Human risk analytics: what it means for identity and access teams

TL;DR: Traditional security awareness still leaves 70% to 90% of breaches involving people, according to Living Security Human Risk Management Platform, because completion-based training does not measure or change behaviour; modern human risk analytics instead correlates behaviour, identity, and threat signals to predict and reduce risk. The governance shift is from awareness as compliance to intervention as control, including the human side of NHI and AI-augmented access.

NHIMG editorial — based on content published by Living Security Human Risk Management Platform: How to Choose a Human Risk Analytics Platform

By the numbers:

• 70% to 90% of breaches still involve a human element.
• The platform claims to autonomously handle 60 to 80 percent of routine remediation tasks.

Questions worth separating out

Q: How should security teams use human risk analytics in IAM programmes?

A: Security teams should use human risk analytics to prioritise interventions where behaviour and access intersect.

Q: Why do completion-based awareness programmes fail to reduce real risk?

A: They fail because completion measures exposure to content, not change in conduct.

Q: What breaks when identity data is not included in human risk scoring?

A: Without identity data, the programme cannot tell whether a risky act belongs to a low-impact user or someone with privileged access to sensitive systems.

Practitioner guidance

• Correlate behavioural risk with identity context Connect phishing, reporting, and risky-action telemetry to IAM and PAM data so the highest-risk users are the ones with the most sensitive access.
• Redefine success metrics for awareness Stop using course completion as the main programme metric and track behaviour change, exception rates, and follow-through on targeted interventions.
• Set approval boundaries for automated remediation Define which interventions can be auto-enrolled and which require analyst approval, especially when they affect privileged users or shared accounts.

What's in the full article

Living Security Human Risk Management Platform's full article covers the operational detail this post intentionally leaves for the source:

• The platform evaluation checklist for behaviour, identity, and threat correlation
• The article's practical examples of predictive interventions and autonomous remediation
• The discussion of AI-native human risk management and its workflow implications
• The FAQ-style guidance on measuring behaviour change instead of course completion

👉 Read Living Security Human Risk Management Platform's analysis of human risk analytics platforms →

Human risk analytics: what it means for identity and access teams?

Explore further

View Full Forum →  |  NHI Foundation Course →