Human risk management (HRM) is a continuous, evidence-led approach to changing risky workplace behaviour. Security awareness is one component of HRM, alongside controls, nudges, simulations, reporting, coaching and measurement.
Move beyond the annual course
An annual course can explain policy obligations and provide a baseline, but it rarely captures the pressures under which a real decision is made. Someone may pass a quiz and still approve an unexpected login request when distracted. An HRM programme treats the work environment, not just employee knowledge, as part of the problem.
Start with the few behaviours that materially influence organisational risk: reporting suspicious activity, verifying payment changes, handling sensitive information, responding to authentication prompts and using approved AI tools.
Connect signal to intervention
Useful signals may include repeated insecure decisions in a simulation, misdirected document attempts, support trends, incident reports and employee feedback. Interpret them carefully; a person who reports more threats may be demonstrating stronger security behaviour, not higher risk.
Use focused interventions. A manager making supplier payments needs different practice from a developer handling API keys or a leader approving an agentic AI pilot. Avoid turning risk scores into individual punishment; that discourages transparency and trust.
Build an improvement loop
Define a baseline, select a behaviour, deliver an intervention and revisit the same decision in a different scenario. Consider whether system design, incentives and workload are contributing to the problem. HRM is cross-functional work between cybersecurity, learning, communications and business owners.
A meaningful dashboard can combine decision quality, reporting confidence, participation, exception trends and action completion. Training completion is still worth tracking—it just should not be mistaken for the ultimate measure of resilience.
Four actions to take away
- Prioritise risk-relevant behaviours
- Respect context and privacy when interpreting signals
- Target learning by role
- Measure repeated decisions, not just attendance
Further reading & sources
These authoritative references provide additional technical, regulatory or security context. The analysis and recommendations above are original editorial commentary.