Metrics
What is human risk?
The likelihood that everyday human behavior leads to a security incident.
In more detail
It is the outcome every security awareness program exists to reduce, and the story a quarterly review should tell with trend lines rather than a single snapshot. Increasingly the term analysts use for the category as a whole.
Why it matters
It reframes the conversation from training completion to measurable risk reduction, which is the language boards and underwriters use.
Related terms
The percentage of people who report suspicious messages instead of ignoring or clicking them.
Measuring how an organization performs against each manipulation tactic — urgency, authority, scarcity, trust, helpfulness and social proof — rather than scoring individual people.
Security awareness training is any structured program that teaches people to recognize and respond to cybersecurity threats — phishing, social engineering, malware and password hygiene.
Vocabulary is the easy part. Behavior is the job.
Thirty minutes, a live account, and a straight answer about where your people actually stand.