Why do strong communication and empathy matter for security leaders managing human risk?

Why Security Leaders Need Communication and Empathy to Reduce Human Risk

human risk is rarely reduced by awareness alone. Security leaders have to shape decisions in environments where staff are busy, overloaded, and often translating vague warnings into real work. Clear communication helps employees understand what matters and what action to take. Empathy matters because people are more likely to report mistakes, ask questions, and follow guidance when they do not feel blamed for ordinary errors. That trust is central to sustainable security culture.

This is why guidance from the NIST Cybersecurity Framework 2.0 and NHIMG’s Top 10 NHI Issues both emphasise governance that is understandable and actionable, not just technically correct. For leaders, the practical task is to make security decisions legible to non-specialists without diluting the risk. In practice, many teams discover this only after repeated policy exceptions, delayed reporting, or avoidable incidents reveal that the message never landed in the first place.

How Communication Changes Security Behavior in Practice

Strong communication turns security from abstract policy into day-to-day behavior. The most effective leaders translate risk into plain language, connect it to specific roles, and explain the consequence of inaction in business terms. That approach works better than generic reminders because people need to know what to do, when to do it, and why it matters in their workflow.

Empathy strengthens that message by reducing defensiveness. When staff feel respected, they are more willing to surface weak signals such as suspicious emails, accidental data exposure, or a control that is too cumbersome to follow. A leader who listens to friction points can often remove the real cause of non-compliance: unclear steps, poor timing, or process overload.

• Use role-based examples instead of one-size-fits-all warnings.
• Replace blame with fast reporting paths and clear escalation routes.
• Ask where controls create friction, then adjust training and process design.
• Measure whether people understood the message, not just whether they attended the session.

For teams building a broader human-risk programme, NHIMG’s NHI Lifecycle Management Guide is useful because it shows how disciplined ownership and clear accountability reduce confusion across the full identity lifecycle. Current guidance suggests that communication is most effective when it is repeated, specific, and tied to observable actions rather than awareness slogans. These controls tend to break down in large organisations with highly fragmented teams and inconsistent manager support because the message becomes diluted before it reaches the point of action.

Where Empathy and Clear Messaging Break Down

Tighter security messaging often increases coordination overhead, requiring organisations to balance speed against consistency. That tradeoff is especially visible when leaders support a mixed workforce, outsourced operations, or time-sensitive business units that cannot absorb long explanations or slow approval cycles.

There is no universal standard for this yet, but best practice is evolving toward communication that is frequent, contextual, and measured against behavior change rather than vanity metrics. That means accepting that different audiences need different language. Executives want risk impact and accountability. Frontline staff want clarity and low-friction actions. Managers need guidance they can reinforce without improvising.

Empathy also has limits. It is not a substitute for enforcement, and it should not blur accountability when repeated risky behavior persists. The strongest programmes combine respectful messaging with firm escalation, because trust works best when people know the rules are real. NHIMG’s 2024 ESG Report: Managing Non-Human Identities shows that compromise and weak governance often persist when organisations do not operationalise identity discipline, reinforcing the need for leadership that is both human-centered and control-oriented. The hardest failures usually appear when leaders assume staff understood the risk because they received the communication, rather than because they changed what they actually do.

Related resources from NHI Mgmt Group

• Why do non-human identities increase zero trust risk?
• How should security teams decide whether JIT access is safe for non-human identities?
• Why do human-risk programmes matter if email security tools already block threats?
• How do security leaders measure whether a human risk management platform is actually working?