What should teams track to measure human risk over time?

What to measure if you want trend, not noise

Human risk tracking works best when teams measure behaviour over time, not single events. Repeated incidents, the weight of privileged actions, and recurrence after intervention show whether risk is isolated, persistent or spreading across accounts, devices and access paths. That gives you a better read on control effectiveness than a one-off click rate or training completion score.

Trend matters because the same user can move between low and high risk states. A rising pattern across multiple behaviours is usually more meaningful than any one incident, especially when it shows up in privileged workflows or across several systems. Teams should therefore treat concentration as a signal of where risk is becoming operationally important, not just where it happened first.

Which patterns matter most in a human risk score

The most useful patterns are those that combine frequency, severity and persistence. Frequent low-severity events can still matter if they cluster around the same person, team or workflow. A smaller number of high-severity actions, especially those involving elevated access or sensitive processes, should usually carry more weight than routine mistakes.

It is also important to distinguish a temporary spike from a stable pattern. If the same risky behaviour reappears after remediation, the issue is not just awareness, it may be workflow design, poor habit change, weak supervision or an exception that has become normalised. For that reason, recurrence after coaching or technical control changes is one of the clearest indicators that risk is not yet under control.

How to interpret concentration across users, devices and access paths

Concentration tells you whether risk is broad-based or tied to a few accounts, devices or access routes. If the same risky events keep appearing through the same browser, endpoint, admin path or integration, the control problem may be localised. If they appear across many paths, the issue is more likely to be behavioural, procedural or cultural.

This is why teams should compare individual behaviour against group baselines and role expectations. A low-volume user can still be high risk if their actions are unusually severe for their role, while a high-volume user may look noisy but not materially risky if the events are low consequence and quickly corrected. The measurement goal is to identify exposure that is building, not simply to rank people by incident count.

Risk and Threat Considerations

Human risk becomes more serious when repeated behaviour creates predictable exposure, especially around privileged actions or users who ignore remediation. Attackers and fraudsters benefit from repetition because it reveals weak habits, weak controls or poorly enforced follow-up, and it can create a path from occasional error to sustained compromise.

Failure mechanism: Teams miss the difference between isolated mistakes and recurring behaviour, so they understate the users, workflows or access paths that are steadily becoming easier to exploit.

Impact: The organisation can end up with lingering exposure in the same accounts or access paths, making later misuse, privilege abuse or repeated policy failure more likely and harder to detect.

Practitioner Guidance

What to prioritise: Track recurrence first, then severity, then concentration. A repeat pattern after remediation should be treated as stronger evidence than a single incident, even if the first incident looked minor.

What to verify: Make sure the metric distinguishes user behaviour from environment noise. If the same behaviour appears only in one team, device class or access route, investigate whether the control gap is local or systemic before drawing conclusions about the person.

What good looks like: A healthy programme shows declining recurrence, fewer high-severity privileged events, and shrinking concentration in the same risky accounts or paths over successive measurement cycles.

Practitioner takeaway: The best human-risk metrics are the ones that show whether remediation actually changes behaviour, because the real warning sign is persistence, not the first mistake.

Related resources from NHI Mgmt Group

• How should security teams measure mobile application risk when findings change over time?
• How should critical infrastructure teams measure cybersecurity risk in a way that supports real progress over time?
• Why do AI agent accounts create more risk than human accounts when access changes over time?
• When does just-in-time access reduce risk for non-human identities?