Human Risk Management

Risk Categorization

To understand human risk at an enterprise scale, we must first map its full breadth—that's where categories come in. Each of the categories below represents a distinct facet of how people interact with systems, data, and one another—helping us conceptually organize the many ways human behavior can impact risk.

Within each category are unique risk indicators: specific, observable actions or events that signal a human's contribution—positive or negative—to cybersecurity risk. It's these indicators that enable organizations to identify, measure, and manage the full spectrum of human‑driven risk. Categories provide the structure; indicators provide the evidence.