Security Awareness Training Is Broken. Human Risk Management Is What Replaces It.
Annual modules and click-rate dashboards can produce compliance without resilience. What a modern human-risk program measures instead, and why boards care.
Annual training alone is not enough because it shows who finished a course, not who would verify an unusual payment or report a suspicious call under pressure. Keep training, but add role-based learning, independent checks and dual approval for payments and account resets, and measure reporting and verification over time. Make reporting safe, because blame makes people hide mistakes.
Summary
Annual training shows who finished a course, not who would verify an unusual payment or report a suspicious call under pressure.
Training is still useful, but human risk management adds role-based learning, better processes, supporting controls and measuring behaviour over time.
Click rate alone is a weak measure, because it depends on how hard the test email is. Reporting, verification and escalation matter more.
Much of the risk sits in the process, so add independent checks and dual approval for payments, bank changes and account resets.
Blame makes people hide mistakes. Make reporting easy and safe, because an early report from the person who clicked is the most useful warning.
Human risk work supports technical security such as patching and MFA, it does not replace it, and any testing must be authorised and scoped.
Every employee finishes the annual security module. Completion reaches 100 per cent, the audit evidence is filed, and the dashboard turns green. Three months later a message lands in the finance inbox that appears to come from the managing director: an urgent supplier payment, new bank details, a request to keep it quiet until a deal is announced. Or the IT help desk takes a call from someone who sounds exactly like a senior manager locked out before a board meeting.
The person handling it did the training. They may even remember the module. But the approval process has no independent check, the requester's seniority discourages questions, and nothing in the workflow forces a pause. The payment goes out, or the reset goes through.
That is not a training failure in the narrow sense. It is a measurement failure. The organisation measured whether people completed a course, not whether its people and processes could resist a convincing request under pressure.
Last checked: 28 September 2026.
#Why Isn't Annual Security Awareness Training Enough?
Security awareness training teaches knowledge and expected behaviours, but training completion alone does not measure organisational human cyber risk. An annual module happens once, covers generic scenarios and produces a completion rate: a number that shows who finished a course, not who would verify an unusual payment request or report a suspicious call. Large field studies have found weak links between recent training completion and simulated phishing outcomes. Attackers also target workflows, not just inboxes: payment approvals, account resets, supplier changes. Human risk management expands the focus from training participation to identifying, measuring, reducing and monitoring human-related cyber risk, using role-specific learning, better processes, supporting controls and behaviour measurement over time. Training remains part of the program. It stops being the whole of it.
#The Human Risk Loop: Know, Measure, Intervene, Test, Improve
A working human-risk program runs as a loop rather than an annual event:
Know. Which roles, workflows and accounts create or amplify human-driven risk, and what attackers can learn about them from public sources.
Measure. Baseline the behaviours that matter, such as reporting, verification and escalation, not only completion and clicks.
Intervene. Change what people know (role-based learning), what they are expected to do (clear procedures) and what the environment allows (controls).
Test. Run authorised, scoped exercises to check whether the changes hold under realistic pressure.
Improve. Feed test results, incidents and near misses back into training, process and control decisions.
Training gives people a shared vocabulary, sets expectations and tells them where to report. Those are real outcomes, and nothing in this article argues for removing it.
The current guidance keeps it central. NIST SP 800-50 Rev. 1 (September 2024), which replaced NIST's 2003 awareness guidance, still treats a mandatory organisation-wide learning program as a core element. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 recommend at least annual cybersecurity training for all users, plus role-based training for specialised roles including finance and senior leadership. For some regulated Malaysian entities, annual awareness training is a regulatory requirement (see section 19).
The criticism here is narrower: security awareness training is useful, but a compliance-only annual training model is insufficient for managing modern human cyber risk.
The traditional model has predictable weak points:
Frequency. Once a year, against threats that change monthly.
Generic content. The same module for the payroll clerk and the system administrator.
The wrong measure. Completion shows attendance, not behaviour.
People without process. It trains individuals while leaving single-approver workflows untouched.
A dead end. The course finishes, and nothing feeds back into how the organisation works.
The research supports caution about completion as a proxy. In an eight-month randomised study of more than 19,500 employees at UC San Diego Health (Ho et al., IEEE Symposium on Security and Privacy 2025), the researchers found no significant relationship between recently completing annual awareness training and failing a simulated phish. Training shown immediately after a click reduced failure by about 1.7 percentage points across the population, and more than half of those training sessions were closed within 10 seconds. The study covers one organisation and measures simulations rather than real breaches, but it is hard to read it as endorsing completion as a risk measure.
An earlier 15-month study of about 14,700 employees at one company (Lain, Kostiainen and Čapkun, IEEE S&P 2022) found that voluntary training shown after a click was associated with more failures, not fewer. The authors stress that they did not test mandatory training.
NIST's own position is plain: meeting compliance requirements "should only be the starting point" for a learning program.
Phishing click rate is a useful metric for a specific simulation, but it does not represent total human risk. It is heavily shaped by how difficult the test email is. NIST's Phish Scale research (Steves, Greene and Theofanos, Journal of Cybersecurity, 2020) found that exercises rated very difficult drew click rates of 19.4 to 49.3 per cent, while the others ranged from 3.2 to 11.6 per cent. A team can improve its click rate simply by sending easier emails.
The NACD's 2026 board handbook still lists click rate as an example culture metric, and that is reasonable as one input among several. The problem starts when it becomes the only number.
Metric
What it tells you
What it does not tell you
Training completion
Who finished the assigned course
Whether anyone behaves differently afterwards
Phishing click rate
How many people clicked one simulated email of one difficulty
How the organisation would handle a phone call, message or deepfake
Report rate
How many people flagged a suspicious message
Whether reports reach someone who acts on them
Time to report
How quickly the organisation gets an early warning
Whether the threat was contained
Repeat failures
Where support or process changes may be needed
Why it happened: workload, role design, poor tooling
Data entered on a test page
How far a simulated attack progressed
Whether controls such as phishing-resistant MFA would have stopped it
Human risk management is the continuous process of identifying, measuring, reducing and monitoring cybersecurity risks created or amplified by human behaviour and human-dependent business processes.
A note on terminology: "human risk management" is an industry and analyst term, not a formal standard. Forrester adopted it as its market name in February 2024, retiring "security awareness and training"; Gartner uses different language, including "security behaviour and culture program". NIST SP 800-50 Rev. 1 mentions "human risk management concerns" only to say they fall outside its scope. The label matters less than the shift it describes.
Human risk management expands the focus from training participation to identifying, measuring, reducing and monitoring human-related cyber risk. In practice it adds four things the annual model lacks: a view of risk by role and workflow, measurement of behaviour over time, changes to controls and processes, and governance reporting that leadership can act on.
Exposure follows authority and access, not intelligence or diligence.
Finance: payment approvals, supplier onboarding and bank-detail changes.
IT and help desk: password resets, MFA re-enrolment and access grants.
HR: personal data, payroll changes and recruitment channels open to anyone.
Executives: public profiles, recorded voices and faces, and the authority impersonators borrow.
Developers: code repositories, secrets, cloud access and third-party packages.
Customer support: account-change requests from people claiming to be customers.
Much of what an attacker needs to target these roles is public. Our analysis of how attackers use OSINT to research a company shows how organisation charts, job posts and social profiles become pretexts. A higher-risk role is a design input, not an accusation.
If one email can change a supplier's bank account, the risk sits in the process. Asking an individual to be sceptical every time, under deadline pressure, is a weak control.
Business email compromise shows the scale. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints and about US$3.05 billion in reported losses in 2025. Those are complaints to IC3, mainly from the United States, not a global incidence rate. In Malaysia, the Royal Malaysia Police's "Kenali BEC" advisory advises verifying payment requests by phone or another channel.
Process questions worth asking:
Does any high-value action depend on one person and one channel?
Can urgency or seniority override the normal check?
Is there a named person to call when something feels wrong?
Are bank-detail changes verified against information already on file?
Training works better when it rehearses the decisions a role really makes. The scenarios below describe situations and the desired defensive response; they are not test content.
Role
Scenario
Desired behaviour
Finance
A message that appears to be from a known supplier announces new bank details before a large invoice
Verify using contact details already on file, apply dual approval and report the request
IT help desk
A caller claiming to be a senior manager urgently needs an MFA reset
Follow the identity-verification procedure regardless of seniority, and escalate if pressured
HR
An email asks to change an employee's payroll account
Confirm with the employee through a known channel before any change
Executive
A video call from "the CEO" asks for a confidential transfer
Awareness is knowing that callback verification exists. Behaviour is doing it when a senior executive is pressing for a payment. Programs should measure the second:
Detection: did people notice something was wrong?
Verification: did they check through an independent channel?
Reporting: did they tell the security team, and how quickly?
Escalation: did the report reach someone who could act?
Recovery: after a mistake, was it disclosed and contained quickly?
Repeat behaviour: does the same failure recur in the same role or workflow?
NIST SP 800-50 Rev. 1 lists incident-reporting metrics and "longitudinal data that depicts program impacts, including employee behavior change" among example measures.
The most reliable way to reduce human risk is to take risky decisions out of individual hands where possible:
Phishing-resistant MFA for email, administrator, finance and social accounts. CISA's Performance Goals 2.0 rank FIDO/WebAuthn or PKI-based methods as the strongest option. See our guide to setting up two-factor authentication properly.
Dual approval and a hold period for new payees and bank-detail changes.
Callback to contact details already on file, never to details in the request.
Documented help desk identity verification that seniority cannot override.
Email authentication, external-sender warnings and a one-click report button. The 2022 ETH Zurich study found that warnings on emails did help.
Least privilege, so that one compromised account reaches less.
Reporting may be the most useful human metric an organisation has. In security-awareness vendor data analysed in the Verizon 2025 Data Breach Investigations Report, users who had recently been trained reported simulated phishing at about 21 per cent, against a base rate of 5 per cent, while the effect on click rate was far smaller. That data is observational, not causal, but it points in a clear direction.
In the ETH Zurich study, staff reports caught real phishing campaigns quickly. About 10 per cent of reports on simulated emails arrived within five minutes, and only 9 per cent of 7,191 real reported emails needed a human decision.
Reporting turns employees into an early-warning network. It works only if reporting is easy, acknowledged and safe.
The UK National Cyber Security Centre is direct: "blaming users for clicking on links doesn't work", and "employees who are afraid for their jobs will not report mistakes." Its Cyber Security Culture Principles (June 2025) ask that incidents be investigated "to learn and improve, not to blame." NIST SP 800-50 Rev. 1 recommends encouraging behaviour change "in positive, non-punitive ways."
The experimental evidence on punishment is mixed. Some studies find that sanctions reduce repeat clicking, and others record costs in perceived unfairness and anxiety. The stronger case against fear is practical: the most valuable signal an organisation can get is an early report from the person who made the mistake, and that depends on trust. Why social engineering works at all is covered in the psychological levers attackers use; a punitive culture adds another lever to the attacker's side.
The NACD's 2026 Director's Handbook on Cyber-Risk Oversight (fifth edition, with the Internet Security Alliance) includes a tool on overseeing insider threats and human risk management. It asks boards to review whether awareness training is effective in reducing poor security behaviours and whether the program shows improvement over time. The questions below draw on that guidance. They are governance recommendations, not a legal requirement or universal practice.
Which roles and workflows carry the most human-driven cyber risk?
Which high-value actions rely on a single person or channel?
Is our training effective in reducing poor security behaviours, and how do we know?
Are reporting and verification improving over time?
How are phishing-resistant MFA and dual approval deployed across critical accounts?
What did recent incidents and near misses teach us?
Do the CISO and HR work together on culture and insider risk?
Are our tests authorised, scoped and comparable over time?
Where do business pressures override security procedures?
What will change next quarter, and who owns it?
For context only: since the US Securities and Exchange Commission's 2023 rules, SEC-registered public companies must disclose material cybersecurity incidents and describe their cyber risk management and board oversight annually. Those rules do not apply to Malaysian companies that are not SEC registrants. For Malaysian listed companies, the Malaysian Code on Corporate Governance guidance names cyber security among the key risk areas boards should discuss.
A concise quarterly human-risk report can follow eight headings:
Risk: the top human and process risks, in business terms.
Exposure: changes in high-risk roles, access and public footprint.
Controls: coverage and gaps in verification, MFA and approvals.
Behaviour: reporting, verification and escalation data.
Trend: direction against the organisation's own baseline.
Exceptions: where controls were bypassed, and why.
Incidents: real events and near misses with a human component.
Actions: what is changing, who owns it and by when.
#17. Human Risk Management Is Not a Replacement for Security Controls
Human risk management complements technical security controls rather than replacing them.
The breach data is explicit. The Verizon 2026 Data Breach Investigations Report, covering more than 22,000 confirmed breaches across 145 countries between November 2024 and October 2025, found that exploiting vulnerabilities was the leading initial access vector at 31 per cent, ahead of phishing at 16 per cent and credential abuse at 13 per cent. Pretexting was 6 per cent. The report found a non-intentional human element in 62 per cent of breaches. Separately, Microsoft Incident Response investigations for the Microsoft Digital Defense Report 2025 (July 2024 to June 2025) found that 28 per cent of breaches began with phishing or social engineering. That figure comes from Microsoft's own incident response engagements, not all organisations.
AI makes impersonation cheaper and more convincing. The FBI warned in December 2024 that criminals use generative AI for fraud, including cloned voices and real-time video chats with alleged company executives. In May 2025 it warned of AI-generated voice messages impersonating senior US officials. In early 2024, engineering firm Arup reported losing about HK$200 million (roughly US$25 million) in Hong Kong after an employee joined a video call with a digitally cloned chief financial officer, as reported by CNN.
The implication for human-risk programs is simple: "it sounded like her" is no longer verification. Procedures must not depend on recognising a face or voice. Read more on AI voice cloning attacks and how organisations are adjusting.
The official figures show the pressure. CyberSecurity Malaysia's Cyber999 centre handled 7,616 reported incidents in 2025, of which 5,751 were fraud. These are voluntary reports to Cyber999, not a measure of total incidence. The Royal Malaysia Police put 2025 online scam losses at RM2.97 billion, up from RM1.57 billion in 2024.
It helps to separate law, regulation and best practice:
Legal duties. The Cyber Security Act 2024 (Act 854), in force since 26 August 2024, places duties on designated national critical information infrastructure entities. It contains no general staff-training requirement for ordinary businesses.
Sector regulation. Bank Negara Malaysia's Risk Management in Technology policy (November 2025) requires financial institutions to provide cybersecurity awareness education at least annually and to measure its effectiveness. The Securities Commission's Guidelines on Technology Risk Management require annual awareness training for capital market entities.
Voluntary best practice. For most SMEs, none of these apply directly. A human-risk program is good practice, not a legal duty.
SME realities shape the risk: founders approving payments by message, small finance teams without a second approver, heavy reliance on agencies and suppliers, and public-facing founders whose identity is easy to borrow (see digital identity protection). If money has just been transferred without authorisation, contact your bank's hotline or the National Scam Response Centre on 997 immediately, then lodge a police report. Incidents can also be reported to Cyber999.
#20. A 90-Day Human Risk Plan for Malaysian Businesses
This is a practical sequence, not an official or regulatory timetable.
Days 1 to 30: Know
List who can move money, reset accounts, change supplier details and publish on official channels.
Check MFA on email, banking, administrator and social accounts.
Set up one clear reporting channel and a named contact.
Review what is publicly visible about key staff and processes.
Days 31 to 60: Intervene
Add independent verification and dual approval for payments and bank-detail changes.
Document help desk identity verification.
Run short role-specific sessions for finance, IT, HR and leadership.
Have leadership state, in writing, that reporting a mistake will not be punished.
Days 61 to 90: Test and improve
Run an authorised, scoped exercise, either a tabletop or a simulation, with written approval, a defined scope and an emergency stop contact.
Measure reporting and verification, not only clicks.
Brief leadership on the results and set next quarter's priorities.
Test. An OSINT exposure baseline, then phishing, voice, SMS, callback and deepfake scenarios. Every engagement runs under written authorisation, a defined scope, agreed scenarios, safety controls and an emergency stop contact.
Observe. We look at how people and processes respond: who reported, who verified, where a workflow allowed a request through. Reports do not name individuals.
Coach. Coaching after each test, and workshops for finance, HR, IT support and leadership.
Improve. Results are broken down by department, role and trend, and presented in board-level reporting. Technical gaps found along the way connect to our cybersecurity services.
Testing shows how processes respond on the day. It does not guarantee future behaviour, and we do not claim it does. How we handle authorisation, data and disclosure is set out in our Trust Center.
It is useful for building shared knowledge, setting expectations and telling people how to report. Field research suggests that annual completion on its own has a weak link to behaviour, so training works best as one part of a program that also changes processes, controls and measurement.
What is human risk management in cybersecurity?
Human risk management is the continuous process of identifying, measuring, reducing and monitoring cybersecurity risks created or amplified by human behaviour and human-dependent business processes. It is an industry term rather than a formal standard.
Is human risk management replacing security awareness training?
No. It widens the scope. Awareness training stays in the program, alongside role-specific learning, process controls, behaviour measurement and governance reporting.
Why is phishing click rate not enough to measure human risk?
Click rate reflects one simulated email at one difficulty level. NIST research shows it varies widely with how hard the email is, and it says nothing about phone, message or deepfake requests, or about whether controls would stop an attack.
What should a human risk dashboard measure?
Exposure (high-risk roles and accounts), behaviour (reporting, verification and escalation), control coverage (MFA and dual approval), testing results by difficulty and channel, and incidents or near misses. It should show trends against the organisation's own baseline, aggregated by role rather than by individual.
How do you measure employee cybersecurity behaviour?
Measure what people do in realistic situations: whether they detect, verify, report and escalate, and how quickly. Compare results over time using like-for-like tests, and combine them with real incident and near-miss data.
How can businesses reduce human cyber risk?
Map high-risk roles and workflows, add independent verification and dual approval to high-value actions, deploy phishing-resistant MFA, make reporting easy and safe, train by role, and test with authorised, scoped exercises.
What is the difference between awareness and behaviour?
Awareness is knowing what a safe action looks like. Behaviour is taking that action under real pressure, such as verifying a payment request when a senior executive is demanding speed.
How should boards oversee human cyber risk?
NACD's 2026 handbook suggests that boards review whether training reduces poor security behaviours, whether the program improves over time, and whether security and HR leaders work together. Boards should ask for risk and trend reporting, not completion percentages.
Does human risk management replace technical security?
No. Human risk management complements technical security controls rather than replacing them. Verizon's 2026 breach data shows vulnerability exploitation as the leading initial access vector, so patching and identity controls remain essential.
How should SMEs build a human risk program?
Start small: identify who can move money or reset accounts, add verification to those workflows, enable MFA, set up one reporting channel, and run a short authorised exercise. For most Malaysian SMEs this is voluntary best practice rather than a legal requirement.
How can businesses test social-engineering resilience safely?
Use written authorisation, a defined scope, agreed scenarios, safety controls and an emergency stop contact. Avoid collecting real credentials, keep individuals anonymous in reporting, and follow every test with coaching rather than blame.
