A Guide to Benchmark and Improve Human Risk Score

Human security behavior is usually judged by security awareness training program completions. But an employee merely watching a video on phishing prevention does not always mean they will automatically report a real phishing email. Which is why organizations need to quantify and measure human risk.

Human risk is the potential for an employee’s action, whether intentional or unintentional, to affect an organization’s security posture. It can be quantified by assigning a numerical value to these risks. For example, a phishing attack caused by an employee’s carelessness is assigned a value based on how much damage it can cause the organization. Turning employee mistakes into metrics makes it possible to track, analyze and improve human behavior. This lays the foundation for a comprehensive human risk management program. It also serves as a baseline for judging whether security awareness programs are truly effective.

Since quantifying human risk is a data-driven approach, it makes sense to set a human risk benchmark. A benchmark defines the thresholds for acceptable security behavior and any deviations from it are considered risks. Clear human risk benchmarks give the board visibility into where the exact vulnerabilities lie and which areas have improved. This helps secure budgets for targeted human behavior interventions and justifies the spend on security investments. 

How to Benchmark Human Risk

Here are five practices to help you benchmark human risk:

• Establish a Baseline of Accepted Behavior

Start by measuring the current human behavior of your employees and defining the desired state you want them to reach. For example, employees may perform well in phishing simulations yet struggle with real phishing emails. Identify the behavior you want to improve, work out its causes and define the ideal security behavior.

• Segment Your Workforce

Looking at the organization as a whole makes risky behaviors hard to pinpoint. Start by dividing employees into groups - those in sensitive departments, those who are repeatedly targeted by threats and those who would have a major impact on the organization if affected by a cyber incident. Segments like these make it easier to set benchmarks and track behavior at a granular level.

• Track the Risk's Entire Lifecycle

A single human risk score is only a snapshot. Let’s say you are monitoring your employee incident-reporting rate and it comes out low. That signals a risky behavior, but the score alone does not show whether the rate has always been low or only dipped during a particular period. To avoid this, monitor the full lifecycle - where the risk starts, how it progresses over time and whether it is improving or declining.

• Integrate Human Risk Into Your Overall Risk Profile

Don't treat human risk as separate from your other security risks. Just because it involves the human factor doesn't make it a standalone risk. Folding it into your overall risk profile gives you a single view of everything the organization faces. It also keeps you from neglecting other risks while focusing only on human risk and vice-versa.

• Compare Benchmarks with Industry Peers

Comparing your benchmarks against those of industry peers shows whether your program is succeeding or drifting toward greater risk. It can also reveal benchmarks worth adopting.

How to Improve Human Risk Scores

Below are a few steps to improve human risk scores:

• Just In Time Nudges

Nudges are timely pushes that guide employees when they attempt a risky action. It can either be a pop-up warning when employees try to download unapproved software, or a micro-training module on phishing that is recommended when employees click on links in mock phishing tests.

• Individual Employee Risk Score

Give employees visibility into their personal risk scores and show how it contributes to the overall organizational risk. This shows employees how their secure actions count. It will make them want to work on their security behaviors and reduce the risk their actions can pose to the organization.

• Reinforcement for Repeat Offenders

Some employees or certain departments may repeat risky actions. Instead of punishing or reprimanding them, positive reinforcement such as rewards or points can motivate them to adopt secure behaviors with ease. Try to identify what causes the repeated risky choices. Addressing the root cause with targeted interventions can help have positive impact on the score.

• Role Based Risk Score Updates

When employees change roles or positions within the organization, update their risk score. A new role brings new responsibilities and the risk that comes with those responsibilities changes accordingly. Hence, that needs to be tracked.

• Include Everyone Associated with The Organization

Human risk is not limited to employees. Every vendor, freelancer or part-timer working for your organization carries some risk, even if it seems small. Vendors and contractors should be held to the same security standards as employees. No entry point should be ignored because risk can emerge from places that are seldom noticed.

• Continuous Refinement of Benchmarks

The human risk benchmarks you set today should not be permanent. As threats keep changing with new attack vectors, update your benchmarks to match. Remove those that become obsolete and add those that are needed.

End Note

An ideal human risk benchmark is data driven and not based on assumptions. It goes beyond ticking compliance boxes and looks at how every person connected to the organization acts. That is how a true human risk management program works: driven by metrics than by intuition.