HRM-CORE-02Term
Human risk management
The discipline that measures human risk per person, intervenes with training, nudges and control changes based on that risk, equips the workforce to defend itself and builds a security culture. Forrester named the market in 2024.
Example
A CISO runs a program that scores each person, targets the riskiest cohorts and reports risk reduction each quarter.
Also called
10How analysts, standards and vendors name the same idea.
- human risk management (HRM)ForresterFour-part definition, Feb 2024: detect and measure, intervene, educate and enable, build a positive security culture.
- security behavior and culture program (SBCP)Gartner2022 program model; risk reduction through tangible employee behavior management.
- secure behavior management (SBM)Gartner2026 market label: Gartner, Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management, Sept 22 2026. Pending a reader with Gartner access to confirm.
- security awareness computer-based training (SACBT)GartnerLegacy market name still used on Peer Insights. (to be confirmed)
- security awareness and training (SA&T)ForresterThe earlier market name.
- human-centric securityGartner2023 strategy trend; the strategy, where human risk management is the program.
- human-centric securityProofpoint
- Human Risk Management marketFrost & Sullivan
- security awareness and skills trainingCIS Controls v8.1Control 14.
- workforce risk managementLiving SecurityPeople and AI agents as one workforce.
Sources
6- Forrester, "The future is now: introducing human risk management", Feb 13 2024
- Forrester, "Human risk management: from talk to action in 18 months", Aug 12 2025
- Gartner, "Innovation Insight on Security Behavior and Culture Program Capabilities", Nov 16 2022 (quoted by Hoxhunt; paywalled) (to be confirmed)
- Gartner, "Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management", Sept 22 2026 (abstract page; the full note is paywalled) (to be confirmed)
- Frost & Sullivan, Human Risk Management Market, Global, 2024–2028 (store page)
- Proofpoint, human-centric security threat reference
Related terms
7"Human risk management" (HRM-CORE-02), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/terms/human-risk-management
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.