Human Risk Management

The practice of human risk management is revolutionising how organisations approach cybersecurity by placing people at the centre of their defence strategies. As cyber threats continue to evolve and target individuals within organisations, this concept provides a critical framework for mitigating risks associated with human behaviour and decision-making.

The goal is to establish a security-conscious culture where people are empowered to make informed decisions that protect the organisation’s assets and data. By focusing on the human aspect of cybersecurity, organisations can better address the root causes of many security incidents, such as phishing attacks, social engineering, and insider threats.

HRM represents a shift from a purely technical approach to cybersecurity to one that recognises the critical role of human behaviour in maintaining a robust security posture. This strategic approach acknowledges that while technology is essential, the actions and decisions of individuals often determine the success or failure of security measures.

While human risk management shares similarities with measures like security awareness training, organisations are increasingly embracing this framework as a more complete approach to combating data breaches and security threats. This shift is driven by the recognition that human behaviour is a critical factor in security incidents and that traditional methods are no longer sufficient to address the evolving threat landscape.

Forrester’s 2024 prediction highlights this urgency, anticipating that people will be a primary factor in 90% of data breaches. This forecast reflects a growing awareness that threat actors increasingly target individuals through sophisticated social engineering tactics, making human behaviour a significant vulnerability. As organisations grapple with the limitations of technology-focused solutions, they realise that while technical safeguards are essential, they cannot fully protect against human error or intentional insider threats.

The recent shift to remote work has further emphasised the need for robust human-centred security measures. With distributed workforces expanding the attack surface, organisations must adapt their strategies to mitigate risks associated with employees working outside traditional office environments. Additionally, increasing regulatory pressures are compelling organisations to take a more proactive stance in managing human-related security risks.

The timing of this transition is critical, as advancements in behavioural analytics enable organisations to effectively understand and predict human behaviour in the context of cybersecurity. Coupled with the rising costs of data breaches—averaging in the millions—there is a pressing need for more effective risk management strategies.

Human risk refers to the potential for individuals in an organisation to inadvertently or intentionally compromise security through their actions, decisions, or behaviours. This risk is inherent in every organisation, as people are both a primary vulnerability and defence in the security ecosystem.

Challenges

Managing human risk presents several unique challenges:

• Variability: Each individual has unique knowledge, habits, and risk tolerance levels, making standardised approaches less effective. This diversity requires tailored strategies to address varying needs and behaviours.
• Measurement difficulties: Quantifying human risk can be challenging, as it involves both tangible and intangible factors. Traditional metrics may not fully capture the complexities of human behaviour in security contexts.
• Evolving threats: Cyber criminals continuously adapt their tactics, exploiting human psychology in increasingly sophisticated ways. This constant evolution requires organisations to stay agile in their approach to human risk management.
• Balancing security and productivity: Overly restrictive security measures can hinder productivity and lead to workarounds, while lax measures increase vulnerability. Achieving the right balance is crucial for effective risk management.
• Maintaining engagement: Sustaining long-term interest and commitment to security practices among employees can be difficult, especially when threats are not immediately visible.

Psychology

Understanding the psychology behind human risk is crucial for effective management:

• Cognitive biases: People often make security decisions based on heuristics or mental shortcuts, which can lead to errors in judgement. For example:
  • The “optimism bias” may cause individuals to underestimate their risk of falling victim to a cyber-attack.
  • The “availability heuristic” might lead people to focus on familiar threats while overlooking less publicised but equally dangerous risks.
• Emotional factors: Stress, fatigue, and other emotional states can significantly impact decisions made in security contexts. High-pressure situations may lead to hasty actions that compromise security.
• Motivation and incentives: Personal motivations and organisational incentives are crucial in shaping security behaviours. Aligning security practices with individual and company goals can enhance compliance.
• Risk perception: How individuals perceive and evaluate risk can vary and is influenced by factors such as past experiences, cultural background, and personal values.
• Social influence: Peer behaviour and organisational culture significantly impact individual security practices. Colleagues’ and leaders’ actions can set powerful examples, either reinforcing or undermining security efforts.

Nudge Theory

Nudge theory offers a promising approach to addressing human risk by guiding individuals towards better security decisions without restricting their choices:

• Default settings: Configuring systems with secure defaults can encourage safer behaviour without requiring active decision-making. For example, strong password requirements can be set by default.
• Framing: Presenting security information to highlight potential losses can motivate individuals to take protective actions. This could involve showing the potential cost of a data breach instead of abstract security concepts.
• Social proof: Leveraging peer influence by showcasing the positive security behaviours of colleagues can encourage others to follow suit. For instance, highlighting departments with high-security compliance rates.
• Choice architecture: Creating an environment that presents choices to promote better security decisions. For an organisation, this might include strategically placing security reminders or simplifying security processes.
• Feedback loops: Providing immediate and clear feedback on security actions can reinforce positive behaviours and quickly correct risky ones.

While nudging can be effective, it should not be relied upon as the sole strategy for managing human risk. A comprehensive approach should combine nudging with other elements such as education and training, cultural development, technology integration, and continuous assessment. By taking a holistic view of human risk and employing a diverse set of strategies, organisations can more effectively mitigate the vulnerabilities associated with human activity.

As cyber threats continue to escalate and target individuals within companies, HRM serves as a critical framework for mitigating them. Here are some of the most fundamental pillars that underscore HRM’s importance as a progressive approach to combating threats.

Addressing the Human Factor

The importance of HRM lies primarily in its focus on the human element of cybersecurity. The World Economic Forum’s Global Risk Report found human error to be the main cause of 95% of cybersecurity breaches, verifying that traditional technical solutions alone are insufficient.

Download the 2023 Human Factor report to learn more

Cost Reduction and Risk Mitigation

Implementing effective HRM strategies can significantly reduce the financial impact of security incidents. With the average cost of a data breach reaching $4.48 million in 2024, organisations cannot afford to overlook the human aspect of security. Proactively addressing human-related risks can save companies millions in breach-related costs and reputational damage.

Enhancing Organisational Resilience

HRM contributes to building a more resilient organisation by:

• Creating a security-conscious culture: By empowering employees to become security advocates rather than viewing them as liabilities, HRM fosters a culture where security becomes everyone’s responsibility.
• Improving incident response: Employees trained through HRM programmes are better equipped to recognise and report potential security threats, leading to faster incident detection and response.
• Adapting to evolving threats: HRM’s focus on continuous assessment and improvement allows organisations to stay agile in the face of evolving threats.

Compliance and Regulatory Alignment

As data protection regulations become more stringent, HRM helps organisations meet regulatory compliance requirements by ensuring employees understand and adhere to security policies and best practices. This proactive approach helps avoid costly fines and legal issues associated with non-compliance.

Optimising Security Investments

HRM allows organisations to make more informed decisions about their security investments. By understanding the specific risks associated with human behaviour, companies can allocate resources more effectively, focusing on areas with the greatest impact on overall security posture.

Addressing the 80/20 Rule of Risk

In light of the 80/20 rule of risk, research shows that only 8% of users cause 80% of security issues. HRM platforms and dashboards enable security teams to identify and focus on these high-risk individuals, allowing for more targeted and effective risk mitigation strategies.

Aligning Security with Business Objectives

By aligning security practices with employee workflows and business goals, HRM helps reduce friction between security requirements and productivity. This integration ensures that security measures enhance rather than hinder business operations.

Human risk management is not just an add-on to existing security practices; it’s a fundamental shift in how organisations approach cybersecurity. By placing people at the centre of security strategies, HRM enables companies to build more robust, adaptive, and effective threat defences.

An effective programme should evolve alongside your organisation and the threat landscape to provide ongoing protection against human-related security risks.

Proofpoint offers comprehensive solutions to address human risk in cybersecurity, focusing on identifying, assessing, and mitigating people-based threats. Their approach combines advanced threat intelligence with behavioural science to create a robust HRM programme.

At the heart of Proofpoint’s offering is the Security Awareness & Education platform, delivering personalised, threat-driven content to employees. This solution adapts to each user’s role, vulnerabilities, and competencies, ensuring relevant and engaging training. The platform includes phishing simulations based on real-world threats, knowledge assessments, and security culture evaluations to provide a holistic view of an organisation’s human risk landscape.

Proofpoint’s Nexus People Risk Explorer (NPRE) is a powerful tool that quantifies employee risk by considering user vulnerability, attack index, and business privilege. This solution helps organisations identify their most at-risk employees, including Very Attacked People (VAPs) and top clickers, allowing for targeted protection and training.

To streamline threat response, Proofpoint integrates its Security Awareness with Threat Response Auto-Pull. This integration automates the analysis and remediation of user-reported suspicious emails, significantly reducing the workload on incident response teams.

Proofpoint’s solutions have demonstrated impressive results, with many customers reporting a 40% decrease in clicks on real-world threats and a 90% reduction in malware infections. By combining advanced technology with human risk mitigation, Proofpoint empowers organisations to transform their employees from potential vulnerabilities into active defenders against cyber threats. For more information, contact Proofpoint.