[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Why Human Risk Management is Now Critical in Cybersecurity](/blog/why-human-risk-management-is-important) Publish date August 7, 2025 {x} minute read # Why Human Risk Management is Now Critical in Cybersecurity [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Michael Tan](/team/michael-tan) Senior Product Marketing Manager Michael is helping UpGuard build the world's best human risk management tools. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) It’s no secret that human error still plays a significant role in data breaches - despite ongoing security and awareness training. But how do we finally disrupt this trend? The answer lies in a new approach to human risk management. ## What is human risk management (HRM)?  Human Risk Management (HRM) is a proactive cybersecurity approach that identifies, quantifies, and mitigates security risks stemming from human behavior.  HRM supports Security Awareness & Training (SA\&T) programs, expanding their impact to equip security teams and stakeholders with real-time awareness of each employee's individual cyber risk profile. ### The shift to HRM: Why now? Despite the popularity of SA\&T programs, human-related breaches continue to rise, with [Forrester predicting that 90% of data breaches in 2024 will involve human error](https://www.forrester.com/blogs/predictions-2024-security-and-risk/).  While Security Awareness & Training remains an essential component of a cybersecurity program, it alone can't address the full scope of human-related cyber threats. It's clear that SA\&T must align with a larger, more proactive cyber risk management strategy. Forrester recognizes the need for this critical change, as evidenced by its reclassification [of SA\&T under Human Risk Management in 2024.](https://www.forrester.com/blogs/the-future-is-now-introducing-human-risk-management/) > Much like endpoint security evolved beyond traditional antivirus solutions, HRM builds on SA\&T principles to deliver a more comprehensive and outcomes-driven cybersecurity necessity. ## Why is human risk management important? Human Risk Management is an important component of cybersecurity because human error is a major contributor of many breaches. In 2023, [74% of breaches involved a human element](https://www.sans.org/blog/parsing-the-2023-vz-dbir-for-the-human-element/). Year after year, [phishing](https://www.upguard.com/blog/phishing), credential theft, and user error remain among the top attack vectors. ‍[IBM's 2024 Cost of a Data Breach report ](https://www.ibm.com/reports/data-breach)confirms this, finding that stolen credentials were the initial attack vector in 16% of breaches- the most common IT environment entry point, followed closely by phishing at 15%.  The chart below illustrates the persistent prevalence of [data breaches](https://www.upguard.com/breaches) caused by human error over time, highlighting the importance of a modified approach to human risk management programs. ### Examples real-world data breaches tied to human factors Behind every major breach, there's a human story. Here is a list of recent major cybersecurity events that exploited human vulnerabilities.  ### 2011 #### RSA Security Breach Attackers used phishing emails to trick RSA employees into opening malicious attachments, leading to the compromise of SecurID authentication tokens used by millions. [Read on Wikipedia](https://en.wikipedia.org/wiki/EMC_Security_Division#2011_security_breach) ### 2012 #### Dropbox Data Breach A Dropbox employee's account was compromised through a reused password, leading to the theft of a project document containing user email addresses, which were subsequently targeted in spam attacks. [Read on The Verge](https://www.theverge.com/2012/7/31/3208681/dropbox-security-breach-spam) ### 2013 #### Target Data Breach Attackers gained access to Target's network by compromising credentials from a third-party HVAC vendor, leading to the theft of credit and debit card information of approximately 40 million customers. [Read on Krebs on Security](https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/) ### 2014 #### Sony Pictures Hack The hacker group "Guardians of Peace" infiltrated Sony Pictures' network, leaking confidential data, including unreleased films and employee information. The attackers used spear-phishing emails targeting employees to install malware, emphasizing the dangers of social engineering. [Read on Vumetric](https://www.vumetric.com/blog/top-5-cyberattacks-caused-by-human-error/) ### 2015 #### Anthem Data Breach Anthem, a major health insurance company, suffered a data breach compromising personal information of nearly 80 million individuals. Attackers gained access through phishing emails sent to employees, highlighting the risks of inadequate employee training on cybersecurity. [Read on Vumetric](https://www.vumetric.com/blog/top-5-cyberattacks-caused-by-human-error/) #### Ukrainian Power Grid Attack Attackers used spear-phishing emails to gain access to Ukrainian power companies' networks, leading to a power outage affecting 225,000 customers. [Read on Wired](https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/) #### Ubiquiti Networks Fraud Ubiquiti Networks lost $46.7 million in a business email compromise attack, where fraudsters impersonated company executives and instructed employees to transfer funds to overseas accounts. [Read on KnowBe4](https://blog.knowbe4.com/tech-firm-ubiquity-suffers-46m-cyberheist) ### 2018 #### SingHealth Data Breach Between June 27 and July 4, 2018, Singapore's largest group of healthcare institutions, SingHealth, experienced a cyberattack that compromised personal data of 1.5 million patients, including the Prime Minister. The breach was attributed to inadequate staff training and delayed patching of system vulnerabilities. [Read on Wikipedia](https://en.wikipedia.org/wiki/2018_SingHealth_data_breach) #### Pathé Fraud French cinema chain Pathé's Dutch subsidiary lost €19 million after executives fell victim to a business email compromise scam, transferring funds to fraudsters posing as company officials. [Read on Bank Info Security](https://www.bankinfosecurity.com/blogs/french-cinema-chain-fires-dutch-executives-over-ceo-fraud-p-2681) ### 2019 #### Capital One Data Breach A misconfigured firewall allowed an attacker to access sensitive data of over 100 million Capital One customers, including Social Security numbers and bank account details. The breach was not identified during routine security audits, leading to prolonged exposure. [Read on Vumetric](https://www.vumetric.com/blog/top-5-cyberattacks-caused-by-human-error/) ### 2020 #### Twitter Hack In July 2020, Twitter suffered a significant security breach where cybercriminals orchestrated a social engineering attack, taking over high-profile accounts, including those of companies like Apple and individuals such as Bill Gates and Elon Musk. [Read on Terranova Security](https://www.terranovasecurity.com/blog/what-the-twitter-hack-revealed-about-social-engineering) #### Interserve Goup Limited Data Breach In May 2020, Interserve, a UK-based outsourcing and construction company, suffered a cyberattack initiated by a phishing email. The attack compromised personal data of up to 113,000 current and former employees. The Information Commissioner's Office (ICO) fined Interserve £4.4 million in October 2022 for failing to prevent the data breach, citing outdated software and inadequate staff training as contributing factors. [Read on Foot Anstey](https://www.footanstey.com/our-insights/articles-news/cyber-risk-interserve-group-fined-4-4-million-for-employee-data-breach/) ### 2021 #### Colonial Pipeline Ransomware Attack In May 2021, Colonial Pipeline, a major U.S. fuel pipeline operator, suffered a ransomware attack that led to a shutdown of operations. The breach was initiated through a compromised password from an old VPN account that lacked multi-factor authentication, highlighting the risks of inadequate password management. [Read on Reuters](https://www.reuters.com/business/colonial-pipeline-ceo-tells-senate-cyber-defenses-were-compromised-ahead-hack-2021-06-08/) ### 2022 #### Uber Breach In September 2022, Uber disclosed that it suffered a breach facilitated through a multi-factor authentication (MFA) fatigue attack. The attacker disguised themselves as Uber IT and repeatedly sent MFA requests to an employee until they approved the access, leading to a full system compromise. [Read on InfoQ](https://www.infoq.com/news/2022/09/Uber-breach-mfa-fatigue/) These incidents prove that even companies with well-funded technical defenses can be crippled by a data breach linked to human error. > "Most cyber attacks begin by targeting a human weakness. Technology alone cannot accommodate for all human exploits in risk management programs."\ > \ > \- Phil Ross (CISO, UpGuard) ## Why technology alone isn't enough  While firewalls, antivirus, and encryption are essential, they can't fix poor judgment, bad habits, or lack of awareness. One study found that over [90% of employees knowingly engage in risky behaviors](https://www.google.com/search?client=safari\&rls=en\&q=Gartner%E2%80%99s+Calling+for+a+Human-Centric+Approach+to+Cybersecurity+-+Here%E2%80%99s+How+to+Implement+It+-+Cyber+Defense+Magazine\&ie=UTF-8\&oe=UTF-8), such as reusing passwords or clicking suspicious links. The rise of AI-driven cyber threats means traditional digital defenses are becoming easier to fool. Attackers now use Generative AI to create hyper-realistic phishing emails, deepfake audio to impersonate executives, and AI chatbots to personalize scam messages at scale.  Deepfake-related phishing [surged over 3,000% in 2023](https://www.forbes.com/councils/forbestechcouncil/2024/01/23/deepfake-phishing-the-dangerous-new-face-of-cybercrime/), and the [World Economic Forum warns that AI-powered scams](https://www.weforum.org/stories/2025/01/how-ai-driven-fraud-challenges-the-global-economy-and-ways-to-combat-it/)are becoming more convincing than ever. An HRM platform fills this defense gap by strengthening [the human factor in cybersecurity](https://www.upguard.com/blog/human-factors-in-cybersecurity)—encouraging training participation, reinforcing ideal behaviors, and tracking [insider threat](https://www.upguard.com/blog/insider-threat) activities—so employees become an active part of an organization's boundary defense system, even against AI-enhanced threats. ## The Cost of ignoring human cyber risks A single phishing email can set off a chain reaction of costly repercussions, including the activation of resource-heavy incident response plans, legal fines, lost customers, and long-term brand damage. The [2013 Target breach](https://www.idstrong.com/sentinel/that-one-time-target-lost-everything/), caused by the phishing of a third-party contractor, led to lawsuits, stock declines, and the CEO's resignation. More recently, the [2023 MGM Resorts cyber attack](https://investors.mgmresorts.com/investors/news-releases/press-release-details/2023/MGM-RESORTS-UPDATE-ON-RECENT-CYBERSECURITY-ISSUE/default.aspx), enabled by social engineering a helpdesk employee, brought casino and hotel operations to a standstill. ### The average cost of a data breach in 2024 was USD 4.35 million IBM reports that "lost business" (downtime, customer churn, and reputational harm) is the biggest driver of breach costs, averaging [$1.59 million per incident](https://www.armis.com/faq/what-is-the-average-cost-of-a-data-breach/). The Colonial Pipeline attack, caused by a single compromised password, l[ed to nationwide fuel shortages and economic disruption.](https://www.reuters.com/business/colonial-pipeline-ceo-tells-senate-cyber-defenses-were-compromised-ahead-hack-2021-06-08/) ### Regulatory and compliance risks Cybersecurity is no longer just an IT concern. Regulators now hold organizations accountable. [GDPR fines can reach 4% of global revenue or €20 million](https://gdpr-info.eu/issues/fines-penalties/), whichever is higher, with penalties frequently imposed for phishing-related breaches, as evidenced by the Interserve Gourp Limited breach in 2020 (see timeline above). In the U.S., [SEC rules require public companies](https://corpgov.law.harvard.edu/2023/12/03/sec-risk-factors-disclosure-analysis/) to disclose cybersecurity risk management strategies, including how they mitigate human risk. Compliance frameworks like [NIST SP 800-53](https://www.upguard.com/blog/nist-sp-800-53) and [ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) also mandate security awareness training.  > Ignoring the human element doesn’t just weaken security, it increases legal and financial exposure. ## Common human cyber risk mitigation strategies (and why they fail) Most organizations attempt to address human cyber risk through a standardized model comprising security training, phishing simulations, and policy enforcement, but these traditional efforts alone often fall short. Some common strategies for combating human-related security events include: * **Security Awareness & Training (SA\&T):** Employees complete [annual or quarterly cybersecurity modules](https://www.cyberdefensemagazine.com/gartners-calling-for-a-human-centric-approach-to-cybersecurity-heres-how-to-implement-it/), primarily to meet compliance requirements. Because training events occur at a single point in time, this approach alone does not support real-time visibility into emerging human cyber risks. * **Phishing Simulations:** While very helpful, these tests can become resource-intensive as they attempt to address the complete scope of phishing tactics. If not done thoughtfully, organizations can invest heavily but notice limited improvement in the company's overall personal security hygiene.  * **MFA and password policies:** While authentication controls are critical, users could quickly lose patience and find workarounds—as evidenced by the [MFA fatigue that led to Uber's breach](https://www.infoq.com/news/2022/09/Uber-breach-mfa-fatigue/). * **Risk assessments & compliance audits:** Some organizations conduct annual risk assessments, but these static reports don't track how an employee's risk changes over time. > Despite billions spent on these programs, phishing clicks, malware infections, and policy violations remain persistent problems, security leaders often wonder if these efforts are making an impact. ## Why these approaches fall short ### Memory fades quickly Security training is perpetually battling Ebbinghaus's Forgetting Curve, an information retention model that says people forget 90% of what they learn within a week without reinforcement. > Without continuous engagement, security training doesn’t translate into long-term behavior change. ### Lack of engagement & relevance Generic, one-size-fits-all security training does not resonate equally with all employees. The same security guidelines do not apply to developers and salespeople—developers require more technical training covering security coding practices, which is completely irrelevant to the sales staff.  Broadening cybersecurity training to maximize workplace relevance often requires omitting advanced security knowledge that is beneficial for technical roles. As a result, some employees may remain security liabilities even after completing the training. The [SA\&T market is projected to reach $10 billion by 2027](https://www.forrester.com/blogs/the-future-is-now-introducing-human-risk-management/), yet breaches keep rising. A[ SANS Institute stud](https://www.sans.org/blog/parsing-the-2023-vz-dbir-for-the-human-element/)y found that even with widespread security awareness programs, 74% of organizations still fell victim to phishing attacks.  > Measuring quiz completion rates doesn’t reduce risk—actual behavior change does.\ > \ > \- Masha Sedova (Human Risk expert) It is important to note that security training does work. It remains one of the most effective tools for preventing human-related cyber incidents. However, this branch of internal risk mitigation must evolve with the fast-paced nature of the modern threat landscape, where AI advancements allow even the most novel hacker to create and deploy advanced social engineering attacks at scale. ### Siloed security data Most organizations lack a unified view of human risk. Phishing test results, IT logs, and HR data sit in disconnected systems, preventing security teams from seeing which employees pose the greatest risk.  If an employee clicks multiple phishing emails, triggers antivirus alerts, or has access to sensitive financial data yet passes a cybersecurity quiz, fragmented security data would prevent a holistic view revealing the employee's need to be flagged as "high risk.". For example, if an employee clicks multiple phishing emails, triggers antivirus alerts, and has access to sensitive financial data, they should be flagged as "high risk," but fragmented security data would prevent the holistic view required to see this.. ### A reactive, periodic approach If an employee fails a phishing test in January, they might get a remedial video—but what happens when an actual attack occurs in July? Delayed, one-off interventions don't provide real-time reinforcement, leaving employees vulnerable. Ultimately, traditional "train and test" approaches focus more on compliance than actual risk reduction. Organizations will see high-risk behaviors persist without reinforcement, role-specific engagement, and continuous monitoring. To truly mitigate human risk, security must move beyond awareness to active risk management. ## The future of human risk management in business  Security-driven organizations are moving beyond checkbox training to data-driven, behavior-focused human risk management (HRM). The future of HRM is defined by [continuous monitoring](https://www.upguard.com/blog/continuous-security-monitoring), risk-based prioritization, real-time behavioral reinforcement, and deep security integration. ### Continuous risk detection & monitoring Traditional risk assessments provide only snapshots of risk exposure at a single point in time, which can result in a misleading report on your organization's actual human cyber risk exposure. This data discrepancy is further expanded by failing to consider the complete spectrum of metrics influencing human cyber risk profiles—a characteristic of most traditional risk assessments, which include: * Phishing interactions * Security Awareness & Training participations * Shadow IT or [Shadow SaaS](https://www.upguard.com/blog/shadow-saas) usage * AI tool adoptions * File-sharing activities By integrating with [IAM](https://www.upguard.com/blog/what-is-iam), email security, [endpoint protection](https://www.upguard.com/blog/endpoint-detection-and-response), and [SIEM](https://www.upguard.com/blog/siem) logs, Human Risk Management solutions offer continuous visibility across all human cyber risk [attack vectors](https://www.upguard.com/blog/attack-vector), giving you real-time awareness of your organization's evolving human cyber risk exposure. An HRM platform helps security teams make informed decisions about specific human security practices impacting an organization's security posture. Consider the scenario of an employee interacting with multiple phishing emails in a given month—outside of a scheduled point-in-time risk assessment period.  With an HRM platform properly integrated across all relevant human cyber risk insights, the event is immediately flagged, triggering instant interventions, such as sending an alert to the direct manager or flagging the employee as requiring additional SA\&T. The result is real-time awareness of emerging human cyber risks. A point-in-time risk assessment approach alone would not have detected this malicious activity or any other arising cyber threats until the next scheduled risk assessment. ### Risk-based prioritization Not all employees pose the same risk—a small subset often contributes disproportionately. In one study, [8% of users were responsible for 80% of security incidents](https://www.bankinfosecurity.com/hrm-crisis-8-employees-cause-80-incidents-a-25184). HRM identifies these high-risk individuals and tailors interventions accordingly. Instead of blanket training, HRM assigns risk scores based on user behavior, such as frequent phishing clicks, failed MFA attempts, or security violations. Higher-risk users receive targeted coaching or stronger controls, while low-risk employees may require less frequent training. ### Behavioral reinforcement To combat the forgetting curve, consider implementing an HRM solution employing real-time nudges—timely, contextual prompts that reinforce secure actions at the moment of decision. For example: * If a user sets a weak password, they receive an immediate warning: *"This password appears too weak, please choose a stronger one."* * Before clicking a suspicious link, a real-time alert might ask, *"This email looks suspicious. Are you sure you trust it?"* * When plugging in a personal USB, a system alert notes: *"External USB devices can introduce security risks—please scan for malware before accessing files."* Unlike traditional training, which tells employees what to do once a year, HRM coaches them in real-time. Security becomes a daily habit, not a one-off compliance task. ### Integration with the security ecosystem HRM doesn't replace existing security measures and tools—it enhances them. By integrating a Human Risk Management platform with IAM, SIEMs, email security, and endpoint detection tools, an HRM tool broadens human attack vector contextualization—creating a risk management strategy based on each employee's true cyber risk profile. With HRM insights feeding into SIEM systems, correlating user risk data with broader security threats, it becomes possible to establish automated response triggers based on human risk signals, such as: * High-risk users automatically receiving stricter MFA requirements. * Increasing email filtering sensitivity for employees with repeated phishing failures. * Automatic user session termination upon detecting high-risk activities, such as attempts to access unauthorized data or execute prohibited commands. * Dynamically restricting or revoking access permissions for users exhibiting anomalous behavior or suspected account compromise. * Automatically enrolling employees who exhibit risky behavior patterns into targeted security training or awareness modules. * Initiating automated security alerts to SOC teams for immediate review when users access sensitive data outside regular working hours or from unusual locations. * Temporarily limiting network access for users whose accounts appear to have been affected by recent credential breaches detected on the dark web. * Automatically requiring password resets or identity verification steps for users exhibiting signs of account compromise, such as simultaneous logins from multiple locations. * Triggering increased endpoint monitoring or isolation protocols on devices associated with repeated unsafe behaviors, like downloading unauthorized software or engaging in unsafe browsing habits. The automation potential introduced by HRM tools eliminates manual processes, allowing security teams to act faster and focus their energy on cyber threat prevention rather than remediation. ## How security leaders should manage human cyber security  As cybersecurity threats evolve, managing human risk must become a core security priority—not just a compliance requirement.  By continuously analyzing risk trends and behavioral patterns, HRM allows security teams to refine their approach over time, ensuring resources are focused where they have the most significant impact. Here's how security leaders can embed Human Risk Management (HRM) into their strategy for long-term impact. ### 1. Treat human risk like any other cyber risk Just as organizations track technical vulnerabilities, incident rates, and threat intelligence, they must quantify human risk. This means defining key metrics like phishing click rates, policy violations, and user risk scores—and reporting them alongside technical risk data to leadership and the board.  > What gets measured gets improved and human risk is no exception. ### 2. Build a security culture Compliance training is necessary but not sufficient. A strong [cybersecurity culture](https://www.upguard.com/blog/developing-a-culture-of-cybersecurity) means employees feel responsible for cybersecurity and are not just obligated to complete training. * Use real-world incidents, gamified challenges, and interactive training to make learning engaging. * Encourage mistake reporting without punishment—so employees learn instead of fearing security. * Partner with HR or leadership to make security a company-wide initiative, not just an IT function. ### 3. Implement continuous, role-based training Organizations should shift to ongoing, bite-sized learning tailored to specific roles and risks. * Developers need secure coding workshops, while finance teams need anti-fraud training. * Executives require CEO fraud awareness and deepfake recognition. * Incorporate real-world threats (e.g., AI-generated simulated phishing attacks), so employees recognize evolving tactics. ### 4. Integrate human risk into security operations HRM should connect with existing security tools and not function in isolation. Security teams understand user risk by integrating phishing data, access logs, and security alerts. * High-risk users can be automatically flagged for extra monitoring or stricter [MFA](https://www.upguard.com/blog/mfa-multi-factor-authentication). * If users fail multiple phishing tests, their email filtering can be increased automatically. * Security teams can automate interventions—ensuring timely responses to risky security behaviors. ### 5. Secure leadership buy-In & accountability HRM requires executive support to succeed. * Security leaders should educate the C-suite with clear data, case studies, and real-world examples. * Set measurable targets (e.g., "Reduce phishing click rate by X% in 2024") and track progress. * Encourage executives to lead by example—for instance, participating in phishing simulations. ### 6. Prepare for AI-driven threats The next wave of attacks will use AI to bypass traditional security. Organizations must train employees to recognize AI-enhanced scams, like deepfake phishing and synthetic voice fraud. * AI will also play a defensive role, helping analyze risky behaviors, auto-generate training content, and predict which users need intervention. * Keeping HRM adaptive ensures security teams stay ahead of emerging threats. ## How UpGuard can help you with human cyber risk mitigation UpGuard simplifies Human Risk Management by tracking emerging threats across three major human cyber risk categories in real-time: * **User identities: **Risks linked to compromised internal credentials * **Applications: **Risks associated with shadow IT practices * **Data: **Risks associated with sensitive data sharing For a quick overview of how UpGuard can help you effectively manage human cyber risks, watch this video: eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [How User Risk Finds the Shadow AI Outside Your Directory](/blog/find-shadow-ai-outside-your-directory) Your directory shows the AI tools you approved. Here’s how User Risk finds the ones in your browsers that it doesn’t, before an auditor asks. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [How to Mitigate Human Risk in Cybersecurity: A Practical Framework](/blog/how-to-mitigate-human-risk) Security awareness training alone isn't human risk management. Use this seven-step framework to discover, govern, and coach workforce behavior. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 Human Cyber Risk #### [Best AI Governance Platforms and Software (2026 Comparison)](/blog/best-ai-governance-platforms) Compare the top AI governance platforms of 2026 and find the right fit for your workforce and compliance needs. [](/team/shane-moosa) [Shane Moosa](#) August 10, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)