Topic starter
02/08/2026 11:54 am
TL;DR: Human risk management is framed here as a move beyond awareness training toward measurable behavior change, with the DEEP framework, four personas, and integration guidance intended to unify existing security controls around people-focused risk reduction, according to KnowBe4. The core issue is that completion metrics do not prove reduced exposure, so governance must track behavior, not participation.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper A Practical Guide to Human Risk Management - Cutting Through the Confusion”.
Key questions
Q: How should security teams measure human risk programmes beyond training completion?
A: Security teams should measure whether the programme changes behaviour, reduces repeat risky actions, and lowers exposure over time.
A: Completion rates measure activity, not impact.
Q: What are the best practices for persona-based human risk programmes?
A: Use personas to segment exposure, tailor controls to workflow, and avoid one-size-fits-all messaging.
Practitioner guidance
- Define behaviour-based success metrics Replace training completion as the primary success measure with observable indicators of safer action, such as reduced risky responses, fewer policy exceptions, or lower repeat-offence rates.
- Segment users by risk persona Group employees by role, exposure, and likely failure modes so interventions target the behaviours that matter most in each workflow.
- Map controls to the DEEP model Assign each HRM initiative to Defend, Educate, Empower, or Protect so leaders can see which parts of the programme create prevention versus behaviour change.
Bottom line: Human risk management is moving from awareness outputs to behaviour outcomes, which changes how security teams should judge effectiveness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Behaviour, not completion, is the real control surface for human risk. Security teams can prove that training was delivered long before they can prove that risky conduct changed. That distinction matters because governance based on participation creates false confidence, especially where user behaviour intersects with access, data handling, and social engineering exposure. The practical conclusion is that human risk management must be measured where decisions are made, not where courses are finished.
A question worth separating out:
Q: How can security teams embed human risk management into existing governance?
A: Connect HRM reporting to the same governance forums that already cover access, awareness, and policy enforcement. That keeps human-risk evidence alongside other security signals, which makes it easier to prioritise interventions and compare behaviour change with broader risk trends.
👉 Read our full editorial: Human risk management is shifting from awareness to measurable behavior