Human risk management: what does measurable behavior change look like?

TL;DR: Enterprise human risk management should treat employee behavior as a continuously governed security control, not an annual awareness exercise, according to Adaptive Security, because completion rates miss the actions that drive phishing, BEC, AI misuse, and reporting failures. The operating model shifts from training-only programs to measurable intervention, privacy governance, and business-impact prioritisation.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Human Risk Management for Enterprise: Framework, Metrics, and a Practical 90-Day Plan for Measurable Behavior Change”.

By the numbers:

• According to Sumsub's 2025-2026 Identity Fraud Report, sophisticated fraud surged 180% YoY including deepfakes, synthetics, and telemetry tampering.
• According to IBM's Cost of a Data Breach Report 2026, AI-driven cyberattacks increased 56% and added an average of $1 million to the cost of a breach.

Key questions

Q: How should organisations handle human risk management when training completion is not changing behaviour?

A: They should treat completion data as a weak proxy and shift to outcome metrics such as reporting speed, reporting accuracy, repeat susceptibility, and risky data-sharing events.

Q: Why do behavioural risk programmes need privacy governance before they scale?

A: Because the same telemetry that reveals unsafe behaviour can also suppress reporting if employees think they are being watched rather than supported.

Q: What are the signs that a human risk score is being misused?

A: A score is being misused when it is treated as a verdict, used without explanation, or drives broad punishment instead of targeted coaching and control redesign.

Practitioner guidance

• Define the behavioural scope before collecting telemetry Inventory the workflows, channels, and populations that actually create exposure, including executives, contractors, privileged users, and AI-assisted work.
• Normalize signals into a single risk model Map phishing, reporting, access context, and AI data-sharing events into one event model so you can compare outcomes across channels and roles.
• Build privacy controls before scaling monitoring Set purpose, retention, access, and appeal rules before using behavioural telemetry operationally.

Bottom line: Human risk management is most effective when it is governed as a continuous control loop rather than treated as annual training.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →