Human Risk Indicators: Measure, Score, and Reduce Cyber Risk (2026 Guide)

Nearly 60% of breaches involve a human element, according to the 2025 Verizon Data Breach Investigations Report. That statistic gets quoted so often it has lost its ability to shock. The more useful number sits one layer down: research from Living Security's 2025 Human Risk Report, drawn from more than 100 organizations and over 200 behavioral signals, found that just 10% of employees drive 73% of all risky behavior. Verizon's own data tells a similar story, with roughly 8% of employees accounting for 80% of security incidents.

Read those two facts together and the picture changes. Human risk is real, and it is the dominant attack surface, but it is not spread evenly across every desk in the building. It concentrates in a small, identifiable slice of the workforce. That concentration is the most important operational fact in the field, because a risk that lives in 10% of your people is not an unsolvable "people problem." It is a variable you can locate, measure, and reduce, the same way you would treat patch compliance or misconfiguration rates.

Human risk indicators are how you do that. They are the quantifiable signals that turn vague worry about employee behavior into specific numbers you can track, benchmark, and lower over time. This guide covers the full arc a practitioner needs: what human risk actually is, the four families of indicators, the behavior underneath them, how scoring genuinely works, the metrics worth tracking, how AI has changed the target, the regulations forcing measurement, a maturity model, an operating loop, how to report all of it to a board, and the honest debates you should be ready to have.

What human risk actually is (and what it is not)

Human cyber risk is the potential for people inside an organization to contribute to a security incident through error, negligence, manipulation, or misuse. It is broader than the term it gets confused with. Insider threat implies deliberate, malicious action: an employee who steals data or sabotages systems on purpose. Technical vulnerability refers to flaws in software or configuration, the unpatched CVE or the storage bucket left open to the internet. Human risk sits between those two categories and covers the far larger space of unintentional mistakes and manipulated decisions that no endpoint tool will flag.

A finance employee who wires funds after a convincing video call from someone who looks and sounds like the CEO did not act maliciously and did not exploit a software bug. They were deceived through a channel nobody had trained them to distrust. That is human risk in its purest form, and it materializes through four recurring patterns:

• Negligent behavior: forwarding a sensitive attachment to a personal inbox, misconfiguring a share, reusing a password already exposed in a breach.

• Social engineering susceptibility: falling for phishing, vishing (voice phishing), smishing, or deepfake impersonation.

• Insider misuse: intentional abuse of legitimate access, whether for money, grievance, or espionage.

• Shadow IT and shadow AI: using unauthorized tools that route data around your controls without oversight.

For most organizations, the first two patterns account for the bulk of measurable exposure, and they surface through three vectors: user identities that get compromised, applications that operate outside sanctioned channels, and data that leaks to places it should not go.

The response to all of this has a name. Human Risk Management (HRM) is the discipline of continuously measuring behavior, scoring it, and intervening where the risk is highest. It is displacing the older model of annual, compliance-driven security awareness training, and the market reflects the shift. Industry estimates put the HRM category at roughly USD 8.4 billion in 2025, with projections above USD 22 billion by the mid-2030s, and Gartner has forecast that around half of medium-to-large organizations will run formal HRM programs by 2026, up from under 10% a few years earlier. Those are vendor and analyst projections rather than settled fact, but the direction is not seriously disputed. The reason it is happening is simple: completion certificates never told anyone whether a workforce would actually resist an attack.

The four families of human risk indicators

Before you can score human risk, you need a working vocabulary of what you are measuring. Human risk indicators fall into four families. The first two describe individuals, the second two describe the environment around them, and a mature program reads all four together.

Behavioral indicators are the most direct signals because they measure what people do, not what they know. This is where most programs start, and for good reason: behavior under simulated attack conditions predicts behavior under real ones better than any quiz score.

Identity and access indicators measure the blast radius. They tell you how much damage occurs if a given person is compromised, which is why an administrator or a finance controller with weak habits is a categorically different problem than a junior employee with the same habits.

Contextual and environmental indicators capture the structural conditions that raise or lower risk independent of any single choice: how attractive a role is to attackers, how new someone is, how healthy the security culture is, and how much strain the person is under.

Technical exposure indicators reflect the systems and tools around the employee, including the fast-growing category of unsanctioned AI use.

A few of these deserve emphasis. The phishing report rate, the share of suspicious messages employees correctly flag, is widely regarded as the single most valuable behavioral indicator, because it treats employees as active sensors rather than passive targets. Repeat-offender frequency is one of the strongest predictors of future real-world involvement in an incident. And shadow AI has become the defining new technical-exposure indicator: surveys in 2025 and 2026 found that a large majority of employees, by some counts more than 80%, use AI tools that IT has not approved, and data-loss activity tied to that usage has climbed several-fold year over year. The National Cybersecurity Alliance's 2025-2026 "Oh Behave!" report found that 58% of employed respondents had received no training on the security or privacy risks of AI tools, even as 65% reported using AI and 43% admitted sharing sensitive work information with it.

Human risk does not stop at your own payroll. Third parties and suppliers who touch your systems bring their own hygiene, and a vendor's untrained finance clerk who fails to verify a change in payment instructions becomes your wire-fraud loss. Extending the same indicators to critical suppliers, at least the ones with access to your environment, is what keeps that exposure on the register instead of in the blind spot.

Why employees fail: the behavior behind the indicators

Indicators measure symptoms. If you want to move them, you have to understand the behavior underneath, and the behavior is rarely about a careless individual. It is about people making trust decisions under load, using complex tools at speed, in conditions attackers deliberately engineer. Treating those failures as character flaws is both unfair and useless, because you cannot train away a systemic condition one scolding at a time.

The most practical lens here is the Fogg Behavior Model, developed at Stanford's Behavior Design Lab, which holds that a behavior happens only when three things converge at once: motivation, ability, and a prompt. Apply it to phishing reporting. Awareness training supplies motivation, but if reporting a suspicious email requires opening a ticket and filling in five fields, ability is too low and the behavior does not happen. A one-click report button raises ability. A contextual reminder that appears at the moment of hesitation supplies the prompt. Design for all three and reporting rates climb; supply motivation alone and you get frustrated employees who know what they should do but cannot do it easily.

Attackers, meanwhile, are experts in three cognitive biases. Optimism bias convinces people that an attack will happen to someone else, not them. Authority bias drives compliance with an apparent executive request without verification. Urgency bias short-circuits scrutiny under artificial time pressure, which is exactly why business email compromise leans so hard on "I need this in the next ten minutes." Programs that teach people to recognize these pressures directly, rather than just memorize red flags, tend to produce more resilient decisions when a real attack applies them.

There is also a leading indicator most programs ignore: strain. Fatigue, burnout, and heavy cognitive load precede security failures. Exhausted employees skip MFA steps, underreport incidents, and reach for shadow IT to save time, and Gartner has flagged cybersecurity burnout as a trend that elevates error rates. A department showing rising exhaustion scores alongside climbing click rates does not have a training problem. It has a workload problem wearing a training problem's clothes, and no amount of microlearning will fix it.

How human risk scoring works

Once you are collecting indicators, you need a way to combine them into something a person can act on. That is the job of the Human Risk Index (HRI): a normalized score, usually on a 0-100 or 0-10 scale, that aggregates signals into a single value you can compare across individuals, teams, and the whole organization. Most implementations then sort people into tiers, commonly running from High Risk through Neutral to Vigilant, so intervention resources go where they matter instead of being spread evenly.

The mechanics are less mysterious than vendors sometimes make them sound. At the foundation is the classic risk equation, likelihood multiplied by impact. Human risk scoring extends it by feeding multiple weighted indicators into the likelihood side and using access level as the impact multiplier. To make that concrete, here is a transparent published example of the weighted approach, from CanIPhish:

Human Risk Score = (Security Knowledge Risk × 0.35) + (Phishing Risk × 0.35) + (Breach Exposure × 0.15) + (Engagement Risk × 0.15)

In that model, simulation and knowledge behavior carry 70% of the weight, with breach exposure and training engagement splitting the rest, and the resulting score maps to bands: roughly 70-100 as high risk, 40-69 as medium, and 0-39 as low. You do not have to adopt those exact weights. The point is that a defensible score is explicit about what it counts and how much, so you can defend it to an auditor and recalibrate it when incident data tells you a weight is off.

More sophisticated models add dimensions. Mimecast composes its score from three factors it labels actions, attacks, and access, which is to say behavior, targeting, and identity. Proofpoint's human-centric model uses vulnerability (likelihood of victimization based on behavior), attacks (probability of being targeted), and privilege (business impact if compromised). Living Security's index draws on user behavior, external threat data, and access, analyzing hundreds of signals. The common thread across all of them is that a real score correlates behavior with identity and threat context rather than reporting a lonely click rate.

Two calibration rules separate a useful score from a misleading one.

The first is role and peer normalization. A finance director handling wire transfers will face more phishing and interact with more suspicious mail than an engineer, so raw susceptibility metrics make them look reckless when they are simply exposed. Normalize within role cohorts, compare finance directors to other finance directors, and cap extreme outliers so a single high-risk person does not distort a department's number.

The second is the distinction most listicles skip: targeting probability is not susceptibility probability. An Attack Factor measures how visible and attractive someone is to adversaries, driven by seniority, public profile, and authority over money. A Behavioral Risk Score measures how likely they are to engage if targeted, driven by simulation performance and reporting habits. These are different axes, and conflating them wastes budget. An executive with a high attack factor but strong behavior needs technical guardrails like step-up authentication, not another remedial module. A repeat-clicking employee with low visibility needs targeted coaching. The dangerous profile, the one worth real attention, is high on both: heavily targeted and likely to engage.

The metrics that matter: outcomes over vanity, leading over lagging

Scoring gives you a number. Choosing the right inputs and the right reporting metrics is what makes the number honest. The core shift from legacy awareness training to human risk management is a shift away from metrics that flatter a program and toward metrics that correlate with actual risk reduction.

The left column measures effort. The right column measures change. A completion rate tells you an employee opened a module; it says nothing about whether they clicked through it at double speed while answering email, which many do. The metric that actually matters is the delta between pre-training and post-training simulation performance, department by department.

Cutting across all of this is the distinction between leading and lagging indicators. Most organizations measure human risk almost entirely through lagging signals: incident counts, breach costs, click rates tallied after the fact. By the time those land on a dashboard, the loss has already happened. Leading indicators flag exposure before an incident: MFA adoption gaps, password-manager penetration, shadow IT patterns, reporting velocity. Lagging indicators justify budget and prove outcomes to the board; leading indicators give you time to intervene. You want both, tracked in parallel, and you want to know which is which.

Financial framing turns the score into a funding argument. The standard method is Annualized Loss Expectancy: ALE equals the annualized rate of occurrence multiplied by the single loss expectancy. Use IBM's 2025 global average breach cost of USD 4.44 million as the single loss expectancy and assume, illustratively, a 12% annual breach probability for a mid-market organization, and the baseline ALE is about USD 533,000. A program that cuts phishing susceptibility by two-thirds reduces the occurrence rate proportionally, dropping expected loss toward USD 178,000. Against a modest program cost, the avoided loss carries the ROI case. The exact figures depend entirely on your assumptions, so show them rather than hiding them, but the structure is sound. It is anchored in a real behavioral result: KnowBe4's 2025 benchmarking, across tens of millions of simulations at more than 60,000 organizations, reported the average untrained phish-prone percentage falling from 33.1% to 4.1% after twelve months of continuous training, an 86% reduction. Treat that as an illustration of what sustained programs can achieve, not a guarantee, and the point holds: susceptibility reduction is the input that drives every downstream financial number.

AI changed the attack surface, and single-channel scoring can't see it

A scoring model built for 2019 measures email and calls it done. In 2026 that model is dangerously incomplete, because generative AI has rewritten the economics of social engineering on both sides of the fight.

For attackers, AI removed the three constraints that used to limit them: time, scale, and personalization. A language model fed a target's public profile can produce hundreds of contextually perfect lures in seconds, each referencing real projects, colleagues, and vocabulary. Voice cloning turns seconds of public audio into a convincing executive on the phone. Deepfake video adds a face to the voice, and when every participant on a call is synthesized, the instinct to trust what you can see works for the attacker. Hoxhunt's 2026 trends reporting documented a fourteen-fold surge in AI-generated phishing at the end of 2025. The most cited proof point remains the 2024 case in which a finance employee approved roughly USD 25 million in transfers after a deepfake video call, and identity-fraud analysts at Sumsub reported sophisticated fraud rising sharply year over year, with deepfake-specific fraud climbing many times over in the United States.

Speed compounds the problem. CrowdStrike's 2026 threat reporting put the average adversary breakout time, the window from initial access to lateral movement, at 29 minutes, with the fastest observed at 27 seconds. Against that clock, an annual training cycle is not slow, it is irrelevant, and so is a phishing test you ran last quarter. An employee who aced a January email simulation tells you nothing about their susceptibility to a March vishing call.

This is why single-channel scoring is worse than incomplete: it broadcasts false safety. Someone who reports every simulated phishing email may still comply with a voice call they have never practiced, and human risk signals bleed across channels. A person who trusts a deepfake of the CEO is more likely to click the spear-phishing email that references the same fake conversation minutes later. A credible human risk model has to ingest behavior from email, voice, SMS, and collaboration tools, because that is where the attacks now operate.

Two newer exposures belong in the model. Shadow AI, covered earlier as a technical indicator, is also an attack surface: proprietary data pasted into consumer tools leaves your control entirely. And AI agents are becoming risk entities in their own right. Autonomous systems now hold credentials, access databases, and execute transactions at machine speed with human-trusted access. A compromised agent, whether through prompt injection or an over-broad permission grant, behaves like a high-privilege insider that never sleeps. Security researchers have already demonstrated agents manipulated into exfiltrating sensitive data. A 2026 human risk framework has to account for two populations, human employees and the non-human identities working alongside them.

The regulations forcing measurement, not just training

For a growing share of organizations, human risk measurement is no longer optional, because regulators have started asking for evidence of behavior change rather than proof that a course was delivered.

The NIS2 Directive, in force across the EU's essential and important sectors, holds management personally accountable for cybersecurity risk management and, in practice, pushes auditors toward behavioral evidence rather than completion documentation. Its tight incident-reporting timelines, an initial notification within 24 hours and a fuller report within 72, only work if employees can recognize and escalate threats quickly, which makes reporting metrics a compliance concern, not just a security one. DORA, which governs EU financial entities, adds an even sharper requirement: major incidents must be reported within a short window after classification, so the workforce has to be capable of rapid recognition and escalation. Beyond Europe, HIPAA mandates security awareness training under its administrative safeguards, GDPR's accountability principle requires demonstrable and proportionate protection of personal data, and PCI DSS and SOC 2 both expect awareness programs backed by evidence of effectiveness. In every case, training without measurement fails the audit.

Mapping indicators to recognized control families is what turns a score into audit-ready evidence. Under the NIST Cybersecurity Framework 2.0, the Protect function houses both PR.AT (Awareness and Training) and PR.AC (Identity Management and Access Control), so a score that combines training and behavioral data with access-privilege levels demonstrates that both control families operate in reality, not just on paper. ISO 27001:2022's Annex A controls for human-resource security map cleanly to the same behavioral and hygiene signals. And there is a financial incentive layered on top of the regulatory one: cyber-insurance underwriters have begun weighing HRM maturity at renewal, and organizations that can show declining susceptibility and improving reporting are being offered better terms. That makes measured risk reduction a line item in the premium, not just the risk register.

The HRM maturity model: where programs actually sit

Most organizations overestimate where they stand. A four-stage maturity model gives you an honest place to locate your program and a realistic next step, and the research consensus is blunt about the fact that the majority are still near the bottom.

Stage 1, compliance-driven awareness. Annual training exists to satisfy an audit. The only metric is completion, and a 100% completion certificate reveals nothing about susceptibility, click rates, or exposure. Risk visibility is effectively zero.

Stage 2, risk-aware with basic simulation. Phishing simulations arrive, and with them the first real behavioral metrics: click rates, credential-entry rates, reporting rates, benchmarked against industry averages. This is a genuine step up, and it is where a large share of organizations plateau. What it still lacks is visibility beyond email, predictive signals, and any view of concentrated risk.

Stage 3, behavior-based with continuous monitoring. Dynamic scores now aggregate signals across email, voice, SMS, and deepfake simulations, plus training engagement and real-world reporting, and personalized interventions trigger automatically. This is the point at which a program manages risk rather than documenting it.

Stage 4, predict and prevent. Machine-learning models trained on historical patterns forecast who is trending toward high risk before an incident, interventions engage proactively, and human risk appears on a unified dashboard alongside endpoint, network, and cloud risk in terms a board understands, increasingly including AI agents as scored entities.

The important discipline, as SANS instructor Lance Spitzner has put it, is to progress one stage at a time. Jumping from compliance straight to optimization is neither practical nor sustainable, and a Stage 2 organization pretending to be Stage 4 usually ends up with an expensive dashboard nobody trusts.

Running the program: assess, prioritize, tailor, track

A maturity model tells you where you are. An operating loop tells you what to do on Monday. The most workable structure is APTT: Assess, Prioritize, Tailor, Track. Run it quarterly and you compress a maturity timeline from years into months.

Assess. Establish an honest baseline before you launch any training. Run a multi-channel simulation covering email and, where feasible, voice and SMS, so you see the whole attack surface rather than the email slice. Audit existing engagement data, remembering that completion tells you what people clicked and assessment scores tell you what they understood. Interview HR, legal, and business-unit leaders to find out why unsafe behaviors happen, because the root cause is often workflow friction rather than negligence.

Prioritize. This is where the concentration insight pays off. Identify the cohort driving disproportionate risk, usually 10-20% of the workforce, and treat it as a distinct population. Separate high attack-factor people (executives, finance, legal) from high behavioral-risk people (repeat clickers, low engagement), then find the intersection of high behavioral risk and high access privilege. That intersection is your highest-priority intervention target.

Tailor. One-size-fits-all training is the defining failure of legacy programs. Match content to role, because finance faces invoice fraud, engineers face credential harvesting, and executives face impersonation and deepfake BEC. Match simulations to channel, because someone who aces email may fold on a voice call. Escalate difficulty as people improve, so you are running realistic simulations rather than training to a stale test. And when someone fails, deploy a two-to-five-minute module on the exact pattern they missed, at the moment they missed it, while the lesson is visceral.

Track. Measurement cadence decides whether you manage risk or merely record it. Review susceptibility trends monthly, not quarterly. Watch the repeat-offender cohort separately from the general population. Present risk-score velocity, who is trending up or down, rather than static snapshots.

Two practical refinements make the loop sharper. First, map each risk tier to an automated response so a score always triggers an action: low-risk employees stay on baseline quarterly simulations, medium-risk employees get microlearning specific to the indicator that elevated them, high-risk employees prompt manager notification and a targeted multi-channel campaign with a 30-day reassessment, and critical-risk employees with privileged access and repeated failures face access restrictions on sensitive systems pending one-on-one remediation. Second, expect predictable spikes. Human risk deteriorates during mergers and acquisitions, when absorbed employees bring unfamiliar habits and cannot tell what is legitimate; during layoffs, when departing staff pose insider risk and survivors disengage; at quarter-end, when financial pressure narrows attention; and during open enrollment, when a flood of legitimate benefits email gives credential theft perfect camouflage. Plan interventions around those windows instead of being surprised by them.

Reporting human risk to the board

For a CISO, the real deliverable is often not the dashboard but the board conversation, and boards do not need more data. They need the right data translated into terms that connect to money, resilience, and regulatory standing. The World Economic Forum's 2026 outlook found that 99% of highly resilient organizations involve the board in cybersecurity governance and that around half provide regular board updates, so this is now a governance expectation rather than a courtesy.

Lead with a single risk-score trendline over several quarters, not an absolute snapshot, because a lone number means nothing while a downward slope tells directors whether the organization is getting safer. Follow it with the reduction in high-risk employee count, which answers the question boards care about most: is the program shrinking the population that drives the exposure? Add the reporting rate as a culture-health signal, since employees who flag suspicious messages within minutes have shifted from targets to defenders.

Then translate. A risk score becomes an exposure estimate tied to breach probability. A reporting rate becomes an operational-resilience metric describing how fast the organization detects and neutralizes threats. Training improvements become compliance-posture evidence for SOC 2, HIPAA, GDPR, and PCI DSS. Benchmark against peers by both vertical and organization size, because a 500-person fintech should not measure itself against a global bank, and directors instinctively understand competitive comparison. The economic case is easy to make when you attach it to real losses: the FBI's 2025 Internet Crime Report tallied USD 20.9 billion in reported losses, with business email compromise alone driving roughly USD 3 billion in the United States and phishing and spoofing generating the single largest volume of complaints. A director who hears that human risk exposure fell meaningfully year over year can act on it. A director who hears that the team completed thousands of modules cannot.

The debates you should be honest about

A guide that only sells the category is not worth much. The field has genuine controversies, and being ready to discuss them is what earns credibility with a skeptical CISO.

Does security awareness training actually work? This is the sharpest debate, and it deserves a straight answer. Research presented at the 2025 IEEE Symposium on Security and Privacy by teams from the University of Chicago and UC San Diego found no meaningful correlation between annual awareness training and reduced phishing failures, and related work found that embedded training delivered after a failure cut subsequent clicks by only about two percentage points, with most employees engaging with it for under a minute. Those findings are real and should not be waved away. The counter-evidence is also real: KnowBe4's large-scale benchmarking shows an 86% drop in susceptibility after a year of continuous training, and a 2025 longitudinal study of more than 1,300 employees and 13,000 simulated emails (arXiv:2510.27298) found that sustained, continuous simulation and training roughly halved susceptibility. The resolution emerging in the literature is that the type of training is decisive. Annual, generic, completion-focused training does little. Continuous, adaptive, behavior-based training that intervenes at the moment of failure does measurably reduce risk. The criticism lands on legacy SAT, and human risk management is the response to it, not the target of it.

Where is the line between measurement and surveillance? Scoring individuals raises legitimate concerns. Continuous monitoring can drift toward workplace surveillance, false positives can flag legitimate work (a finance manager closing a deal at midnight), employees who know they are scored on reporting may report everything to game the metric, and structural differences in exposure can make scoring systems flag whole groups unfairly. The defensible answer is to treat scoring as supportive rather than punitive: report at the department and trend level rather than naming individuals to leadership, anonymize and aggregate wherever possible, keep individual remediation private, and publish a clear policy drawing the line between security measurement and surveillance. Under GDPR that policy is a requirement, not a nicety, and a program that breeds resentment tends to increase human risk rather than reduce it.

Is HRM just security awareness training with a new label? Sometimes, honestly, yes. Plenty of vendors rebranded without changing their methodology. The real boundary is not whether a product offers simulations alongside modules, it is whether the program measures risk instead of activity, tracks individuals instead of averaged populations, monitors continuously instead of periodically, and produces evidence that an intervention worked rather than documentation that it occurred.

Should technical controls just replace behavioral training? Some argue that the consistent shortcomings of training mean the money belongs in filtering, isolation, and stronger authentication instead. Those controls matter enormously, but they cannot cover the whole surface. An employee still makes trust judgments on phone calls, in-person requests, and channels that bypass email filters entirely, and a convincing deepfake call from the apparent CEO offers no technical guardrail at the moment of decision. The workable stance is defense in depth: technical controls reduce the frequency and severity of incidents, behavioral programs reduce susceptibility and build detection, and neither is sufficient alone.