Security awareness training is broken. Human risk management is what replaces it.

The traditional model is easy to describe: everyone completes a module once a year, a quarterly phishing test produces a click rate, and the number goes in a compliance report. It has the enormous advantage of being simple to run and simple to evidence. It has the disadvantage of not working.

#What the old model actually measures

Completion measures attendance. A quiz measures short-term recall in a calm setting. A click rate measures whether people noticed one artefact in one channel on one day, and it is trivially gameable: send easier simulations and the number improves without anybody becoming safer.

None of these measure the behaviour that determines whether you get breached, which is what a specific person does when a plausible authority creates pressure to skip a step.

#What a human risk program measures instead

• Reporting rate and time to report. A workforce that reports a suspicious message in four minutes is defended. One that silently deletes is not, however low its click rate looks.
• Behaviour under multi-channel pressure. Email alone is no longer representative. Voice, SMS, QR codes, chat platforms and video all need to be in scope.
• Risk weighted by privilege. A click by someone with domain admin or payment authority is not equivalent to a click by someone with neither. Aggregate averages hide exactly the people who matter.
• Repeat susceptibility. First failures are normal. The same person failing the same lever three times is a signal that requires coaching, not a scolding email.
• Procedural adherence. When a request bypassed policy, did anyone verify? Did anyone escalate? This is measurable and it predicts real outcomes better than any click metric.
• Trend over time. A single point is noise. The question is whether the curve is moving, and whether it moves back after each intervention stops.

#Intervention at the moment of failure

Timing matters more than content volume. A ninety-second explanation delivered the instant somebody falls for a simulation, describing that exact lure and that exact lever, outperforms an hour of generic material delivered three months later. The teachable moment is short and it closes fast.

The purpose of a simulation is not to catch people. It is to give them a safe memory of being manipulated, so the real attempt feels familiar.

#Culture is a control

Programs that publish leaderboards of failures, or that route results to line managers as a performance matter, reliably produce the same outcome: people stop reporting. Concealment is the mechanism by which a two-minute incident becomes a two-week one. A no-blame reporting culture is not a nicety, it is the control that determines your response time.

The practical rule is simple. Individual results go to the individual. Leadership sees aggregates and trends. Nobody is ever named in a report.

#Why boards are now asking

Regulators and auditors increasingly want evidence that human risk is being managed rather than merely trained, and insurers ask about it at renewal. That means participation records, testing across realistic channels, demonstrated behaviour change over time, and reporting mapped to whichever framework applies to you. A program built to change behaviour produces that evidence as a by-product. A program built only to produce evidence changes nothing.

#Where to start

Baseline honestly, including voice, before you buy anything. Pick the three roles an attacker would target first and start there rather than everywhere at once. Publish the verification procedures before you run the simulations, so people have somewhere to land. Then measure reporting, not just clicking, and give it two quarters before you judge the curve.