Topic starter
20/08/2026 6:00 pm
TL;DR: Traditional security awareness still leaves 70% to 90% of breaches involving people, according to Living Security Human Risk Management Platform, because completion-based training does not measure or change behaviour; modern human risk analytics instead correlates behaviour, identity, and threat signals to predict and reduce risk. The governance shift is from awareness as compliance to intervention as control, including the human side of NHI and AI-augmented access.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “How to Choose a Human Risk Analytics Platform”.
Key questions
Q: What breaks when security awareness programmes rely on completion rates?
A: Completion rates break because they measure attendance, not behaviour change or exposure.
Q: Why do identity and threat signals need to be analysed together?
A: Because risk depends on context.
Q: What do security teams get wrong about human risk management?
A: They often treat it as a training completion problem instead of a resilience problem.
Practitioner guidance
- Assess behaviour-change outcomes, not course completion Replace completion-rate reporting with measures such as risky click trends, reporting speed, and repeat-offence reduction.
- Correlate behaviour with identity and access Join user behaviour signals to entitlement scope, privileged access, and active threat targeting so that a single event is judged in context rather than in isolation.
- Create tiered interventions for high-risk users Use targeted micro-training, policy reminders, workflow nudges, or access review triggers based on the specific risk pattern rather than sending the same remediation to everyone.
Bottom line: Human risk analytics reframes security awareness as a control problem, using behaviour and access context to reduce risk instead of measuring course completion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:38 pm
Human risk analytics marks a control shift, not a training upgrade. Completion-based awareness programmes are useful for policy distribution, but they do not establish whether behaviour has changed in a meaningful way. The article’s core argument is that security teams need measurable intervention points, not attendance records. For identity programmes, that matters because the real control boundary is the decision made at the moment of access, not the course taken weeks earlier.
A few things that frame the scale:
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams govern AI agents and non-human identities in IGA?
A: Security teams should treat AI agents and other non-human identities as first-class identities with owners, lifecycle states, and least-privilege scope. Governance should combine continuous inventory, behavioural context, and automated remediation, while keeping human approval for exceptions and high-risk access changes.
👉 Read our full editorial: Human risk analytics is shifting security from training to intervention