Topic starter
02/08/2026 12:08 pm
TL;DR: Human risk management is gaining ground because training alone cannot keep pace with AI-driven social engineering and persistent ransomware, according to Knowbe4. Security programmes now need behaviour signals, not just completion data, to judge whether human risk is falling.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “CISO's Guide: Top 4 Considerations for Human Risk Management”.
By the numbers:
- 74% of CISOs still cite human error as the top cybersecurity risk.
- 87% are turning to AI-powered products to reduce that risk.
Key questions
Q: Why does human error remain a top cybersecurity risk even with training in place?
A: Training improves knowledge, but it does not eliminate fatigue, opportunism or social engineering pressure.
Q: How should security teams measure whether human risk management is actually reducing risk?
A: Use outcome metrics, not just participation data.
Q: What breaks when user risk management is based only on awareness training and perimeter controls?
A: Perimeter tools and generic training miss the context that drives real risk.
Practitioner guidance
- Define human-risk metrics tied to real behaviour Track risky actions, repeat exposures and intervention outcomes instead of relying on course completion or simulation pass rates.
- Map human-risk signals to identity and access controls Connect phishing susceptibility, unusual privilege use and insider-risk indicators to IAM and PAM workflows so risky behaviour can trigger response.
- Replace awareness-only reporting with governance reporting Report human-risk trends to security leadership and business owners with clear ownership, escalation paths and remediation targets.
Bottom line: The article argues that human risk management is replacing awareness-only security because training alone cannot keep pace with modern social engineering and ransomware pressure.
Glossary terms: Human Risk Management, Security Awareness Training, Behavioural Signal, Insider Risk Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:12 pm
Human risk management is becoming the governance layer that awareness training never was. Training can influence knowledge, but it does not govern exposure, behavioural drift or repeated decision failure. The article reflects a broader shift in security programmes from education-led signalling to measurable control design, which is the right direction for organisations trying to reduce people-driven risk.
A question worth separating out:
Q: How should security teams use human risk management instead of awareness training alone?
A: Use awareness training for baseline education and human risk management for ongoing intervention. The practical difference is that HRM should detect risky behaviour, coach the user at the point of action, and feed repeat issues back into governance workflows. If it cannot change outcomes, it is only reporting activity, not reducing risk.
👉 Read our full editorial: Human risk management is replacing awareness-only security models
This post was modified 2 days ago by NHI Mgmt Group