnerabilities, exposure analysis, prioritization, and prevention.
Explore PSIRT →CSIRT
Handles active attacks, real-time analysis, mitigation, and coordinated response.
Explore CSIRT →Incident Recovery / DFIR
Investigates compromise, establishes impact, contains damage, and supports recovery.
Explore Compromise & Recovery →AMI3A in One View
AMI3A is a security decision model that helps organizations determine whether they are vulnerable, under attack, or compromised, and provides a structured path for prevention, defense, and recovery.