Why do human risk programs fail when organisations begin with training instead of risk decisions?

Why This Matters for Security Teams

human risk programs often fail because “training” is treated as the objective instead of the mechanism. Security leaders may measure completion rates, quiz scores, or phishing click rates, yet still have no clear answer to a more important question: which risky decision changed, by whom, and under what control expectation? That gap matters because human risk is operational, not academic. If a programme cannot tie awareness activity to access decisions, reporting behaviour, data handling, or escalation quality, it becomes difficult to justify spend or prioritise remediation.

The most effective programmes begin with a decision such as whether users should be allowed to approve high-risk actions, bypass controls, or handle sensitive data in a given workflow. That is consistent with the outcome-focused approach in the NIST Cybersecurity Framework 2.0, which emphasises identifying desired outcomes and aligning controls to them. In practice, many security teams discover the weakness only after incidents, audit findings, or repeated exceptions have already exposed that training activity never changed the decision path.

How It Works in Practice

A workable human risk programme starts by defining the business decision that needs to improve. That might be “Can staff recognise and report suspicious payment requests?”, “Should developers approve secrets access outside normal workflow?”, or “How should privileged users respond to anomalous requests?” Once the decision is clear, teams can identify the evidence needed to support it, such as behaviour data, simulated scenarios, ticket outcomes, access logs, or reporting timeliness.

This sequence matters because it changes the design of the programme. Instead of building a generic training calendar, security and risk teams can align interventions to control expectations and observable behaviours. A practical approach often includes:

• Defining the risk decision and the owner who can act on it
• Identifying the control or policy that the decision supports
• Selecting a measurable signal, such as report quality or approval behaviour
• Testing one intervention first, rather than launching broad content campaigns
• Reviewing whether the evidence changes the decision, not just awareness

That approach fits well with NIST SP 800-53 Rev 5 Security and Privacy Controls, because controls are meant to shape behaviour and accountability, not merely inform it. It also helps security teams separate awareness from enforcement. Training can support the control environment, but it cannot replace access design, approval workflows, monitoring, or incident response procedures.

Where programmes succeed, they usually connect learning to a specific workflow and track whether human decisions improve over time. Where they fail, they measure participation in content and assume that exposure equals reduced risk. These controls tend to break down when organisations span many business units with different risk tolerances and no consistent decision owner for the behaviour being measured.

Common Variations and Edge Cases

Tighter measurement often increases operational overhead, requiring organisations to balance behavioural insight against privacy, cost, and manager bandwidth. That tradeoff is real, especially when teams want to instrument every role at once. Best practice is evolving, but there is no universal standard for this yet: some organisations focus on a single high-value workflow, while others build broad indicators across multiple departments.

Edge cases appear when the decision is influenced by factors outside the training function. For example, a team may know the right action but still bypass it because the process is too slow, the tool is cumbersome, or the approval chain is unclear. In those cases, more training can hide a control design problem. Human risk programmes also need care when using metrics in regulated or employee-facing contexts, because poorly designed scoring can create distrust or encourage box-ticking rather than better judgement.

The practical lesson is that training should follow the risk decision, not lead it. When the decision is defined first, content, simulations, nudges, and policy reinforcement can be targeted to a measurable outcome. When it is not, the programme risks becoming a communications exercise with no durable link to risk reduction.

Related resources from NHI Mgmt Group

• Why do organisations need predictive human risk management instead of annual awareness training?
• What do organisations get wrong about awareness training and human risk?
• How should security teams use human risk management instead of awareness training alone?
• Why do isolated training reports fail to reduce human risk?