Notifications
Clear all
Topic starter
20/08/2026 5:54 pm
TL;DR: GenAI training ROI cannot be measured by completion rates alone because risk now comes from both employees and AI agents interacting with sensitive systems, according to Living Security Human Risk Management Platform's analysis. The useful measure is behavioural change linked to identity, access, and threat signals, because training only matters when it reduces risky actions and closes the human machine risk gap.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: How to Measure GenAI Training ROI & Effectiveness
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: How should organisations measure GenAI training effectiveness?
A: Measure whether training changes behaviour, not just attendance.
Q: Why do human and machine identities need to be measured together?
A: Because AI agents can generate the same business risk as employees, but at machine speed and with different access patterns.
Q: What signals show that GenAI training is actually working?
A: Look for fewer unsafe prompts, fewer data-sharing mistakes, lower click rates on AI-generated phishing, and fewer access-policy exceptions among trained groups.
Practitioner guidance
- Define outcome metrics before rollout Measure reductions in risky AI behaviour, policy violations, and sensitive-data handling errors before judging programme effectiveness.
- Correlate HRM data with IAM signals Join employee behaviour telemetry with identity and access events so you can see whether high-risk users also have privileged access or access to sensitive systems.
- Add AI agent activity to training dashboards Include AI agent access patterns, tool use, and data-touch events in the same reporting layer as human activity so machine behaviour is visible in the same governance view.
What's in the full article
Living Security Human Risk Management Platform's full blog covers the operational detail this post intentionally leaves for the source:
- Role-specific KPI examples for tracking GenAI adoption and risky behaviour over time
- Practical guidance on correlating employee behaviour with identity and access signals
- Methods for measuring AI agent activity alongside human training outcomes
- Examples of translating training results into board-ready risk reduction language
GenAI training ROI and effectiveness: what do teams measure now?
Explore further
20/08/2026 6:35 pm
Behavioural measurement is now the only defensible way to judge GenAI training. Completion counts and attendance logs are administrative data, not security evidence. If a programme cannot show fewer risky prompts, fewer policy violations, or fewer high-risk AI interactions, it cannot claim effectiveness. For identity teams, this is where governance becomes measurable rather than aspirational, and the practical conclusion is to track what people and agents actually do.
A question worth separating out:
Q: Who should remain accountable when AI reduces security team workload?
A: Accountability should remain with the security function that owns the control, not with the model that helped process the work. AI can reduce workload, but it does not replace the need for clear decision ownership, especially where identity, escalation, or incident response outcomes are affected.
👉 Read our full editorial: Measuring GenAI training effectiveness needs human and machine risk
