Topic starter
11/11/2026 6:01 pm
TL;DR: Human cyber risk stays trapped in organisational silos, MetaCompliance reports from a survey of 200 CISOs across the UK, France, Germany and Sweden. Security programmes need cross-functional ownership if they are going to change behaviour rather than just track training activity.
Editorial analysis by NHI Mgmt Group, based on content published by MetaCompliance: “Managing Human Cyber Risk: The Cross-Functional Breakdown No One Talks About”.
Key questions
Q: Why do awareness metrics fail to prove behaviour change?
A: Awareness metrics fail to prove behaviour change because they usually measure participation, recall, or training completion, not whether people actually avoid risky actions.
Q: What is the best way to measure human risk reduction?
A: The best way to measure human risk reduction is to track changes in observed risky behaviour, not training volume or quiz scores.
Q: Who should be accountable for human cyber risk in an organisation?
A: Accountability should sit with the risk owners who control access, workflow design, and user exposure, not with awareness teams alone.
Practitioner guidance
- Define shared ownership for human risk Assign named responsibility across Security, HR, IT, Compliance and leadership for the employee lifecycle, including onboarding, access changes, communications and escalation.
- Replace activity metrics with behaviour metrics Track repeat risky actions, exception rates, escalation quality and role-based risk concentration instead of relying on completion and simulation scores alone.
- Embed secure behaviour into onboarding and management routines Make security expectations part of employee induction, manager check-ins and role transitions so secure decisions are reinforced where work actually happens.
Bottom line: Human cyber risk persists when no single function owns the behaviour, process and accountability chain from onboarding through day-to-day work.
Glossary terms: Human Cyber Risk, Security Awareness Programme, Human Risk Management, Behavioural Metrics
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Human cyber risk is a business control problem, not a security training problem. The evidence in MetaCompliance's survey points to a governance gap: organisations recognise the risk, but they distribute the responsibility across functions without assigning end-to-end ownership. That structure creates activity, but not accountability. The practical conclusion is that human risk should be governed like any other enterprise risk, with clear ownership, decision rights and measurable outcomes.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can leadership keep human risk programmes funded?
A: Leadership keeps human risk programmes funded by tying them to measurable loss reduction, regulatory exposure, and operational resilience. Use clear metrics such as fewer account takeovers, reduced privileged access misuse, lower phishing success, and fewer high-risk exceptions, then report trends in business terms that show avoided incidents and control effectiveness.
👉 Read our full editorial: Shared ownership is key to reducing human cyber risk effectively