Topic starter
21/08/2026 4:58 pm
TL;DR: Generic phishing tests miss real exposure because human risk varies by behavior, identity and access, and threat context, according to Living Security Human Risk Management Platform; Cyentia Institute research cited in the article reports a 50% reduction in risky users and a 98% drop in data-loss exposure. The control problem is no longer awareness alone, but governance that ties intervention to live identity and risk signals.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “Adaptive Phishing Training: Personalize Intervention by Risk”.
Key questions
Q: How should security teams design phishing training around user risk instead of fixed schedules?
A: Build the programme around user-specific risk signals, including behavior, identity and access, and current threat intelligence.
Q: Why do generic phishing tests fail for high-risk users?
A: Generic tests fail because they treat all users as though the same mistake has the same consequence.
Q: What are the signs that phishing awareness is not reducing real risk?
A: The clearest signs are stable or rising susceptibility scores, repeat failures on realistic simulations, and little difference between people who completed training and those who did not.
Practitioner guidance
- Define risk-triggered intervention rules Set rules that trigger training based on role, access scope, behavior signals, and current threat context rather than on a fixed monthly cadence.
- Join phishing telemetry to access data Correlate click, report, and failure signals with identity and access attributes so the programme can prioritize users whose mistakes would create material exposure.
- Segment training by business role Use role-based paths for finance, IT, executives, and other sensitive functions so simulations reflect the attacks each group is likely to face.
Bottom line: Adaptive phishing training reframes awareness as a governance control by linking intervention to behavior, identity and access, and threat context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:14 pm
Adaptive phishing training is really a governance control, not an awareness exercise. Once intervention is driven by behaviour, identity and access, and current threat context, the programme is deciding where human risk becomes material. That moves the control closer to IAM and privileged access governance than to generic education. The practitioner conclusion is that human risk programmes should be managed as part of the access and exposure model, not as a separate training calendar.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should human risk management sit inside IAM and GRC programmes?
A: Yes, because human behaviour directly affects access approvals, MFA use, password handling, and exception requests. When HRM is isolated, teams can see risky behaviour but cannot change the access controls that shape it. Integrated governance makes the programme more actionable and much easier to prove.
👉 Read our full editorial: Adaptive phishing training exposes the gap in human risk governance