Living Security is a Human Risk Management company that helps security teams find the people, and increasingly the AI agents, most likely to cause an incident, and then change that risk. Its platform reads signals from the security, identity and HR tools an organisation already runs, scores each person’s exposure and helps the team respond before an incident happens.
It is built for security leaders who need to move beyond training completion rates and show that human risk is actually falling.
At A Glance
| Vendor | Living Security |
|---|---|
| Category | Human Risk Management |
| Identities covered | Workforce users, AI agents, service accounts and OAuth clients |
| Deployment | Cloud, with US or EU data residency, no agent to deploy |
| Agentic AI | Livvy AI analyst, AI Agent Governance, Livvy over MCP |
| Customers | Blackbaud, Unilever, Merck, Ford, Target |
| Founded | 2017 |
| Market classification | Security Operations |
What Living Security Does
Security awareness programmes have long measured whether people finished a course rather than whether their behaviour changed. Living Security was founded to close that gap. Its research finds that a small share of the workforce accounts for most risky behaviour, a reported 74.8% from 10% of staff, so the platform concentrates effort on those people. Rather than treating everyone the same, the approach measures risk per person, intervenes where it is highest and proves the result to leadership and auditors. The same thinking now applies to the AI tools and agents employees adopt on their own.
Products
Living Security Platform And Livvy
The core platform works in four stages: Predict, Guide, Act and Prove. Signals from nine risk domains are grouped into cohorts, sequences and breach scenarios, and risk is prioritised by threat, access and behaviour. Livvy, the built-in AI security analyst, proposes actions such as step-up MFA or a coaching nudge, and playbooks carry them out automatically or after approval. Livvy can also be reached from AI assistants over MCP, including Claude, Cursor, ChatGPT and Microsoft Copilot; the connection is off by default and an admin must enable it.
Train
When a risky behaviour shows up, people need relevant training rather than a generic annual course. Train combines Security Awareness Training, Content Studio for custom material, CyberEscape Online escape games and VTX (Virtual Tabletop Experience) exercises. Alongside it, Simulations runs phishing, voice phishing (vishing) and multi-channel attack simulations to test how staff respond to realistic social engineering.
Govern: AI Agent Governance
Employees adopt AI tools and agents faster than security teams can track them. Govern builds an inventory of that activity from identity sign-ins, the web gateway and CASB, app registrations and OAuth consent grants, grouped by vendor and linked to the person who granted access. Every agent should have an accountable owner, and those without one are flagged “Unowned (Needs Review)”. Customers can also upload an AI acceptable use policy, and Livvy proposes which AI vendors to approve for a person to confirm.
How It Works
The platform is delivered from the cloud, with data residency in the US or the EU, and connects to existing tools without deploying an agent.
| Component | What it does |
|---|---|
| Human Risk Index | Each person’s exposure is scored on threat, access and behaviour and combined into a Human Risk Index from 0 to 1,000, where a higher score is better. |
| Feedback loop | Every action a playbook takes feeds back into the index, so the score reflects what the team has done. |
| AI activity collection | Agent discovery works without a browser extension and does not capture prompts. Blocking unapproved AI tools stays with the existing web gateway. |
Identities And Systems Covered
| Workforce users | People across the organisation, scored individually and in cohorts |
|---|---|
| AI agents and non-human accounts | AI apps, agents, service accounts and OAuth clients, each tied to an accountable person |
| Identity providers | Okta, Microsoft Entra ID, OneLogin, Cisco Duo, Auth0, JumpCloud, Ping Identity and Oracle Cloud Identity |
| Privileged access and password managers | CyberArk, SailPoint, ConductorOne, 1Password, LastPass and Keeper |
| HR systems | Workday, SAP SuccessFactors, ADP, Rippling and BambooHR |
Integrations
| Area | Integrations |
|---|---|
| Email security | Microsoft 365, Google Workspace, Abnormal Security, Proofpoint TAP, Mimecast, Cofense Triage |
| Endpoint | Microsoft Defender, CrowdStrike Falcon, Sophos, Cortex XDR, Microsoft Intune |
| Web, network and data | Zscaler, Netskope, Cloudflare, Code42, Microsoft Purview, Varonis |
| SIEM and SOAR | Splunk, Microsoft Sentinel, Securonix, ServiceNow |
| Collaboration | Slack, Microsoft Teams |
Company Background
| Founded | 2017 by Ashley Rose and Drew Rose |
|---|---|
| Headquarters | Austin, Texas, United States |
| Leadership | Ashley Rose, CEO and Co-founder; Drew Rose, Co-founder |
| Funding | Series A in 2020 and a Series B in 2021 led by Updata Partners |
| Research | The 2026 Human Risk Report, covering 4.9M identities across more than 100 organisations, and an open Human Risk Management Framework of 137 signals published under CC BY 4.0 |
| Recognition | Included in The Forrester Wave: Human Risk Management Solutions, Q3 2024, and in the Forrester Wave for security awareness and training, Q1 2022 |
Note: This overview is compiled from Living Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.