Topic starter
02/08/2026 11:54 am
TL;DR: Behaviour change, not training completion, is the metric KnowBe4 argues human risk management should use to judge whether people-focused controls are working. Human risk governance has to track repeat risky actions, segment exposure and intervention effects, not just participation.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper A Practical Guide to Human Risk Management - Cutting Through the Confusion”.
Key questions
A: Completion rates measure activity, not impact.
Q: What are the best practices for persona-based human risk programmes?
A: Use personas to segment exposure, tailor controls to workflow, and avoid one-size-fits-all messaging.
Q: How should security teams measure human risk programmes beyond training completion?
A: Security teams should measure whether the programme changes behaviour, reduces repeat risky actions, and lowers exposure over time.
Practitioner guidance
- Define behaviour-based success metrics Replace training completion as the primary success measure with observable indicators of safer action, such as reduced risky responses, fewer policy exceptions, or lower repeat-offence rates.
- Segment users by risk persona Group employees by role, exposure, and likely failure modes so interventions target the behaviours that matter most in each workflow.
- Map controls to the DEEP model Assign each HRM initiative to Defend, Educate, Empower, or Protect so leaders can see which parts of the programme create prevention versus behaviour change.
Bottom line: Human risk management is moving from awareness outputs to behaviour outcomes, which changes how security teams should judge effectiveness.
Glossary terms: Human Risk Management, Behaviour-Based Risk Governance, Persona-Based Controls, Completion Metrics
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:03 pm
Behaviour, not completion, is the real control surface for human risk. Security teams can prove that training was delivered long before they can prove that risky conduct changed. That distinction matters because governance based on participation creates false confidence, especially where user behaviour intersects with access, data handling, and social engineering exposure. The practical conclusion is that human risk management must be measured where decisions are made, not where courses are finished.
A question worth separating out:
Q: How can security teams embed human risk management into existing governance?
A: Connect HRM reporting to the same governance forums that already cover access, awareness, and policy enforcement. That keeps human-risk evidence alongside other security signals, which makes it easier to prioritise interventions and compare behaviour change with broader risk trends.
👉 Read our full editorial: Human risk management is shifting from awareness to measurable behavior