Topic starter
02/08/2026 12:08 pm
TL;DR: AI-driven social engineering and persistent ransomware are outpacing security awareness training alone, according to Knowbe4, and 74% of CISOs still rank human error as their top cybersecurity risk while 87% are turning to AI-powered tools. The bigger shift is toward Human Risk Management as a layered governance model for measuring behaviour, reducing exposure, and linking people-centric controls to broader security outcomes.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “CISO's Guide: Top 4 Considerations for Human Risk Management”.
By the numbers:
- 74% of CISOs still cite human error as the top cybersecurity risk.
- 87% are turning to AI-powered products to reduce that risk.
Key questions
Q: What breaks when user risk management is based only on awareness training and perimeter controls?
A: Perimeter tools and generic training miss the context that drives real risk.
Q: Why does human error remain a top cybersecurity risk even with training in place?
A: Training improves knowledge, but it does not eliminate fatigue, opportunism or social engineering pressure.
Q: How should security teams measure whether human risk management is actually reducing risk?
A: Use outcome metrics, not just participation data.
Practitioner guidance
- Define human-risk metrics tied to real behaviour Track risky actions, repeat exposures and intervention outcomes instead of relying on course completion or simulation pass rates.
- Map human-risk signals to identity and access controls Connect phishing susceptibility, unusual privilege use and insider-risk indicators to IAM and PAM workflows so risky behaviour can trigger response.
- Replace awareness-only reporting with governance reporting Report human-risk trends to security leadership and business owners with clear ownership, escalation paths and remediation targets.
Bottom line: The article argues that human risk management is replacing awareness-only security because training alone cannot keep pace with modern social engineering and ransomware pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:12 pm
Human risk management is becoming the governance layer that awareness training never was. Training can influence knowledge, but it does not govern exposure, behavioural drift or repeated decision failure. The article reflects a broader shift in security programmes from education-led signalling to measurable control design, which is the right direction for organisations trying to reduce people-driven risk.
A question worth separating out:
Q: How should security teams use human risk management instead of awareness training alone?
A: Use awareness training for baseline education and human risk management for ongoing intervention. The practical difference is that HRM should detect risky behaviour, coach the user at the point of action, and feed repeat issues back into governance workflows. If it cannot change outcomes, it is only reporting activity, not reducing risk.
👉 Read our full editorial: Human risk management is replacing awareness-only security models