Human risk management that shows who’s at risk, and brings it down

Human risk management (HRM) is the continuous process of measuring how employees respond to cyber threats, stepping in with the right training or action when someone’s risk rises, and tracking whether risk falls over time. It replaces “who finished the course” with “who would fall for the attack.”

Seven inputs contribute: email simulation clicks and credential submissions; SMS taps; compliance with simulated voice requests; acting on deepfake videos; threat reporting; training completion and exams; and leaked work credentials. Reporting attacks and passing exams move the score toward safer groups. Risky actions and credential exposure raise the need for support. Read the contributing behaviors and trends rather than treating someone’s job title as a risk prediction.

High: New or untrained, or showing risky behavior. Focused path + manager informed. Average: Some training done; still needs follow-up. Monthly lessons + harder simulations. Low: Most training complete; spots fakes most of the time. Lighter touch, monitored. Safe: All training done; reports what they see. Advanced scenarios to stay sharp. Behavior moves people between groups; Safe does not mean immune to attack.

Yes. For the repeat-clicker playbook, the trigger is three simulation clicks in 30 days across email, SMS or QR. Check that the employee is not already on a focused path, then assign four short credential-safety lessons and an exam. Inform the manager at 80% of the training deadline and copy HR at 90% if it remains open. Scores respond as learning and reports arrive; once the learner returns to Low, use harder simulations. Separate playbooks can respond to a breached password or a vishing failure.

Training completion cannot tell you whether a work password has leaked. Continuous scans of public breach data and dark-web sources find exposures, including password hashes in third-party breach datasets. A match raises the person’s score, triggers an immediate alert and password-reset request, and assigns a password-hygiene lesson for follow-up.

No. Available channels and integrations depend on the package. SIEM events are available on Diamond plans. Check the pricing page or confirm requirements with the team before choosing a plan.

Four responses connect measurement to action: a two-minute lesson at the moment of a mistake, a new learning path matched to the behavior, escalation to a manager, HR or leadership, and events delivered to your SIEM on Diamond plans. Available simulation channels vary by package.

Look for credential submissions, breached work passwords, compliance with a cloned-voice request, three or more simulation clicks in 30 days, and unverified QR scans. Combine those with overdue learning. For example, an Accounts Payable employee who clicks invoice lures, has an exposed password and has an overdue course can receive a payment-fraud path with manager follow-up.

A one-page report brings together the organization’s risk score, the change from the previous quarter, reporting and click rates, the riskiest department, the number of people who moved out of High, and the interventions taken. A six-month department heat map shows where risk concentrates. Next-quarter actions can include payment-fraud training for Finance and voice-clone verification for executives.

Move from who finished to who is at risk and why; from generic courses to behavior-triggered training; and from email-only tests to supported email, SMS, voice and deepfake simulations plus leaked credentials. Continuous scoring replaces an annual review, automated playbooks replace manual chasing, and a board-ready risk report complements the completion export.

Yes. Start a 30-day free trial with no credit card to see your organization’s Human Risk Management. Risk scoring is included in published plans; compare the pricing page for the simulation channels, support and integrations your team needs.