Notifications
Clear all
Topic starter
20/08/2026 5:33 pm
TL;DR: Employee cyber risk benchmarking only becomes useful when behavioural signals are correlated with identity and access data and threat intelligence, because completion rates and click rates do not show who can actually do damage, according to Living Security Human Risk Management Platform. That makes identity context central to any programme trying to move from awareness reporting to measurable risk reduction.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: How to benchmark employee cyber risk in 6 steps
Questions worth separating out
Q: How should security teams benchmark employee cyber risk across different roles?
A: Start with a baseline that combines behaviour, identity and access, and threat exposure.
Q: Why do training completion metrics fail to describe real human risk?
A: Training completion shows participation, not whether risky behaviour declined or whether exposure was reduced.
Q: What signals show that employee risk scoring is actually working?
A: A working programme should show declining risk trajectories, fewer high-risk users in privileged groups, and faster movement from score to intervention.
Practitioner guidance
- Weight behavioural scores by privilege and role Combine phishing results, training outcomes, and access entitlements so risky behaviour is ranked by the blast radius of the account rather than by the event alone.
- Build a baseline from three data pillars Correlate behavioural signals, IAM and PAM data, and current threat intelligence before setting thresholds, so the benchmark reflects exposure rather than completion metrics.
- Use risk trajectories, not static scores Track whether employee risk is rising over time and trigger interventions when the trend accelerates, even if the person has not crossed a fixed threshold yet.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact six-step benchmarking workflow, including how to build and recalibrate a baseline over time.
- Practical examples of employee risk metrics, such as phishing report rate, risky application use, and access-linked scoring.
- How to segment employees by role, department, and risk trajectory to support targeted interventions.
- Board-facing reporting approaches for translating human risk into executive and budget language.
Employee cyber risk benchmarking: what IAM and HRM teams miss?
Explore further
20/08/2026 6:19 pm
Behaviour-only benchmarking creates a false sense of precision: if a programme measures training completion and simulation clicks without identity context, it overstates maturity. Those metrics are useful for engagement, but they do not show who can inflict material harm. Practitioners should treat them as inputs, not as the benchmark itself.
A question worth separating out:
Q: How should organisations respond when high-risk employees also hold privileged access?
A: Prioritise those users for immediate review, because behaviour and privilege together create outsized exposure. Use targeted micro-training, manager engagement, and access validation to reduce the likelihood that a human mistake becomes a security event.
👉 Read our full editorial: Benchmarking employee cyber risk needs identity context, not vanity metrics
