Notifications
Clear all
Topic starter
20/08/2026 5:53 pm
TL;DR: Remote security training fails when programmes measure completion instead of behaviour, according to Living Security Human Risk Management Platform, and effective control depends on correlating identity, behaviour, and threat signals to target interventions before incidents occur. The governance challenge is moving human risk management from awareness content to measurable access and behaviour control.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: A Guide to the Best Security Training for Remote Teams
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams measure whether remote training is actually reducing risk?
A: Measure behaviour, not attendance.
Q: Why do remote employees create more identity risk than office-based users?
A: Remote employees often authenticate from less controlled devices and networks, then depend on cloud and SaaS access that may be broader than their day-to-day task set.
Q: What mistakes do organisations make when securing remote workers?
A: The most common mistake is treating remote access as a connectivity problem instead of an identity problem.
Practitioner guidance
- Measure behavioural outcomes, not course completion Track phishing clicks, risky file sharing, and credential hygiene changes over time so training is judged by reduced risk rather than attendance.
- Correlate identity and behaviour signals Feed authentication context, access tier, and user activity into a common risk view so high-risk identities receive prioritised intervention.
- Deploy contextual micro-training Trigger short, role-specific nudges after simulated or real risky actions, especially for users handling sensitive data or privileged access.
What's in the full article
Living Security Human Risk Management Platform's full blog covers the operational detail this post intentionally leaves for the source:
- Role-by-role training examples for remote employees working across home networks, personal devices, and shared environments
- Behavioural reporting approaches that go beyond completion rates and show whether training reduced risky actions
- Examples of AI-guided remediation workflows that assign micro-training and nudges after risky behaviour is detected
- Implementation detail on correlating employee behaviour with identity systems and threat signals
👉 Read Living Security Human Risk Management Platform's guide to security training for remote teams →
Remote security training: are your controls measuring real risk?
Explore further
20/08/2026 6:32 pm
Behaviour-based training is now a governance control, not a soft skill. Remote security programmes that only report completion rates miss the real security question: did behaviour change? In distributed environments, risk is expressed through identity use, device context, and response to social engineering, so training must operate as a measurable control surface. The broader lesson is that human risk management belongs alongside IAM and PAM as a governance function, because access alone does not explain whether a person is likely to misuse or lose it. Practitioners should treat behaviour change as a control objective, not a communications outcome.
A question worth separating out:
Q: When should training be linked to identity and access controls?
A: Link it whenever a risky action has access consequences, such as repeated phishing failures, abnormal login behaviour, privileged access misuse, or unsafe handling of sensitive data. At that point, the issue is not only knowledge, it is governance. Training, access review, and intervention should operate together so the organisation can respond before the behaviour becomes an incident.
👉 Read our full editorial: Remote security training is shifting from completion to behavior
