Human Risk Management is the security industry's best-dressed idea. Every vendor has a module for it, every board deck has a slide on it, and every dashboard glows green with completion rates and simulated-phishing scores. And yet the behaviour those programmes are meant to change barely moves. This report argues, plainly, that HRM as we practise it today is finished — and sets out what comes next.
The comfortable illusion
Awareness training and human-risk programmes are graded on activity: modules finished, simulations clicked, policies acknowledged. Those numbers are popular because they are easy to generate and easy to present — but activity is not behaviour. A workforce can pass every module and still be the door an attacker walks through. Measuring participation and calling it risk reduction is exactly the procession in Andersen's tale: a room full of people admiring a garment that isn't there.
From managing risk to measuring behaviour
Behavioural Risk Intelligence starts from a different question — not "did people complete the training?" but "what do people actually do when it matters?" It observes real behaviour in the flow of work: how phishing is handled, how quickly threats get reported, where good habits quietly break down. That evidence becomes a Behavioural Risk Index — a measured, benchmarked figure leaders can track over time and treat like any other operational risk, rather than a completion percentage that reassures without protecting.
What the full report covers
The full paper makes the case in detail: why HRM stalled, what behavioural science offers in its place, and how Behavioural Risk Intelligence turns human cyber risk into something you can actually see, measure and reduce. Enter your details and we'll take you straight to it.
Read the full report
Free PDF. We'll only use your details to send it and follow up.