Topic starter
20/08/2026 5:23 pm
TL;DR: Generic awareness training often satisfies compliance without changing the high-risk behaviours that matter most, and Living Security Human Risk Management Platform argues that risk-based personalisation can align training to role, access, and behaviour. For identity and security teams, the real shift is moving from completion metrics to measurable behaviour change, especially where access and privileged workflows raise the stakes.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Hyper-Personalized Security Training: Why One-Size-Fits-All Fails”.
By the numbers:
- Security teams using the Living Security Platform reduce risky users by 50% starting from day one.
Key questions
Q: Why does generic security awareness training fail in high-risk roles?
A: Generic training fails because it ignores context.
Q: What should security teams measure instead of training completion?
A: Teams should measure whether the risky behaviour that prompted training actually declines afterwards.
Q: How can organisations personalise awareness without manual course curation?
A: Use risk signals from access context, observed behaviour, and threat exposure to trigger targeted content automatically.
Practitioner guidance
- Align training triggers to role and privilege Use access scope, job function, and department context to decide which users receive targeted training instead of applying a single annual curriculum to everyone.
- Tie interventions to observed behaviour Build escalation rules around repeated risky actions such as credential sharing, weak phishing responses, or policy violations, and generate follow-up content only when those signals appear.
- Measure post-training behaviour change Track whether the risky behaviour that prompted the intervention declines after training, and treat certificate completion as a secondary metric.
Bottom line: Generic awareness programmes can look mature while leaving the highest-risk behaviours unchanged.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:13 pm
Generic awareness is a compliance artefact, not a risk control. When training does not vary by role, access, or demonstrated behaviour, it can look effective while leaving the most consequential users untouched. That is why completion metrics routinely overstate maturity and understate exposure. Practitioners should treat one-size-fits-all awareness as a reporting layer, not a control objective.
A question worth separating out:
Q: When does personalised training create more value than a broad awareness programme?
A: Personalised training creates more value when access differences change the security stakes, such as privileged users, transaction-heavy roles, or people who repeatedly ignore risky behaviours. In those cases, broad content wastes effort on low-risk users and misses the users whose actions matter most.
👉 Read our full editorial: Hyper-personalized security training exposes the limits of generic awareness