Notifications
Clear all
Topic starter
19/08/2026 4:03 pm
TL;DR: Annual compliance courses prove training happened but do not prove employees can recognize, report, or avoid threats under pressure, according to Living Security Human Risk Management Platform research, reinforcing that behaviour change requires personalised intervention, realistic simulations, and continuous measurement. The lesson is that completion is a baseline, while risk reduction depends on evidence tied to identity, role, and response patterns.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: Cybersecurity Compliance Training: Why Check-the-Box Fails
By the numbers:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%).
Questions worth separating out
Q: What breaks when cybersecurity training only measures completion?
A: Completion-only programmes break because they measure attendance, not whether people can recognise a threat, resist pressure, or report suspicious activity.
Q: When should organisations move from compliance training to human risk management?
A: They should move when the same annual module is still being used for every role, or when risky behaviour remains concentrated in a small group after repeated campaigns.
Q: What do security teams get wrong about phishing awareness training?
A: They often treat training as a replacement for technical containment.
Practitioner guidance
- Rebase awareness metrics on behaviour Replace completion rate reporting with measures such as repeat click rate, report rate, response speed, and intervention success by role and risk tier.
- Segment by identity and access context Use role, privilege, location, and prior behaviour to distinguish low-risk users from the people whose mistakes create the greatest exposure.
- Build closed-loop interventions Trigger coaching, retests, and nudges after observed failure, then compare the next simulation or real-world response against the prior baseline.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- How the human-risk scoring model links phishing, vishing, and smishing outcomes into one operating view
- Examples of targeted coaching and retest workflows that follow a failed simulation
- The program-level reporting details behind response time, remediation, and board-facing risk evidence
- Specific product examples showing how simulated attacks feed follow-up actions and measurement
Check-the-box cybersecurity training: what security teams miss?
Explore further
19/08/2026 4:38 pm
Check-the-box training is a compliance artifact, not a security control. Completion proves that instruction was delivered, but it does not prove that people can recognise a threat, slow down under pressure, or choose a safer action. The problem is structural: organisations often measure distribution instead of resilience. That leaves human risk invisible where it matters most, especially in workflows tied to access, approval, or sensitive data. Practitioners should treat completion as the floor, not the outcome.
A question worth separating out:
Q: How do IAM teams know whether access governance is working?
A: IAM teams should look for fast revocation after role change or departure, accurate entitlement data, and low numbers of orphaned or over-provisioned accounts. If access creation is easy but removal is slow, governance is incomplete. The strongest signal is whether access still matches business need after the identity changes.
👉 Read our full editorial: Cybersecurity compliance training fails when completion becomes the metric
