Skip to content
HRM Framework 2.0 , home
Start the assessment
Illustrative sample data

This page is a sample layout. Every number on it is generated sample data.

The first State of Human Risk edition publishes when the HRM Benchmark holds 25 or more consented records. Nothing on this page describes the market.

State of Human RiskSample layout

Sample layout: State of Human Risk

The structure of the annual report: level shares, practice means, risk-domain gaps and cohort breakdowns, filled with generated sample records so the layout can be read.

1,200 generated records · model 2.0.0 · generated 2026-10-16

About this sample

Built from 1,200 generated records.

Each record is generated by a seeded function, flagged illustrative: true and scored by the same engine as a real assessment. No program's real answers are in it. The sample file is at /report/data.json, flagged the same way.

How the first edition will be produced

When the benchmark holds 25 or more consented records for a year, the same generator builds this file from a store export: pnpm --filter @ls/assessment-engine report:generate -- --input records.json. Every cohort under 25 records is withheld, the illustrative flag turns false, and this page renders the full edition with its year-over-year block and press-ready facts. Real records and sample records are never mixed.

Headline findings

Illustrative
  1. Finding 01

    Most programs sit at level 2 (Observe): 58% of 1,200 programs.

  2. Finding 02

    38% of programs are at level 3 (Prioritize) or above.

  3. Finding 03

    Prove is the weakest practice: a mean of 2.1 out of 5.

  4. Finding 04

    See is the strongest practice: a mean of 2.6 out of 5.

  5. Finding 05

    The gating rule capped the level of 2% of programs: their weakest practice sat two or more levels below the level their overall score alone would give.

  6. Finding 06

    31% of programs skipped the AI agents question because they have no AI agents yet.

  7. Finding 07

    Programs see more than they prove: See averages 2.6 and Prove 2.1, a gap of 0.5.

Share of programs at each level

Illustrative
  1. 1 Comply 4% (43)
  2. 2 Observe 58% (699)
  3. 3 Prioritize 38% (453)
  4. 4 Orchestrate 0% (5)
  5. 5 Preempt 0% (0)

Mean overall score 2.36 out of 5, median 2.38. Levels are after the gating rule: The overall level is at most one level above the weakest practice: a program cannot prove or automate what it cannot see.

Risk-domain gaps

Illustrative
  1. Readiness and response Largest gap 2.29
  2. Social engineering 2.32
  3. Data handling 2.32
  4. Security culture 2.35
  5. Identity and access 2.36
  6. AI agents 2.37
  7. Endpoint and device 2.40
  8. Web, cloud and SaaS 2.40
  9. AI use 2.41

Mean coverage of each risk domain, from the questions tagged with it. Lowest first.

Practice means

Illustrative
  1. See 2.59
  2. Understand 2.27
  3. Act 2.38
  4. Prove 2.08
  5. Govern 2.47
  6. Culture 2.37

Breakdowns

By cohort.

A cohort is published when it holds 25 or more records. Below that, the row shows the count and the rule.

By industry

Illustrative
CohortProgramsMeanMedianMost common level
Financial services 104 2.29 2.34 2 Observe
Healthcare 114 2.38 2.40 2 Observe
Technology 112 2.34 2.38 2 Observe
Manufacturing 102 2.39 2.38 2 Observe
Retail 111 2.32 2.33 2 Observe
Energy and utilities 112 2.37 2.42 2 Observe
Public sector 97 2.43 2.42 2 Observe
Education 109 2.42 2.40 2 Observe
Professional services 111 2.29 2.32 2 Observe
Media and telecom 99 2.25 2.30 2 Observe
Other 129 2.48 2.47 2 Observe

By company size

Illustrative
CohortProgramsMeanMedianMost common level
Under 500 people 249 2.43 2.40 2 Observe
500 to 2,499 255 2.36 2.37 2 Observe
2,500 to 9,999 233 2.35 2.40 2 Observe
10,000 to 49,999 224 2.32 2.34 2 Observe
50,000 or more 239 2.36 2.40 2 Observe

By role of the person answering

Illustrative
CohortProgramsMeanMedianMost common level
CISO or security leader 174 2.38 2.41 2 Observe
Security awareness or culture lead 202 2.35 2.36 2 Observe
GRC or risk leader 198 2.36 2.37 2 Observe
SOC or incident response 213 2.34 2.37 2 Observe
Executive or board 214 2.35 2.40 2 Observe
Other 199 2.41 2.39 2 Observe

By region

Illustrative
CohortProgramsMeanMedianMost common level
North America 286 2.39 2.41 2 Observe
Europe, Middle East and Africa 317 2.36 2.38 2 Observe
Asia Pacific 276 2.37 2.38 2 Observe
Latin America 321 2.35 2.38 2 Observe

Method

How the numbers are made

Each record is one completed HRM Maturity Assessment (version 2.0.0) scored against the HRM Maturity Model 2.0.0. Level shares, practice means, medians and cohort rows come from the same aggregation the benchmark page uses. The gated share and the skip share are recomputed from each record's answers. Risk-domain coverage is the mean answer over the questions tagged with the domain.

Records are self-reported by one person per program, stored under a random identifier with no name, email or company attached, and used only in aggregate. Full method: methodology.

The sample is not for citation. The first edition carries its own citation line.

HRM Maturity Assessment

Place your program in the first edition

18 questions, about 4 minutes. Your level and practice scores are shown at once; your anonymous record joins the benchmark.

Questions
18
Minutes, about
4
Start the assessment

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback