Metrics
What is human risk?
The likelihood that everyday human behavior leads to a security incident.
In more detail
It is the outcome every security awareness program exists to reduce, and the story a quarterly review should tell with trend lines rather than a single snapshot. Increasingly the term analysts use for the category as a whole.
Why it matters
It reframes the conversation from training completion to measurable risk reduction, which is the language boards and underwriters use.
Related terms
The percentage of people who reported a suspicious message rather than ignoring or clicking it.
Measuring how an organization performs against each manipulation tactic — urgency, authority, scarcity, trust, helpfulness and social proof — rather than scoring individual people.
Security awareness training is any structured program that teaches people to recognize and respond to cybersecurity threats — phishing, social engineering, malware and password hygiene.
Vocabulary is the easy part. Behavior is the job.
Thirty minutes, a live account, and a straight answer about where your people actually stand.