Notifications
Clear all
Topic starter
19/08/2026 4:00 pm
TL;DR: Boards do not need more activity counts from human risk programmes; they need exposure, impact, and reduction evidence that ties behaviour to business outcomes, according to Living Security Human Risk Management Platform. That shift matters because human-driven incidents often begin with identity, workflow, or access decisions that traditional training metrics cannot explain.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: Human Risk Board Reporting: A CISO Framework
By the numbers:
- Living Security cites a 98% decrease in data-loss exposure for mature programs, attributed to the Cyentia Institute.
Questions worth separating out
Q: How should security teams report human risk to the board?
A: Security teams should report human risk as exposure, impact, and reduction, not as isolated activity metrics.
Q: Why do training completion metrics fail to describe real human risk?
A: Training completion shows participation, not whether risky behaviour declined or whether exposure was reduced.
Q: What signals show that human-risk controls are actually working?
A: Look for a falling concentration of risky behaviour, lower data-loss exposure, fewer repeat incidents, and faster remediation after targeted intervention.
Practitioner guidance
- Replace activity counts with exposure metrics Report which populations, access paths, and business processes create the highest human-driven exposure, then show how that exposure changes after intervention.
- Add identity context to behavioural reporting Segment human-risk signals by privilege level, sensitive workflow, and data proximity so the board can see why a small number of users may create disproportionate loss potential.
- Track intervention, baseline, and follow-up together For every material metric, show the starting value, the control or coaching action taken, and the post-change result.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- The full board-reporting framework and the exact metric structure used to connect exposure, intervention, and business impact.
- Living Security Human Risk Management Platform's explanation of the Human Risk Index and how it is built from behaviour, identity, and threat signals.
- The article's examples of how to translate human-risk movement into board-level decisions on investment, prioritisation, and risk reduction.
- The practical reporting cadence and Q&A structure the vendor recommends for executive reviews.
👉 Read Living Security Human Risk Management Platform's board reporting framework for human risk →
Human risk board reporting: what security teams need to show?
Explore further
19/08/2026 4:36 pm
Human risk reporting fails when boards are given activity, not exposure. Completion rates and simulation counts describe participation, but they do not show whether the enterprise is safer. Boards need to understand which identities, workflows, and business processes remain vulnerable after the activity is over. That is why human risk governance should sit closer to IAM and access control than to awareness-only programmes. The right conclusion is not more reporting, but better exposure mapping.
A question worth separating out:
Q: What should boards ask when human-risk exposure rises?
A: Boards should ask which population changed, which control or workflow failed, and what business process is now more exposed. They should also ask whether the security team can quantify reduction after the next intervention. That keeps the discussion focused on accountability, risk ownership, and decision quality.
👉 Read our full editorial: Human risk board reporting needs exposure, impact, and reduction
