Draft:Human risk management

Vendor origins

The concept of managing human-related cybersecurity risk through data correlation rather than training alone emerged among several cybersecurity vendors in the late 2010s and early 2020s. Living Security, a cybersecurity company founded in 2017, registered the domain humanriskmanagement.com in 2020 and began publicly advocating for human risk management as a distinct category.^[6] In a March 2022 blog post, the company argued that "a better name for the category" was needed to reflect the shift from training-centric approaches toward risk identification and behavioral intervention.^[6] Other vendors, including CybSafe and Hoxhunt, also began repositioning their platforms around human risk management concepts during this period.^[4]

Analyst recognition

In 2022, Forrester Research formally introduced its vision for human risk management as a new approach to address what it described as security awareness and training's shortcomings.^[1] In the same period, Gartner introduced the concept of Security Behavior and Culture Programs (SBCP), which similarly advocated for a holistic approach to managing human cyber risk through behavioral change rather than awareness alone.^[7]

In Q1 2024, Forrester published its Human Risk Management Solutions Landscape report, formally establishing HRM as a distinct market category with defined evaluation criteria.^[8] This was followed by The Forrester Wave: Human Risk Management Solutions, Q3 2024, the first competitive evaluation of vendors in the category.^[1]

Gartner has projected that by 2030, 80% of enterprises will have formally established human risk management programs, up from approximately 20% in 2022.^[7]

Data correlation

HRM platforms ingest and correlate data from multiple enterprise sources, typically including:^[3]

• Identity data: Information from identity management and IAM systems about user roles, access privileges, and authentication patterns
• Behavioral signals: Observable actions across security tools, including email behavior, endpoint activity, cloud application usage, and data handling patterns
• Threat intelligence: External and internal threat data, including targeted attack campaigns, compromised credentials, and vulnerability exposure
• Security event data: Alerts and logs from security information and event management (SIEM) platforms, data loss prevention systems, and endpoint detection and response tools that provide context on security incidents involving specific users

By correlating these data streams, HRM platforms generate a unified view of where human risk concentrates within an organization, identifying the specific individuals, departments, or behaviors that represent the greatest risk exposure.^[3][9]

Risk quantification

A central capability of human risk management is the translation of correlated behavioral, identity, and threat data into quantitative risk scores that represent the likelihood and potential impact of human-caused security incidents.^[3][9]

Human risk scores differ from traditional security metrics in that they are not based on a single data point such as a phishing simulation click rate or a training completion percentage. Instead, they are composite scores derived from multiple weighted signals observed over time. A user's risk score may factor in how they handle sensitive data, whether they follow authentication policies, how they respond to phishing attempts, whether they have been targeted by known threat campaigns, the sensitivity of the systems they can access, and patterns of behavior that deviate from their established baseline.^[3][2]

Dynamic scoring is a key characteristic of HRM risk quantification. Unlike static assessments that capture risk at a single point in time, HRM platforms continuously update risk scores as new behavioral and threat data is ingested. A user's score may increase as they demonstrate sustained secure behaviors—such as correctly identifying and reporting suspicious emails, completing relevant training, or maintaining consistent adherence to security policies. Conversely, scores may decrease when users engage in higher-risk activities, such as accessing systems outside their normal pattern, mishandling sensitive data, failing phishing simulations, or being identified as a target of an active spear-phishing campaign.^[9][2]

Organizational and group-level quantification extends risk scoring beyond individuals. HRM platforms aggregate individual scores to produce risk views at the department, business unit, geographic, and enterprise levels. This gives security leaders visibility into where pockets of risk concentrate across the organization—whether a particular team, office, or role carries disproportionate exposure—so they can direct resources and interventions where they will have the greatest impact. In some cases, these aggregated views also reveal underlying process or access issues that contribute to elevated risk within a group.^[3]

Predictive modeling represents an emerging capability in HRM risk quantification. Some platforms apply machine learning and probabilistic modeling to historical behavioral and incident data to forecast which users or groups are most likely to be involved in future security incidents. Living Security's patented approach uses causal and probabilistic AI modeling to generate risk predictions based on the relationship between observed behaviors and security outcomes, creating what the company describes as a continuous risk feedback loop.^[9]

The shift from activity-based metrics to risk-based quantification has implications for how organizations communicate cybersecurity posture to leadership. Traditional SA&T programs typically report metrics such as the percentage of employees who completed training or the organization-wide phishing click rate. HRM risk quantification enables security teams to instead report on measurable risk reduction over time, the distribution of risk across the organization, the effectiveness of specific interventions on high-risk populations, and the correlation between human risk trends and actual security incidents. This provides CISOs and executive leadership with a framework for understanding human risk in terms comparable to other enterprise risk domains.^[2][1]

Targeted intervention

Rather than delivering uniform training to all employees, HRM systems trigger context-specific interventions tailored to the risk profile and circumstances of each individual or team. These interventions typically fall into several categories:^[2][4]

Adaptive simulations and AI-generated content: HRM platforms use risk data to generate phishing simulations and training content that are calibrated to each user's specific vulnerabilities. Rather than sending identical simulations to all employees, the platform may adjust the sophistication, attack vector, and social engineering techniques based on the individual's role, observed behaviors, and risk score. Some platforms use artificial intelligence to generate personalized training content that addresses the specific risk factors identified for each user.^[2]

Proactive risk alerts for targeted groups: When threat intelligence or behavioral data indicates that a particular department, role, or team faces elevated risk—such as a finance team during a spike in business email compromise campaigns—HRM platforms can deliver targeted communications alerting those groups to heightened threats and providing specific guidance on what to watch for.^[4]

Positive reinforcement and recognition: In addition to addressing risky behavior, HRM programs incorporate mechanisms to recognize and reinforce secure behavior. This may include notifying teams or individuals when their security practices demonstrate improvement, surfacing metrics that highlight departments with strong security posture, or delivering acknowledgment when users correctly identify and report threats. This approach is grounded in behavioral science principles that sustainable change requires reinforcing desired behaviors, not only penalizing risky ones.^[2]

Access and policy controls: For users whose risk scores exceed defined thresholds, HRM platforms can trigger automated policy responses through integration with IAM systems, such as requiring additional multi-factor authentication steps, restricting access to sensitive systems, or escalating for manual review.^[3]

Manager and team scorecards: HRM platforms generate security scorecards at the team and department level, providing managers with visibility into the risk posture of their groups and enabling accountability for risk reduction across the organization.^[2]

The distinction is that these tactics serve as components within a data-driven risk management framework, rather than functioning as standalone security programs. Each intervention is informed by the platform's risk intelligence layer and measured against its impact on actual risk reduction.^[2][3]