Topic starter
21/08/2026 4:57 pm
TL;DR: Behaviour-only human risk programmes miss the access side of exposure, and privilege creep, MFA fatigue and provisioning errors change risk even when user behaviour looks acceptable, according to Living Security Human Risk Management Platform. Human risk scoring needs IAM data so entitlement scope, not awareness metrics alone, drives review and intervention.
Editorial analysis by NHI Mgmt Group, based on content published by Living Security Human Risk Management Platform: “The Access Equation: Identity Meets Human Risk”.
Key questions
Q: Why do over-provisioned accounts raise risk even when employees behave well?
A: Because the security issue is not only intent, it is reachable scope.
Q: What are the signs that privilege creep is distorting human risk scoring?
A: Users retain access after role moves, former department permissions stay active, and access reviews keep approving entitlements that no longer match current responsibilities.
Q: What breaks when workforce risk programmes ignore identity and access context?
A: They miss the difference between low-risk behaviour and high-risk behaviour with privileged access.
Practitioner guidance
- Correlate access scope with behavioural scores Combine IAM entitlements, MFA events and behavioural telemetry into a single risk model so users are scored by both what they do and what they can reach.
- Review privilege creep by role change Run targeted recertification for employees whose access still reflects former departments, old projects or prior job functions.
- Tune MFA prompt volume and escalation paths Measure repeated push requests, approval rates and lockout patterns so fatigue becomes visible before it turns into account compromise.
Bottom line: Behaviour-only human risk programmes miss the access side of exposure and therefore understate the practical risk of many users.
Glossary terms: Human Risk Management, Privilege Creep, MFA Fatigue, Provisioning Exception
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/08/2026 5:14 pm
Identity data has become a core input to human risk management, not a supporting signal. Behavioural scoring alone cannot explain the difference between a low-risk employee and a low-risk-looking employee with high-value access. The article reflects a broader shift in security programmes: access scope determines blast radius, so identity data must sit inside the risk model. Practitioners should stop treating HRM and IAM as adjacent functions and start treating them as one control plane.
A question worth separating out:
Q: How should security teams reduce MFA fatigue risk without weakening access control?
A: Security teams should reduce MFA fatigue risk by adding number matching, device binding, prompt throttling, and clear reporting paths for suspicious requests. The goal is to make approval harder to coerce and easier to verify, while also limiting the access a single approved session can reach through least privilege and session controls.
👉 Read our full editorial: Identity data and human risk management are converging