In short: Human risk management (HRM) is an approach that measures each person's cyber risk from several signals, such as training results, phishing simulation behaviour, exposed credentials, MFA status and access rights, and then targets training, policy and technical fixes at the riskiest combinations. It builds on security awareness training rather than replacing it.
What human risk management means
Traditional security awareness training treats everyone the same: the same course, the same deadline, the same phishing email. Completion reaches a high figure, the box is ticked, and nobody can say whether the organisation is actually safer.
Human risk management (HRM) changes the question from "did everyone finish the course?" to "where is our people-related risk, and is it going down?". It does three things:
- Measures risk per person and per team, using more than one signal
- Prioritises the people and combinations of weaknesses that matter most, such as a finance director with a leaked password and no MFA
- Intervenes in a targeted way: a short lesson for one person, an MFA fix for another, a policy reminder for a team, and fewer interruptions for people who are already doing well
The aim is less wasted training time for low-risk staff and more attention where an attacker would actually succeed.
The signals HRM platforms combine
No single number tells you how risky a person is. HRM platforms combine several kinds of signal into a score:
| Signal | What it shows | Typical source |
|---|---|---|
| Training and knowledge | Which topics a person has covered and where their knowledge gaps are | The awareness platform's courses and quizzes |
| Phishing behaviour | Clicks, credentials entered, reports and how quickly they reported | Phishing simulations and the report button |
| Policy acknowledgement | Whether key policies have been read and accepted | Policy management tools |
| Breach exposure | Whether work credentials appear in known data breaches | Dark web breach monitoring |
| Identity hygiene | MFA status, weak or old passwords, dormant accounts | Microsoft Entra ID or Google Workspace |
| Access and privilege | Admin rights, access to finance or sensitive data, mail forwarding | Directory and mailbox settings |
| Target value | How attractive a person is to attackers because of their role or visibility | Role, seniority and public exposure |
The value comes from combinations. A person who clicked one simulation is a training need. A person who clicked, has admin rights and has no MFA is an incident waiting to happen. That is why good HRM tools highlight "toxic combinations" and rank remediation by impact.
Examples of the approach in platforms we supply
Several of the vendors we supply have moved from plain training towards human risk management. Each takes a different angle:
- usecure uHealth is usecure's newest product and its human risk intelligence layer. It analyses four areas (Target Value, Awareness, Hygiene, and Access & Privilege), gives the organisation a live risk score and rates each person from Critical to Low. It highlights toxic combinations, such as a leaked password with MFA disabled or a privileged account without MFA, and ranks next steps by impact, such as enforcing MFA, tightening a policy or assigning a course. It draws on signals from usecure training, phishing, policy and breach products rather than replacing them
- The Hornetsecurity Employee Security Index benchmarks how securely employees behave when they receive realistic, targeted phishing, then uses the result to decide how much e-training each person receives. The Awareness Dashboard shows ESI history and forecasts. See the Hornetsecurity Security Awareness Service
- Microsoft's predicted compromise rate (PCR) in Attack Simulation Training uses historical data across Microsoft 365 to predict the percentage of people a given simulation is likely to compromise, and the training efficacy report sets that prediction beside your actual compromise rate. That helps you judge performance fairly when simulations vary in difficulty
None of these is a complete HRM programme by itself. The score is only useful if someone acts on it every month, which is where a managed security awareness training service helps.
Security awareness training vs human risk management
| Traditional awareness training | Human risk management | |
|---|---|---|
| Main question | Has everyone completed the course? | Who is most at risk, and is risk falling? |
| Content | The same modules for everyone | Targeted to each person's gaps and role |
| Data used | Completion and sometimes click rate | Training, simulation, identity, access and breach signals |
| Actions | Assign more training | Training, MFA or access fixes, policy prompts, technical controls |
| Reporting | Completion percentages | Risk trend by person, team and organisation |
HRM is not a reason to drop the basics. Everyone still needs cyber security awareness training and regular phishing simulation. HRM decides where to go further.
Doing it fairly: people, privacy and culture
Scoring individuals can feel uncomfortable, and handled badly it undermines trust. A few principles keep it constructive:
- Be open about it. Tell staff what is measured and why. Risk scores are personal data under UK GDPR, so involve your data protection lead and consider whether a data protection impact assessment is appropriate (this is not legal advice)
- Use scores to help, not to punish. The NCSC warns that blaming people who click does not work and discourages reporting. A high score should trigger support, not a disciplinary process
- Fix the system as well as the person. Many toxic combinations are technical: missing MFA, excessive admin rights or external mail forwarding. Fix them with controls such as Cisco Duo MFA and a Microsoft 365 security review rather than another course
- Reward reporting. Reporting a real or simulated phish should improve a person's standing
See building a positive security culture for more on getting the tone right.
How we help
We are vendor-independent, so we start from the risk you need to manage rather than a product we need to sell:
- Review what you already have: Microsoft 365 or Google Workspace licences, email security, MFA coverage and any existing training
- Recommend a platform with the HRM features that fit, from usecure uHealth to the Hornetsecurity Employee Security Index or Microsoft's built-in reporting
- Connect your directory and run a baseline, so you can see your starting risk
- Act on the top risks each month, combining targeted training with technical fixes
- Report the trend to your board using the metrics in how to measure security awareness training effectiveness
Pricing depends on users, platform and service level, so ask us for a quote. Contact us to discuss a baseline.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is human risk management in cyber security?
Human risk management is the practice of measuring and reducing the cyber risk that comes from people's behaviour, knowledge and access. It combines signals such as training results, phishing simulation behaviour, breach exposure, MFA status and privileges into a risk view, then targets training and fixes where they will reduce risk most.
Is human risk management the same as security awareness training?
No. Security awareness training is one part of it. Human risk management adds measurement across several signals, prioritisation of the riskiest people and combinations, and actions that go beyond training, such as enforcing MFA or removing unnecessary admin rights.
What is a toxic combination in human risk?
A toxic combination is two or more weaknesses on the same person that together create serious risk, for example a privileged account without MFA, or an executive whose leaked password is still in use. Each issue alone may be minor; together they give an attacker an easy route in.
Do small businesses need human risk management?
Small businesses benefit from the same idea at a smaller scale: knowing which few people and accounts matter most. Several platforms we supply are designed to run with little admin, and a managed service can act on the results for you. See security awareness training for small business.
Is it legal to give employees a cyber risk score?
Organisations can measure security behaviour, but risk scores are personal data under UK GDPR, so you need a lawful basis, transparency with staff and proportionate use. Speak to your data protection lead or adviser; this page is not legal advice.