A Focus on Technology for Human Risk Management

Enterprise security goes far beyond safeguarding digital assets and infrastructure. One of the most unpredictable factors in the security equation is human behavior, leading to a crucial aspect of enterprise security known as Employee Risk Management. This represents a transformational approach in identifying, responding to, and reporting human-initiated risks. It acknowledges that compliance checklists are not a guarantee for a secure organization. The maturity of a People Risk Management program lies in its continuous adaptation, the breakdown of organizational silos, and the comprehensive utilization of tools and data.

Three Core Trends

Human Risk Management, or as it can be referred to, Employment Risk Management, is a result of three major trends:

1. Beyond Compliance: The realization that compliance does not necessarily mean security.
2. Continuity Over Snapshots: The move from occasional assessments to continuous reporting and improvement in risk management for employees.
3. Convergence of Technology: The amalgamation of technology, data, and applications for holistic security.

A mature program offers personalized guidance and dynamic content to shape a robust security culture, while also quantifying human risk to refine policies continually.

Maturing the Program: Beyond Compliance to Behavior Change

Traditionally, compliance has been the go-to method for managing employee risk in organizational security. However, research shows that mere compliance doesn't necessarily reduce risk. The focus should be on altering employee behavior for a lasting impact. Thus, there is a need for an evolution from conventional security awareness methodologies to comprehensive human risk management.

Human Risk Management Maturity Model

Developed with inputs from cybersecurity experts, the maturity model is a framework that guides security teams in cultivating cyber resilience and strengthening defenses. It serves to improve human behaviors, reduce business risks, and foster a culture of shared security responsibility.

Initial

When an organization first delves into human risk management, they typically find themselves in the "Initial” stage, wrestling with minimal budgets and grappling with suboptimal tools. In this phase, the focus is often on ticking off compliance checkboxes rather than instigating meaningful behavioral change.

Security programs are usually executed via internal Learning Management Systems, a far cry from specialized security training platforms. This limitation often results in outdated or generic content that's recycled year-over-year, usually produced in-house or outsourced from a vendor. Meanwhile, any interest in phishing simulations is likely in its infancy, often manifesting through free or inexpensive open-source options bundled with other compliance services from vendors. Unfortunately, the employee experience in this stage is often less than inspiring.

Managed

As organizations recognize the limitations of this preliminary phase, they venture into the "Managed" stage. Here, the inadequacies of siloed data points like phishing click-rates become glaringly obvious. These metrics, while useful, are not holistic enough to drive substantive improvements in human risk.

Realization dawns that one must consider multiple facets to inform decision-making in security training and awareness programs. Organizations in this phase often start employing light automation and begin to rely on spreadsheets to track activities and behaviors, forming an early but earnest effort to contextualize data.

Defined

As organizations mature past the “Managed” stage, they move to the “Defined” stage. In this stage, automated spreadsheets and purpose-built training platforms are commonly deployed to target campaigns to specific roles and risk profiles, highlighting the gradual sophistication of tools and approaches. Technology integrations, however, remain reactive to events and focus on manual ecosystem integrations.

Optimized

Then comes the "Optimized" stage, where the role of technology becomes increasingly intricate. Informative dashboards take center stage, tracking events, behaviors, and risk factors in a much more nuanced manner. Factors such as employee tenure, elevated permissions, and susceptibility to threats begin to influence decision-making.

This is the stage where human risk management truly starts to live up to its promise, employing specialized tools that deliver real-time guidance or "nudges" as employees navigate their daily tasks. These tools not only provide actionable insights but also offer metrics that are directly relevant to executive and board-level decisions, thereby situating human risk as a critical business consideration.

Innovating

The final stage of technological maturity is the "Innovating" stage. Here, we see the seamless integration of cutting-edge technologies like machine learning, artificial intelligence, and predictive modeling. These technologies serve to automate the human risk management processes, continuously identifying areas of risk and preemptively applying corrective measures with minimal human intervention.

The platforms in use at this stage not only focus on internal factors but also provide benchmarking data drawn from broader industry metrics. They employ learnings from various deployments to recommend configurations and interventions based on proven data. This predictive, preemptive, and deeply data-driven approach allows for a fine balance between privacy and security while keeping an organization's risk tolerance in sharp focus.

Enhancing Human Risk Management With Technology

The thread that weaves through all these stages is the steady integration of more advanced technologies into the human risk management toolkit, enhancing employee risk management. Each phase represents not just an upgrade in technology but also a profound shift in organizational culture, culminating in a stage where human risk management is not merely a program but an ingrained ethos.

By this point, technology, people, and processes have become interlinked in a harmonious dance of continuous improvement, marking the fulfillment of the human risk management vision.