What is an IoH?
An Indicator of HUMINT Operation (IoH) is an observable sign that a person is currently the target — or the relay — of a social-engineering operation. It is the human echo of the IoC: some practitioners read the same acronym as an "indicator of human compromise", and both point to the same object — the human-side signals of an attack in progress.
An IoC lives in a machine: a hash, an IP, a suspicious process. An IoH lives in an interaction: an unusual request, a manufactured emotion, a channel that does not match the claimed identity. The IoC is read by a tool; the IoH is read by a human — which is exactly why it needs a framework.
Why IoH matter — and why one is never enough
Technical indicators are largely binary: a known-malicious hash is malicious. Human indicators are not. Urgency, authority or a favour can all be perfectly legitimate. Taken alone, a single IoH proves nothing and produces false positives that erode trust.
HACT therefore treats IoH by accumulation, not by isolation. The signal that matters is the convergence of several weak indicators inside one interaction — a threshold, not a verdict on a single cue.
IoC vs IoH
| Dimension | IoC — Indicator of Compromise (cyber) | IoH — Indicator of HUMINT Operation |
|---|---|---|
| Object | A system, a network, a file | A person and their decision |
| Nature of the signal | Technical artifact (hash, IP, domain, registry key) | Behavioural / relational cue (urgency, authority, secrecy) |
| Signal strength | Often strong, near-binary | Weak and contextual by design |
| Read by | A tool (EDR, SIEM, antivirus) | A human, ideally trained |
| Decision rule | A single match can trigger a block | Convergence of several (rule of three) |
| Example | Connection to a known C2 IP address | An "urgent, confidential" wire request from a new channel |
Common IoH
None of these is suspicious on its own. Their value lies in convergence within a single interaction.
- Manufactured urgency A hard deadline that removes time to think or verify.
- Authority + secrecy An order presented as coming from the top, "to keep between us".
- Channel mismatch A sensitive request arriving through an unusual or new channel.
- Verification refused Resistance or irritation when a call-back or second check is proposed.
- Process bypass A request that skips the normal validation circuit "just this once".
- Emotional pressure Fear, flattery, guilt or excitement engineered into the exchange.
- Identity–context gap Claimed identity inconsistent with tone, timing or knowledge.
- Reciprocity hook A small favour granted first, to make refusal feel awkward.
From indicator to detection
Each HACT technique carries the IoH it typically produces and a countermeasure. Detection is therefore not a matter of catching one clever line, but of counting convergent signals and, above threshold, moving the interaction from trust to verification.