Human risk management

Most breaches involve a person. Train little and often, and make reporting easy.

A once-a-year training video does not change behaviour. Short regular training, fair phishing practice, fast reporting and controls that catch mistakes do. Here is what a human risk programme looks like, how to run it without blaming people, and a 9-point check for your business.

Breach data from the Verizon 2026 DBIR, checked 31 October 2026.

Start a human risk programme Check your programme 07 3114 2808

What a programme includes
Culture, not blame
9-point check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A dispatcher shows a colleague a suspicious message on his phone at a desk beside the warehouse window. — **62% of breaches**Involved the human element in the Verizon 2026 Data Breach Investigations Report.

The risks

Four ways people end up in a breach.

None of them need a bad employee. Most need a busy one.

Phishing

A convincing email, often AI-written, gets a password or a payment.

Simulations
Report button
Phishing-resistant MFA

Human risk check

How well does your business manage human risk?

Tick what is true today. You get the gaps, in the order we would close them.

Tick what is true for your business today.

Short training every month, not once a yearA few minutes at a time, matched to each person's role and mistakes.
Regular phishing simulationsRealistic tests with instant, private follow-up for anyone who clicks.
A one-click way to report suspicious emailAnd staff know someone actually looks at what they report.
Reporting a mistake is thanked, not punishedIncluding when someone clicked first and reported second.
Leaked staff passwords are watched forDark web monitoring on your domain, with resets when something turns up.
MFA backs up the peoplePhishing-resistant for admins and finance, so one mistake is not fatal.
Payment changes always get a callStaff know to verify bank detail changes by phone on a known number.
Policies are short, signed and knownAcceptable use, devices, reporting, with signatures on record.
Risk is measured over timeWho has completed training, who clicks, who reports, trending month to month.

Where you stand

0of 9 practices in place

9 gaps to close.

Short training every month, not once a yearPeople forget annual training. Little and often sticks.
Regular phishing simulationsPractice is how people learn to spot the real thing.
A one-click way to report suspicious emailFast reports turn one click into a contained incident.
Reporting a mistake is thanked, not punishedBlame teaches people to hide mistakes.
Leaked staff passwords are watched forReused passwords from other breaches are a common way in.
MFA backs up the peopleTraining lowers the odds. Controls limit the damage.
Payment changes always get a callEmail fraud targets people, not systems.
Policies are short, signed and knownClients, insurers and SMB1001 ask for the evidence.
Risk is measured over timeIf you do not measure it, you cannot show it is improving.

Close the gaps

What it includes

What a human risk programme includes.

Short, regular trainingA few minutes a month, matched to each person's role and results.
Phishing simulationsRealistic and varied, with instant private follow-up for anyone who clicks.
Leaked password monitoringWatching for staff credentials in breach data and resetting them.
Policies people signShort policies with signatures tracked.
A human risk scoreOne measure per person and team, trending over time.

Not blame

Build a culture where people report, not hide.

Thank reports, even late onesSomeone who clicked and reported has done the most useful thing.
Leaders go firstExecutives do the same training and simulations.
Keep results privateIndividual results go to the individual, team trends go to managers.
Explain the whyReal local examples, like a changed invoice, land better than generic warnings.

Evidence

Where training fits with frameworks and insurers.

The Essential Eight does not include training as one of its eight strategies, but training supports controls such as MFA and macro settings by reducing how often they are tested. SMB1001 includes staff training requirements, and many insurers and client questionnaires ask for training records, simulation results and signed policies.

A managed programme produces that evidence as it runs, so you are not scrambling for completion records when an insurer or client asks.

How we run it

How we run it.

We run our managed human risk service on usecure. It covers training, phishing simulations, policy management and dark web monitoring, syncs users from Microsoft 365 or Google Workspace, and reports on each person's risk over time.

We set it up, tune the simulations to your business, review the results with you each quarter, and act on what they show.

Our view

Training lowers the odds. Controls limit the damage.

No training programme gets clicks to zero, and it should not have to. Pair it with phishing-resistant MFA, payment call-backs and someone watching sign-ins, so the one mistake that does happen is caught before it costs money.

Then measure. The businesses that improve fastest are the ones that look at the numbers every quarter and adjust.

The order

Starting a human risk programme in five steps.

Step 1Baseline
A first simulation and leaked password check.
Step 2Set up training
Short, monthly, matched to roles.
Step 3Make reporting easy
A report button and a no-blame message from leadership.
Step 4Sign the policies
Short policies, signed and tracked.
Step 5Review quarterly
Look at the trend and adjust.

Related guides

People are one layer. Here are the others.

Phishing, email fraud, sign-in and policies.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about human risk management.

What is human risk management?

An ongoing programme that measures and reduces the risk that comes from people: short regular training, phishing simulations, watching for leaked passwords, signed policies, and a culture where people report mistakes quickly. It replaces the once-a-year training session.

How is it different from security awareness training?

Awareness training is one part of it. Human risk management adds measurement, so you can see who is at risk and whether it is improving, and ties training to what each person actually does and gets wrong.

How much of the risk comes from people?

In the Verizon 2026 Data Breach Investigations Report, 62% of breaches involved the human element, such as a click, a mistake or a misused account.

Does the Essential Eight require staff training?

No. Training is not one of the Essential Eight strategies, although it supports them. Other frameworks and many insurers do ask for evidence of training, simulations and signed policies, and SMB1001 includes staff training requirements.

Will phishing simulations upset staff?

Not if they are run fairly. Keep results private, give instant short training rather than public shaming, and celebrate reports. The aim is practice, not catching people out.

What platform do you use?

We run our managed human risk service on usecure, which covers training, phishing simulations, policy management and dark web monitoring, and syncs users from Microsoft 365 or Google Workspace.

Next step