Human Risk and Security Culture Briefing for Boards

Most organisations still spend on annual awareness training and click-rate reports while attackers succeed by phoning the help desk, pressuring a finance clerk or tricking a user into approving a login, and boards rarely see evidence of whether behaviour is actually changing. This briefing is for board members, chief executives, audit and risk committees and the CISOs who report to them. It explains human risk in business terms, why culture is now an explicit governance expectation in the UK and the US, the questions directors should ask, what good looks like, where money is best spent and how to measure it. It stays at board level. The operating detail is in the Human Risk Management Programme Guide and the Security Culture Measurement Guide.

The risk in one paragraph

People are part of almost every serious incident: they receive the phishing email, answer the impersonation call, approve the push prompt, reuse a password, paste data into an unapproved AI tool or delay reporting a mistake because they fear the consequences. Human risk is the likelihood that ordinary, predictable human behaviour opens the door, and security culture is the set of norms that decides whether people report early, follow verification steps under pressure and feel able to challenge a senior colleague. Training alone does not reduce this risk. It falls when the organisation designs processes and technology that tolerate human error, makes the secure way the easy way, and leaders reward reporting rather than punish clicks. A weak culture turns a single deceived employee into a breach; a strong one turns the same employee into the earliest warning the organisation gets.

Why this is a board-level issue now

Phishing is still the most common attack: in the UK government's Cyber Security Breaches Survey 2025, 43% of businesses and 30% of charities reported a breach or attack in the previous 12 months, and phishing was the most prevalent type for 85% of those businesses and 86% of those charities.
The costliest recent attacks started with a conversation: according to the reported accounts, attackers impersonated staff and third-party users to get help desks to reset credentials at Marks and Spencer, the Co-op and MGM Resorts. None of these depended on a technical exploit; each depended on a process that trusted a voice on the phone.
Culture is now written into governance guidance: NIST Cybersecurity Framework 2.0 states in GV.RR-01 that organisational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical and continually improving. The UK Cyber Governance Code of Practice (April 2025) has "People" as one of its principles, supported by the NCSC Board Toolkit module on developing a positive cyber security culture.
Leaders are named as the cause and the cure: the NCSC's cyber security culture principles (June 2025) make leadership accountability one of six principles, alongside openness, social norms and clear guidance. Directors cannot delegate culture to the security team.
Boards are thin on ownership: the same 2025 survey found only 27% of businesses had a board member with explicit responsibility for cyber security, and only 19% of businesses had provided staff training or awareness raising in the last year (76% of large businesses).
AI is raising the quality of deception: convincing emails, cloned voices and fake video make "spot the mistakes" training less useful. Verification processes, not individual vigilance, have to carry the load. See the Deepfake and Payment Fraud Executive Briefing.

From awareness to human risk management

The shift directors should look for is from activity (courses completed) to outcomes (risky behaviour reduced and incidents reported quickly). The table shows what changes.

Dimension	Compliance-led awareness	Human risk management
Goal	Everyone completes the annual course	Specific risky behaviours fall in the groups where they matter most
Audience	One course for all staff	Targeted by role: finance, help desk, executives and assistants, developers, administrators
Main metric	Completion rate and phishing click rate	Reporting rate, time to report, verification followed, repeat behaviour
Response to a click	Mandatory retraining, sometimes named and shamed	Thank the reporter, fix the process or control that let it through
Where controls sit	Mostly in people's heads	In processes and systems: phishing-resistant MFA, payment call-backs, help desk identity checks
Board reporting	Percentage trained	Trend in risky behaviour, reporting culture and incidents with a human factor
Owner	Security awareness lead	Executive sponsor with HR, finance and operations sharing the outcome

The NCSC's phishing guidance makes the same point: defend in four layers (make it hard for attackers to reach users, help users identify and report, limit the damage when someone is caught, respond quickly), and do not over-invest in training at the expense of the other three. It also warns that blame does not work and that fear of consequences stops people reporting, which removes an early warning signal.

Five questions for the board to ask

Which human behaviours are most likely to cause us a serious incident, and in which teams? A credible answer names a short list (help desk resets, payment changes, MFA approvals, data sharing, use of unapproved AI) and the roles exposed, not "everyone needs to be more careful".
If a member of staff clicks a malicious link today, how quickly do we find out, and what happens to them? The right answer is minutes, through an easy report button, and the person is thanked. If the honest answer is "they get retrained and their manager is told", reporting is being suppressed.
Which of our critical processes would still be safe if one person were fully deceived? Payments, password and MFA resets, supplier bank detail changes and privileged access should need a second person or an out-of-band check that the attacker cannot control.
How do we know our culture is improving, rather than our training completion? Ask for trend data on reporting rates, time to report, verification compliance and survey results, compared with the previous year.
What do we, as leaders, model? Do executives follow the same verification steps, accept being challenged by junior staff and avoid asking for exceptions? Seniority exceptions are the pattern attackers exploit.

Red flags in management answers

Click rate as the headline metric: click rates move with the difficulty of the simulation and say little about real risk. Reporting rate and time to report are more meaningful.
"Our people are our weakest link": a framing that blames staff usually means processes and controls have not been designed for human error.
Punitive consequences for simulations: disciplinary action or public league tables for clicking discourage the reporting the organisation needs.
No targeted programme for high-risk roles: the help desk, finance and executive assistants get the same generic course as everyone else.
Exceptions for senior people: executives exempt from MFA, verification call-backs or phishing simulations.
Culture claimed but not measured: no survey, no baseline and no trend, only assurance that "the culture is strong".

What good looks like

Area	Good practice	Evidence the board can ask for
Leadership	A named executive sponsor; leaders visibly follow and endorse the rules, including being challenged	Sponsor in the risk register; executive participation in simulations and exercises
Reporting	One-click reporting, fast feedback to the reporter, explicit no-blame policy for honest mistakes	Reporting rate, median time to first report on real and simulated campaigns
Process design	Out-of-band verification for payments, bank detail changes and help desk resets; dual approval for high-value actions	Documented procedures, test results from authorised impersonation exercises
Technical safety net	Phishing-resistant MFA for administrators and remote access, email authentication, least privilege	MFA coverage by method; DMARC policy status; standing admin count
Targeted learning	Role-based training for high-risk groups, short and frequent, linked to real incidents	Coverage of high-risk roles; behaviour change in those groups
HR integration	Security in joining, moving and leaving processes, role design and performance conversations (CSF GV.RR-04)	Leaver access removal times; security objectives in role descriptions
Measurement	Annual culture survey plus behavioural data, reported as trends to the board	Baseline, target and trend for 4 to 6 indicators

Two things are worth stressing. First, good culture is the product of good process: staff cannot verify a supplier's bank change by phone if the procedure does not exist or the approval system lets one person bypass it. Second, culture extends to contractors, outsourced help desks and suppliers' staff who act on the organisation's behalf, which is where several 2025 incidents began.

Where identity fits

Many human-factor incidents end in an identity being taken over: a password reset, an MFA device registered by an attacker, or a session token stolen through a fake login page. That is why the most effective human risk investments are often identity controls that do not rely on the user noticing anything. Phishing-resistant MFA (FIDO2 and passkeys) stops a deceived user from handing a usable login to a fake site; CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication. Strong identity checks at the help desk protect the reset process. The same discipline applies to non-human identities: staff who paste API keys into chat or code, or grant third-party apps broad OAuth access, create risk that awareness alone will not catch. See the Phishing-Resistant MFA Guide and the Vishing and Help Desk Social Engineering Awareness Guide.

Where to invest first

Verification in high-risk processes: out-of-band checks and dual control for payments, supplier bank changes, help desk password and MFA resets and privileged access requests. This protects the organisation even when a person is fully deceived.
Phishing-resistant authentication for those who matter most: administrators, remote access, finance approvers and executives first.
Reporting that is easy and rewarded: a report button in every mail client, feedback within hours, and a written statement from the chief executive that nobody is penalised for reporting a mistake.
Targeted programmes for high-risk roles: help desk, finance and treasury, executive assistants, developers and IT administrators, based on the attacks those roles actually face. See the Security Awareness for Executives and Assistants Guide.
Measurement: a culture survey and a small set of behavioural indicators, baselined now so next year's board report shows a trend.

Simulation programmes are useful when they are designed for learning and measured on reporting, but the NCSC cautions that they carry HR and legal considerations and should be agreed with HR first. See the Phishing Simulation Programme Guide.

Metrics to track

Metric	Why it matters	Direction
Reporting rate on simulated and real phishing	Shows whether people act as sensors, the outcome the NCSC recommends measuring	Up
Median time from first delivery to first report	Early reports let the security team pull messages and block links before others click	Down
Verification compliance on payment and reset tests	Tests the controls that stop the most expensive attacks	Up, target 100% for high-risk roles
Repeat risky behaviour by the same individuals or teams	Shows where targeted support or process change is needed	Down
Incidents with a human factor, and their cost	Links the programme to business outcomes	Down in impact
Culture survey: confidence to report and to challenge	Measures openness, the condition for everything else	Up

Avoid reporting click rate alone. If it is reported, show it beside reporting rate and the difficulty of the campaign, so the board does not mistake an easier simulation for progress.

A 90-day plan

Days 1 to 30: confirm an executive sponsor and the board member responsible; ask management for the current metrics and for the procedures covering payments, bank detail changes and help desk resets; agree and publish a no-blame reporting statement from the chief executive.
Days 31 to 60: identify the five riskiest behaviours and the roles exposed; close the most serious process gaps (call-back verification, dual approval, help desk identity checks); run a culture survey to baseline openness and confidence to challenge; check that executives have no exemptions from MFA or verification.
Days 61 to 90: launch targeted programmes for the high-risk roles; run an authorised impersonation exercise against the help desk and a payment change test in finance; agree four to six board metrics with targets, and add human risk to the board's cyber risk report. See the Board Cyber Risk Reporting Guide.

Framework mapping

Framework	Reference	What it expects
NIST CSF 2.0	GV.RR-01	Leadership is accountable for cybersecurity risk and fosters a risk-aware, ethical, continually improving culture
NIST CSF 2.0	GV.RR-04	Cybersecurity is included in human resources practices
NIST CSF 2.0	PR.AT-01, PR.AT-02	Awareness and training for all personnel, and for individuals in specialised roles
NIST SP 800-53 Rev. 5	AT-2, AT-2(3), AT-3	Literacy training and awareness, including social engineering and mining; role-based training
NIST SP 800-50 Rev. 1	Whole publication	A life cycle approach to a cybersecurity and privacy learning programme aimed at behaviour change and culture, with metrics
CIS Controls v8.1	Control 14	Security awareness and skills training
ISO/IEC 27001:2022	Annex A 6.3	Information security awareness, education and training
UK Cyber Governance Code of Practice	People principle	Board oversight of skills, awareness and culture, supported by the NCSC Board Toolkit
MITRE ATT&CK	T1566 Phishing	The initial access technique most human risk programmes are built to blunt

Common failure patterns

Training as the control: relying on staff to spot every attack instead of designing processes that survive a deceived employee. The NCSC is explicit that training cannot catch everything.
A blame culture: punishing clicks, which teaches people to hide mistakes and delays the report that would have contained the incident.
The help desk left out: investment in user awareness while the reset process accepts a caller's word, the route used at MGM Resorts and Marks and Spencer.
Seniority exceptions: executives who skip verification or are exempt from controls, which attackers target precisely because they are trusted.
Measuring the wrong thing: completion rates and click rates reported as success, with no evidence that risky behaviour or incident impact is falling.
Third parties ignored: outsourced service desks and contractors who act with the organisation's authority but are outside its programme and culture.

Practitioner checklist

Name an executive sponsor and a board member responsible for human risk and culture.
Publish a no-blame reporting statement from the chief executive and keep it in the induction pack.
Deploy one-click reporting in every mail client and acknowledge each report.
Document out-of-band verification for payments, bank detail changes and help desk resets, and test it at least twice a year.
Require phishing-resistant MFA for administrators, remote access, finance approvers and executives, with no seniority exemptions.
Run targeted programmes for help desk, finance, executive assistants, developers and administrators.
Run an annual culture survey and report trends to the board alongside behavioural metrics.
Agree simulation design and consequences with HR and legal before launch.
Extend expectations and testing to outsourced help desks and contractors in contracts.

Standards and references

How NHI Mgmt Group can help

We provide independent identity and security risk assessments, board briefings and programme initiation support, including how help desk, MFA and access processes hold up against social engineering. Our NHI Foundation Level Training Course helps security and IAM teams govern the API keys, tokens and service accounts that staff handle every day. Contact us to arrange a briefing.

Human Risk and Security Culture Executive Briefing: Board Questions, Investments and a 90-Day Plan