What is human risk management?
Human risk management (HRM) is the practice of measuring and reducing the security risk created by employee behavior - clicks, credential habits, data handling - rather than just delivering training about it. An HRM program quantifies each person’s susceptibility through simulation and observation, targets interventions at the individuals and behaviors that carry the most risk, and tracks whether behavior actually changes over time.
Also known as: human risk management · HRM · human cyber risk · human attack surface management · behavioral cybersecurity
From awareness to behavior
Security awareness programs answer "have employees been told?" Human risk management answers "has the risk gone down?" The difference is measurement: HRM platforms establish a per-person baseline - who falls for which manipulation techniques, who reports, who improves - and treat the workforce like any other attack surface, with metrics, prioritization and remediation. Training becomes one intervention among several, applied where the data says it is needed.
What a mature program looks like
A working HRM program runs continuous, personalized simulations rather than annual blasts; delivers coaching at the moment of risky behavior rather than months later; makes reporting suspicious messages effortless so the workforce feeds the SOC; and reports a human-risk trend the CISO can put in front of the board. Dcoya’s platform - Behave for personalized simulation, Beware for reporting, Bewise for in-the-moment nudges - implements exactly this loop.
In the Lionet portfolio
Dcoya measures and changes the human attack surface - distributed by Lionet.
FAQ
Common questions.
How is human risk management different from security awareness training?
Awareness training is content on a schedule; HRM is a measured program. HRM uses simulation and behavioral data to find each person’s actual weaknesses, intervenes there, and verifies the change - awareness training is one tool inside that loop, not the loop itself.
What metrics does a human risk management program track?
Phish-click rate per cohort and per person, report rate and time-to-report for suspicious messages, repeat-offender trends, and improvement against the baseline established at program start - behavior metrics, not completion certificates.
Which vendor provides human risk management?
In the Lionet portfolio, Dcoya - founded in Tel Aviv in 2015 and part of NINJIO since 2022 - provides ML-personalized simulation, reporting and behavioral nudges. Lionet distributes Dcoya through channel partners with engineer-led pilot campaigns.
Related explainers: What is security awareness training?Why does security awareness training fail?What is business email compromise (BEC)?
Weighing approaches? Personalized behavioral training vs annual awareness training: what actually changes behavior?