Topic starter
21/08/2026 4:54 pm
TL;DR: Human cyber risk assessment benchmarks now need to measure behaviour, identity and threat signals together because AI agents and other non-human actors have joined the attack surface, according to Living Security Human Risk Management Platform. Static annual awareness metrics are no longer enough; continuous, data-driven assessment is becoming the practical basis for targeted intervention and measurable risk reduction.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “What Are Human Cyber Risk Assessment Benchmarks?”.
Key questions
Q: How should security teams measure human cyber risk across employees and AI agents?
A: Use a unified model that combines behaviour, identity and access, and threat context.
Q: Why do annual awareness metrics fail as human risk benchmarks?
A: Because they measure knowledge at one point in time, not how people behave when exposed to real threats over time.
Q: What signals show that human-risk controls are actually working?
A: Look for a falling concentration of risky behaviour, lower data-loss exposure, fewer repeat incidents, and faster remediation after targeted intervention.
Practitioner guidance
- Define a benchmark that joins behaviour, identity, and threat signals Measure phishing susceptibility, incident reporting, access scope, and live threat targeting in one model so the score reflects actual exposure rather than training completion alone.
- Include AI-driven activity in human risk scoring Track service accounts, AI agents, and delegated actions alongside employee behaviour so the programme captures non-human activity that inherits human-granted permissions.
- Prioritise high-access, high-exposure individuals first Use risk segmentation to focus intervention on users with sensitive access and demonstrated risky habits, rather than applying the same controls to every employee.
Bottom line: Human cyber risk benchmarks now need to measure behaviour, identity, threat context, and AI-driven activity together if they are going to reflect real exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:11 pm
Human risk measurement is becoming an identity problem, not just a training problem. The article is right to move beyond awareness completion because the thing that matters is whether access, behaviour, and threat context line up in ways that increase exposure. Once a benchmark includes identity and access data, it starts to function as a governance control, not a compliance scorecard. The practical conclusion is that teams should measure who can act, how they act, and what they are exposed to.
A question worth separating out:
Q: What should teams do first when building a human cyber risk benchmark?
A: Start by correlating three data sets: behaviour, identity and access, and threat intelligence. That gives you a baseline that is operationally useful because it ties risk to who can act, how they behave, and whether adversaries are actively targeting them.
👉 Read our full editorial: Human cyber risk benchmarks must now include AI-driven activity