Topic starter
02/08/2026 12:08 pm
TL;DR: Human factors contribute to 68% to 90% of security breaches, and KnowBe4’s whitepaper argues that Human Risk Management shifts organisations from awareness campaigns to continuous identification, measurement, and mitigation of people-related risk. The strategic question is no longer whether users make mistakes, but whether security programmes can operationalise human-risk controls fast enough to keep pace with AI-amplified social engineering.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “A Strategic Framework for Human Risk Management: What is HRM and Why Do Organizations Need It?”.
By the numbers:
- The human element remains a factor in 68% to 90% of security breaches.
Key questions
Q: What breaks when human risk management is only treated as training?
A: Training alone breaks because it changes knowledge, not exposure.
Q: Why does AI-assisted social engineering increase risk for identity security programs?
A: AI-assisted social engineering increases risk because it lowers the cost of tailored manipulation while making messages and conversations look more authentic.
Q: How can organisations tell if human-risk management is working?
A: Look for downward trends in behavioural susceptibility, improved performance in realistic simulations, and better targeting of coaching to higher-risk groups.
Practitioner guidance
- Define human-risk metrics that matter Track susceptibility, reporting speed, repeat exposure, and intervention effectiveness instead of relying on training completion alone.
- Bind HRM to IAM and PAM workflows Use identity and privileged-access controls to limit what a mistaken approval, disclosure, or click can unlock.
- Segment interventions by role and exposure Prioritise high-risk roles, frequent approvers, and users with elevated access when tailoring simulations, coaching, and controls.
Bottom line: Human error remains a material breach driver, but the governance failure is treating that exposure as a one-off awareness issue instead of an ongoing control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
Human risk has become a governance problem, not a training problem. The article is right to move the discussion away from blame and toward control design. Security teams still over-rely on awareness completion as a proxy for resilience, even though modern attacks succeed by exploiting time pressure, context, and trust. Practitioner conclusion: treat human-risk reduction as an operating model with metrics, ownership, and continuous review.
A few things that frame the scale:
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams connect red team results to IAM and PAM governance?
A: Any exploit path that uses leaked credentials, overprivileged access, or lateral movement should be routed to IAM and PAM owners as a control issue, not just an application defect. That ensures identity, privilege, and access scope are remediated alongside code and network fixes.
👉 Read our full editorial: Human risk management is closing the gap in breach prevention