Human cyber risk benchmarks must now include AI-driven activity

At a glance

What this is: This is an analysis of how human cyber risk assessment benchmarks are changing as AI-driven activity and non-human actors become part of the measured workforce.

Why it matters: It matters because IAM, PAM, and identity governance teams now need benchmark models that cover both people and machine-driven access patterns, not just user awareness.

👉 Read Living Security Human Risk Management Platform's analysis of human cyber risk assessment benchmarks

Context

Human cyber risk assessment is the problem of measuring how people create security exposure through behaviour, access, and response patterns. In this article, the key shift is that the workforce now includes AI agents and other non-human actors, so benchmark models that stop at human awareness no longer describe the real attack surface.

Traditional awareness programmes measure attendance or completion, not whether risky behaviour changes under pressure. That leaves a governance gap for IAM and PAM teams, because the same identity and access controls that govern people now also need to account for service accounts, AI-driven workflows, and delegated access paths.

The article's starting point is typical for modern HRM thinking: risk is treated as measurable behaviour rather than a compliance checkbox, but the inclusion of AI-driven activity makes the benchmark problem broader and more operational.

Key questions

Q: What breaks when human risk assessments ignore AI agents and other non-human actors?

A: The benchmark becomes incomplete because it measures only human behaviour while missing delegated access, inherited privileges, and automated actions. That creates false confidence, especially when an AI agent or service account can reach sensitive systems on behalf of a user. Effective programmes must include NHI governance in the same risk model as human risk.

Q: Why do identity and access signals matter in human cyber risk scoring?

A: Because behaviour only becomes meaningful when you know what the person or account can actually access. A low-risk click from a user with minimal permissions is not the same as the same behaviour from a privileged identity. Weighting risk by access scope helps teams focus on the identities that can cause real harm.

Q: How should security teams measure human risk programmes beyond training completion?

A: Security teams should measure whether the programme changes behaviour, reduces repeat risky actions, and lowers exposure over time. Completion rates can still be reported, but they are not security outcomes. The useful measures are access risk trends, phishing susceptibility by segment, response rates to nudges, and whether high-risk groups improve after intervention.

Q: How should organisations govern AI agents alongside human identity and device access?

A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.

Technical breakdown

Why static awareness metrics miss human cyber risk

A static benchmark is a snapshot, while cyber risk is a moving target. Annual training completion, phishing click rates, and policy acknowledgements can show participation, but they do not prove safer behaviour in day-to-day work. A useful human cyber risk assessment correlates signals from behaviour, identity, and threat exposure so security teams can separate low-signal activity from genuine risk concentration. That matters because the control gap is not awareness alone, but the mismatch between what people know and what they do when incentives, pressure, or urgency change.

Practical implication: replace point-in-time training metrics with continuous, multi-source measurement tied to actual behavioural outcomes.

How identity and access data changes benchmark quality

Identity and access data turns a generic people-risk score into an operational security measure. Two employees may behave similarly in phishing simulations, but the one with elevated access, sensitive-data reach, or privileged workflows creates far more consequential exposure. This is where HRM intersects with IAM and PAM: benchmark design should reflect who can do what, not just who clicked what. Without that context, assessments can overstate low-impact behaviours and understate the risk created by standing privilege, excessive access, or weak offboarding controls.

Practical implication: weight human risk benchmarks by access level, privilege scope, and data sensitivity, not only by user behaviour.

Why AI agents and non-human actors belong in the same risk model

AI agents behave differently from humans, but they still create governance risk through delegated access, inherited privileges, and tool use. When a person grants an agent access to email, code, or business systems, the resulting activity often looks like machine-driven workflow rather than conventional user behaviour. That changes how benchmarks should be built: the assessment has to capture who delegated authority, what the agent can reach, and whether that access remains bounded over time. In practice, this is an NHI governance problem as much as a human-risk problem.

Practical implication: extend benchmark models to service accounts, bots, and AI agents wherever delegated access can act on behalf of users.

Threat narrative

Attacker objective: The objective is to turn everyday human or delegated-machine behaviour into durable access that can be abused at scale.

1. Entry occurs when an employee accepts a convincing phishing lure, reuses credentials, or delegates access to an AI-driven workflow without sufficient review.
2. Escalation follows when the same account has excessive permissions, allowing a low-level behavioural mistake to become privileged system access.
3. Impact is measured in compromised data, fraudulent actions, or automated misuse that bypasses the controls designed for human-only workflows.

NHI Mgmt Group analysis

Human risk benchmarks are becoming identity benchmarks. The moment an organisation includes AI agents, service accounts, and delegated workflows in its workforce model, assessment design crosses into IAM and NHI governance. Behaviour alone cannot explain exposure when identity scopes, privilege levels, and offboarding discipline determine the blast radius. Practitioners should treat benchmark design as an identity-control problem, not just a training metric problem.

The real gap is not visibility, but risk prioritisation. Many programmes can collect human-risk data, but fewer can decide which signals matter most. Correlating behaviour, access, and threat context creates a sharper governance model, especially where privileged users or exposed accounts are involved. The field is moving toward benchmark systems that rank operational consequence, not just user mistake frequency, and that is where security teams need to focus.

Behavioral assessment without delegated-identity governance creates false confidence. AI-native human risk programmes often emphasise monitoring, but the decisive issue is whether access granted to non-human actors is bounded, reviewable, and revocable. When agents inherit permissions from people, the governance assumption becomes that a human will remain in control of the session or workflow. That assumption is fragile, so teams should benchmark the control point where delegation turns into persistent machine authority.

Continuous assessment is now a governance baseline, not a maturity bonus. Static annual reviews were always weak for dynamic threats, but they are especially inadequate when machine activity can change faster than human review cycles. Continuous measurement gives leaders evidence for targeted intervention, board reporting, and access recertification decisions. Practitioners should use this moment to align HRM benchmarks with broader identity governance and resilience reporting.

Human cyber risk is now a mixed-identity discipline. The article correctly points to a combined human and machine workforce, which means the naming convention must change as well: programmes should stop treating non-human access as a separate niche and start treating it as part of the same governance fabric. That framing makes it easier to assign ownership, audit controls, and avoid blind spots across IAM, PAM, and NHI operations.

What this signals

Human cyber risk programmes are becoming identity operations by another name. Once AI agents and delegated workflows are included, the measurement problem shifts from awareness to access governance. Security leaders should expect stronger demand for benchmarks that combine behavioural telemetry with privilege scope, especially where service accounts and automation touch sensitive systems.

Identity teams will be asked to prove that delegated access stays bounded. That means better recertification, tighter offboarding, and clearer ownership for machine activity that originates from human decisions. The practical test is whether the programme can show that high-risk access is being reduced, not merely observed.

From our research, 85% of organisations lack full visibility into third-party vendors connected via OAuth apps. That visibility gap is exactly why mixed human-machine risk models will keep exposing hidden access paths, including delegated and third-party identity paths that traditional awareness programmes never see.

For practitioners

• Correlate behaviour with identity scope Build benchmark dashboards that combine training outcomes, access entitlements, and threat exposure so high-risk behaviour is weighted by the privileges it can actually touch. This is where IAM and PAM data becomes operationally useful.
• Add delegated-machine activity to human risk scoring Include service accounts, bots, and AI agents in the same measurement model when they act on behalf of users. Separate direct human actions from delegated activity so you can spot where NHI governance is missing.
• Measure behaviour change, not completion rates Track whether risky actions decline after intervention, whether incident reporting improves, and whether high-access users show sustained improvement. Use those outcomes for board reporting instead of relying on awareness attendance.
• Prioritise high-consequence identities Focus controls on employees and non-human identities with sensitive-data access, administrative rights, or delegated workflow authority. A small number of high-impact identities usually drives a disproportionate share of enterprise exposure.

Key takeaways

• Human cyber risk benchmarks are shifting from awareness metrics to mixed-identity governance metrics that include AI-driven activity.
• Behaviour data becomes far more useful when it is tied to identity scope, privilege, and delegated access.
• Security teams should measure change over time, not completion rates, and extend governance to non-human actors that act on behalf of people.

Key terms

• Human Cyber Risk: Human cyber risk is the probability that a person will make a security-relevant decision that creates exposure. It is governed by context, access, workload, and threat pressure, so it must be measured as an operational risk domain rather than treated as a training outcome alone.
• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Human Risk Benchmark: A human risk benchmark is a measurable baseline used to track behavioural security exposure over time. Unlike a simple pass or fail metric, it is designed to show whether interventions reduce risk, especially when privilege, access scope, and threat pressure are included in the assessment.

What's in the full article

Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:

• A step-by-step framework for combining behaviour telemetry, identity data, and threat signals into a continuous human-risk score
• Examples of benchmark metrics for phishing susceptibility, reporting behaviour, and high-risk-user prioritisation
• Guidance on how the platform correlates employee behaviour with AI-driven activity and delegated access paths
• Board-reporting examples that show how to demonstrate behaviour change over time

👉 The full Living Security Human Risk Management Platform article expands the benchmark model, measurement approach, and AI-driven risk considerations.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps identity and security practitioners turn delegated access and machine identity risk into manageable policy.