Security tools create activity. Behavior creates security.
A scanner alerts, someone eventually fixes, and the system never says a word. That's activity, not a habit. M.A.R.I.A. is built on the behavioral science of closing that loop — ethically, deterministically, and out loud.
The loop every security tool leaves open
Behavioral science has a simple model for why people act: B = Motivation + Ability + Prompt (BJ Fogg). An action happens when there's enough motivation, real ability, and a trigger at the right moment. Habits form through a cycle: cue → craving → response → reward.
Almost every security tool has the cue and the response, and never closes the reward. The scanner fires an alert. Someone, eventually, fixes something. And the system says nothing — it never confirms the fix worked, never shows the risk drop, never acknowledges the person who did the work.
A cue and a response with no reward produces activity. It never produces a habit.
M.A.R.I.A. did exactly this too, once. Fixing it — and proving the fix in production — is what this module is.
The loop, closed and out loud
M.A.R.I.A. completes the cycle the way behavior actually forms: nudge → fix → confirm → recognize.
- Nudge — a single recommended action at the right moment, under a hard attention budget. Not the whole list; the one thing worth doing now.
- Fix — the developer does the work, in their own flow.
- Confirm — the same scanner re-runs and the finding is gone. Disappearance is evidence, so an anti-cliff guard rules out a scan that simply didn't run.
- Recognize — the reward arrives in two beats: at merge, while the person still remembers what they did, and again when the re-scan confirms it for real.
This is the sixty-second demo no other tool can give you: a developer fixes an issue, the scanner confirms it, the application's risk score drops, and the person is credited — live, on real data.
Behavioral design has a dark version. These are the red lines.
The moment you design behavior, you can manipulate it. M.A.R.I.A. is named after a mother who cared for people — and a mother who manipulates is worse than a neutral tool. So the ethics aren't a policy page; they're written into the code, each with a test that breaks if it's violated:
- Invisible by fluidity, never by concealment. The layer stays out of your way, but it never hides a real risk to nudge you.
- No scarcity, no unpredictability, no individual ranking. The manipulative dark patterns of engagement design are unexpressible in the schema, not merely discouraged.
- Disagreeing is free. Contesting a finding takes one click, never carries a penalty, and is never read by the recognition system or used to evaluate a person.
- Recognize the fact, never invent the impact. The reward claims a risk drop only when it's real. In a saturated repo it acknowledges the fix and says plainly that the number didn't move.
- Silence is earned by evidence, not by ignorance. M.A.R.I.A. only goes quiet about a risk when it has positive evidence the risk is low — never because a signal is missing.
A champion is a bridge, not a bottleneck
Champion programs fail the same way: the champion slowly becomes a part-time AppSec team, a single point of failure with a day job. M.A.R.I.A. encodes the roles so that can't happen quietly.
- The champion facilitates — interprets context, translates, connects. They accept low/medium risk and escalate. That's the whole mandate.
- The champion is never accountable for the fix — that's the developer — and never accepts high/critical risk — that needs dedicated authority. The role is guaranteed to stay out of the accountability chain by a test, not a guideline.
- Being a champion is opt-in. No auto-enrolment. And contribution is measured as help given, never as bugs owned — because a bug belongs to the code, not the person.
Why it matters — and why it sells
Every ASPM ends at "here's your prioritized list" or "we opened the ticket." None of them proves the work reduced risk, and none of them closes the loop back to the person who did it. That layer — judgment, accountability, and proof of outcome — has no owner in this market.
Prioritization is table stakes with ten vendors fighting for parity. The closed loop isn't. It's the difference between a tool your team tolerates and one that quietly changes how they behave.
The honest test of a security tool isn't coverage. It's whether the behavior survives when you remove the prompt.
The reward, in two beats
Recognition lands at the moment of the habit, not in a monthly report:
Beat 1 — at merge (projected)
✔ You upgraded spring-core 6.1.4 → 6.1.6
Projected impact on payments-api: risk 84 → ~61
Nice — that closes a reachable critical.
Beat 2 — next scan (confirmed, real data)
✔ Confirmed: CVE-2025-31324 no longer reported by Trivy
payments-api risk 84 → 41 (real, −43)
Credited to you. The loop is closed.
(If the repo were saturated: "Fix confirmed. Risk number
didn't move this time — acknowledged anyway.")Illustrative example
Proven in production: a repository went from a risk score of 92 to 84 the moment six criticals were marked fixed. Before the honest-scoring fix that made this possible, the number couldn't move — so the reward had nothing true to say.
See the loop close on real data.
The demo runs the whole cycle end to end — fix, confirm, drop, recognize.