Glossary
What is human risk management?
Human risk management is an approach to security that measures and reduces the risk created by people’s behaviour, such as clicking phishing links, mishandling data or skipping policies.
- Also known as
- HRM, human risk
- Scope
- Behaviour, training, simulations, policies, reporting
- Typical goal
- Targeted action on the riskiest behaviours
- Related term
- Security awareness training
How it works
Observe, prioritise,
act, show.
- 01
Observe
Collect signals such as simulation results, reports of suspicious messages, training completions and policy acknowledgements.
- 02
Prioritise
Identify which people, teams and behaviours carry the most risk right now.
- 03
Act
Target follow-up: a relevant lesson, a simulation on the channel that matters, a policy reminder.
- 04
Show
Track change over time and report it to leadership and auditors.
Close concepts
Awareness training vs
human risk management.
| Security awareness training | Human risk management | |
|---|---|---|
| Focus | Delivering knowledge | Measuring and changing behaviour |
| Unit of planning | Courses and campaigns | People, teams and specific behaviours |
| Typical measure | Completion rates | Behaviour trends such as reporting and risky actions |
| Relationship | A core input | Uses training as one lever among several |
Questions buyers ask
Frequently asked questions.
Is human risk management the same as security awareness training?
No. Awareness training is one part of it. Human risk management also uses behavioural signals, such as simulation results and reports, to decide where training and other controls are needed.
What data does human risk management use?
Typically simulation results, reporting of suspicious messages, training completions, assessment scores and policy acknowledgements, sometimes alongside other security signals.
Who owns human risk management in an organisation?
It usually sits with the security team, working closely with HR, compliance and line managers.
Let’s connect the dots
See the human risk.
Change what happens next.
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo