What is the best way to measure human risk reduction?

Measure Behaviour Change, Not Activity Volume

The best measurement starts with observed behaviour because risk only drops when people actually change what they do. Track a small set of behaviours that create exposure, then compare them to a baseline so you can see whether the control is reducing real-world risk rather than just producing more training completions.

Useful measures are the ones tied to incidents and near-misses, such as phishing susceptibility, unsafe data handling, privilege misuse, MFA adoption, and repeat policy breaches. Those signals are stronger than attendance or quiz scores because they reflect whether the risky action is still happening after intervention.

A good measurement set is stable enough to compare over time, but specific enough to detect change. If you redefine the metric every quarter, you lose trend value; if you use only one metric, you miss whether improvement in one area is offset by failure in another.

Build a Baseline That Can Show Real Reduction

Human risk reduction only means something if you can compare before and after. Establish a baseline from the same population, the same control environment, and the same observation window, then watch for movement in both the rate and the severity of risky behaviours.

Where possible, use control groups or staggered rollout so you can separate programme effect from background noise, seasonal spikes, new tooling, or reporting changes. That matters because a drop in one metric can be caused by lower visibility, not lower risk.

Good baselines also account for repeat offenders and high-risk roles. A general enterprise average can hide concentration in teams that handle sensitive data, approvals, finance workflows, or privileged access, where a small number of people can create outsized exposure.

Use Metrics That Map to Exposure and Intervention Quality

The best metrics tell you whether the intervention worked and where it failed. If phishing simulations improve but report rates stay flat, the programme may be teaching recognition without improving response. If MFA adoption rises but risky access patterns remain, the control may be enabled but not actually reducing privilege abuse.

Measures should also distinguish between leading indicators and outcome indicators. Leading indicators show whether people are behaving more safely now; outcome indicators show whether that behaviour is translating into fewer security events later. Both matter, but only leading indicators let you intervene early.

For this topic, the most useful operational view is a short scorecard that links behaviour, context, and trend. That gives you a defensible way to explain whether risk is falling, holding steady, or shifting into a different form.

Risk and Threat Considerations

Human risk programmes can look successful while exposure stays the same or even worsens. The main failure mode is measuring training completion or quiz performance instead of behaviour, which creates a false sense of control and can hide persistent phishing susceptibility, unsafe data handling, or privilege misuse.

Failure mechanism: If the metric is disconnected from observable behaviour, leaders may optimise for participation rather than reduction in risky actions, and the same users can continue to create the same exposure.

Impact: Teams may underinvest in the controls that actually change behaviour, miss repeated policy breaches, and fail to spot concentrated risk in high-impact roles or groups.

Practitioner Guidance

What to prioritise: Start with the few behaviours that create the most business exposure, then measure them consistently over time. For most environments, phishing report rate, repeat unsafe actions, privilege misuse, and MFA adoption are more decision-useful than broad awareness survey scores.

What to verify: Make sure the signal is observable, repeatable, and attributable to the intervention. If the metric moves, be able to explain whether it changed because people behaved differently, because the sample changed, or because detection became weaker or stronger.

Decision rule: If a measure does not change what you would fund, fix, or escalate, it is probably not the right measure. Treat any metric that can be improved without lowering exposure as a reporting metric, not a risk-reduction metric.

Practitioner takeaway: Human risk reduction should be judged by less risky behaviour in the environment, not by evidence that people attended training or passed a test.

Related resources from NHI Mgmt Group

• How should security teams measure human risk in a way that changes access decisions?
• Why do non-human identities change the way IAM teams should think about risk?
• How should security teams measure human risk in phishing simulations?
• What breaks when access review programmes measure completion instead of risk reduction?