Topic starter
02/08/2026 12:08 pm
TL;DR: Human factors appear in 68% to 90% of security breaches, and Knowbe4 argues that AI-amplified social engineering is widening the gap between awareness training and continuous human-risk control. Identity and privilege controls need to track behavioural risk so governance can target the people most likely to cause damage.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “A Strategic Framework for Human Risk Management: What is HRM and Why Do Organizations Need It?”.
By the numbers:
- The human element remains a factor in 68% to 90% of security breaches.
Key questions
Q: Why does AI-assisted social engineering increase risk for identity security programs?
A: AI-assisted social engineering increases risk because it lowers the cost of tailored manipulation while making messages and conversations look more authentic.
Q: How can organisations tell if human-risk management is working?
A: Look for downward trends in behavioural susceptibility, improved performance in realistic simulations, and better targeting of coaching to higher-risk groups.
Q: What breaks when human risk management is only treated as training?
A: Training alone breaks because it changes knowledge, not exposure.
Practitioner guidance
- Define human-risk metrics that matter Track susceptibility, reporting speed, repeat exposure, and intervention effectiveness instead of relying on training completion alone.
- Bind HRM to IAM and PAM workflows Use identity and privileged-access controls to limit what a mistaken approval, disclosure, or click can unlock.
- Segment interventions by role and exposure Prioritise high-risk roles, frequent approvers, and users with elevated access when tailoring simulations, coaching, and controls.
Bottom line: Human error remains a material breach driver, but the governance failure is treating that exposure as a one-off awareness issue instead of an ongoing control problem.
Glossary terms: Human Risk Management, AI-amplified social engineering, Behavior-Based Risk Model, Human-Risk Control Plane
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
Human risk has become a governance problem, not a training problem. The article is right to move the discussion away from blame and toward control design. Security teams still over-rely on awareness completion as a proxy for resilience, even though modern attacks succeed by exploiting time pressure, context, and trust. Practitioner conclusion: treat human-risk reduction as an operating model with metrics, ownership, and continuous review.
A few things that frame the scale:
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams connect red team results to IAM and PAM governance?
A: Any exploit path that uses leaked credentials, overprivileged access, or lateral movement should be routed to IAM and PAM owners as a control issue, not just an application defect. That ensures identity, privilege, and access scope are remediated alongside code and network fixes.
👉 Read our full editorial: Human risk management is closing the gap in breach prevention