Decision Model and Notation (DMN) is an open standard for expressing business decisions in a structured, readable form, usually as decision tables, boxed expressions, and simple diagrams. Instead of burying rules in application code, spreadsheets, or prompts, DMN makes the inputs, logic, and outputs explicit so they can be reviewed, tested, and versioned.
In cyber security, that visibility matters. DMN can describe approval rules, risk scoring, fraud checks, access decisions, and incident triage steps in a way that auditors and domain experts can inspect. Defenders use it to reduce hidden logic, limit manual errors, and keep policy changes controlled. It is also useful when AI systems need to act on business rules, because the model can explain or route a decision while DMN supplies the governed rule set. Poorly managed decision logic is a risk: inconsistent thresholds, outdated exceptions, and unreviewed changes can be abused or can cause a system to authorize the wrong action.