What CISOs Should Measure and Report About Human Cyber Risk Instead
There is a slide that has probably appeared in thousands of cybersecurity board decks.
Somewhere between the vulnerability chart and the regulatory update sits a small box showing the latest phishing simulation results. Perhaps the click rate went down. Maybe the report rate went up. There is usually an arrow pointing in the direction everyone has agreed represents progress, and the meeting moves on with a general sense that awareness is improving.
There is, of course, a reason the click rate keeps surviving every new generation of cyber strategy. It is simple, legible and wonderfully cooperative in PowerPoint. Give it a green arrow and suddenly everyone feels like we have accomplished something before lunch.
What is less clear is how much anyone in the room has actually learned about the organization’s human cyber risk.
Phishing simulations can be useful. Training completion matters. We use both, and most mature Human Risk Management programs should use both in some form. The difficulty comes when the measures that are easiest to collect gradually become the measures used to describe the risk itself.
What boards need from the human side of cybersecurity is a view of whether the organization is becoming more capable of dealing with situations in which people, technology, process and threat interact in ways that can create material harm. That requires more context than a click rate can provide, and the gap is becoming more significant as AI changes the way work is performed.
We Have Confused Measurement With Meaning
There is a deeper measurement problem here, and it is not unique to Human Risk Management.
NIST makes a striking observation in the AI Risk Management Framework: when complex human and social phenomena are converted into measurable quantities, necessary context can be lost. Once that happens, understanding the actual impact becomes harder rather than easier. (nvlpubs.nist.gov)
That is worth sitting with.
Cybersecurity has spent years getting better at measurement, and Human Risk Management has benefited enormously from that progress. We can observe more activity, connect more evidence, identify patterns across populations, assess capability and increasingly relate security events to the people and organizational conditions around them.
The danger is assuming that the act of quantifying something has settled the question of what it means.
A phishing click is an event. A training completion is an event. An assessment result tells us something about whatever we chose to assess. Meaning arrives when we understand the conditions around those observations: who was involved, what they were trying to do, what access or authority they held, what threat they faced, what controls surrounded them and what consequence could plausibly follow.
Strip enough of that context away and the metric gets cleaner while the risk gets fuzzier.
There is also an uncomfortable truth here for all of us who work in this field: sometimes we report the metric because we have it.
The platform produced it. The dashboard can trend it. The board has seen it before. Nobody has to spend twenty minutes explaining what it means.
That does not make the metric useless. It just means convenience has quietly become part of the measurement model, and convenience is not a particularly strong theory of risk.
We have written elsewhere about how to measure human cyber risk and why clicks and completions cannot carry the full weight of a human risk model. The problem becomes especially important when the data moves upward into executive and board reporting, because much of the context that made the number meaningful can disappear along the way.
Once that happens, the metric itself can begin to stand in for the risk.
What the Board Is Really Trying to Understand
Board members are rarely looking for a deeper education in phishing simulations. Their questions are generally more fundamental. They want to know where meaningful exposure exists, whether management understands what is driving it, whether the organization is responding effectively and whether anything material remains unresolved.
Those are governance questions.
There is a fairly practical reason to take this seriously: boards themselves are asking for better information. NACD's 2026 Director's Handbook on Cyber-Risk Oversight reports that 43 percent of public-company directors and 57 percent of private-company directors consider improving the quality of management's cyber-risk reporting very or extremely important. The same guidance argues that directors need reporting that allows them to see exposure, trends, resilience, investment effectiveness and the relationship between cybersecurity and enterprise risk. (nacdonline.org)
That creates an interesting test for Human Risk Management. If a metric cannot help management explain exposure, movement, control effectiveness or a meaningful business consequence, why is it occupying precious space in the board deck?
The phishing click rate may survive that test. It just should not automatically pass it.
Deloitte takes a similar position in its guidance for CISOs, emphasizing risk reduction, preparedness, resilience and strategic alignment rather than simply reporting security activity. (deloitte.com)
Human risk reporting should develop in the same direction.
A CISO should be able to explain where human-related exposure matters, what conditions contribute to it, what management is doing in response, whether those conditions are changing and where residual risk still requires attention. Phishing results may contribute useful evidence to that explanation, but they are usually only one part of the picture.
The shift is subtle, but important. Human Risk Management stops being reported as a collection of awareness activities and starts being discussed as part of the organization’s wider risk environment.
Eventually, Something Gets Through
There is another reason the board conversation has to become broader than prevention: prevention has limits.
Keri Pearlson, a principal research scientist at MIT Sloan whose work focuses on organizational cybersecurity and resilience, has argued that boards need to spend more time discussing cyber resilience rather than cyber protection. The logic is refreshingly unsentimental. Organizations cannot protect themselves enough to assume that prevention will always work. Systems fail, novel attacks succeed, circumstances change and eventually somebody encounters something the security program did not anticipate perfectly. (hbr.org)
That observation becomes particularly interesting when we apply it to people.
Much of security awareness has historically been built around the idea that we can prepare somebody in advance for the decision they will eventually need to make. Teach the warning signs. Explain the policy. Practice the scenario. Reinforce the expected behavior. All sensible things to do.
Real work has an irritating habit of improvising.
Policies are written in tidy language. Risk registers are generally well behaved. Actual people, systems and deadlines are considerably less interested in sticking to the script.
That gap between the neat version of work and the version that actually shows up on a Tuesday afternoon is where a lot of human risk lives.
Someone receives an unusual payment request that appears legitimate in every obvious respect. A new collaboration tool arrives faster than policy can catch up. An employee needs to complete a task, but the approved process no longer fits the way the business operates. A manager is asked to supervise an AI system performing work they used to carry out themselves. An automated process produces an outcome that falls within policy yet still feels wrong to the person reviewing it.
Many of these situations involve judgment more than recall.
What happens next tells us a great deal about the organization. People may notice that something is wrong, ask for help, escalate uncertainty, challenge a process or find a safe way to adapt. They may also stay silent, work around a control, approve something they do not fully understand or assume that somebody else has already considered the risk.
Those behaviors are influenced by much more than individual awareness. Process design, leadership behavior, psychological safety, workload, incentives, access to expertise, technology and organizational norms all shape what people actually do when the expected path breaks down.
That wider system is where human resilience becomes relevant.
Human Resilience Is About How the System Performs Under Pressure
The cybersecurity industry has a habit of turning every useful concept into a score, and resilience is especially vulnerable to that treatment.
A single resilience number might be convenient, but the more useful question is whether the organization can continue to function safely when conditions become uncertain, controls fail or the situation falls outside what people were prepared for.
NIST’s Cybersecurity Framework 2.0 spans Govern, Identify, Protect, Detect, Respond and Recover because cybersecurity cannot be understood entirely through prevention. Organizations also need the ability to recognize changing conditions, respond appropriately and recover when something goes wrong.
People participate across that lifecycle. They notice anomalies, report concerns, interpret ambiguous situations, challenge assumptions, escalate uncertainty and help reconstruct what happened after an incident. They also adapt when processes fail and intervene when technology behaves in unexpected ways.
At Cybermaniacs, this broader view is central to how we think about Human Resilience. We are interested in whether the human layer can continue to perform effectively when the operating environment changes, when the expected path no longer fits and when risk appears in forms the organization did not perfectly anticipate.
That creates a more demanding measurement problem because it requires context, interpretation and evidence from multiple parts of the organization. It also reflects more closely how human-related risk actually emerges in complex work.
AI Makes the Gap More Visible
AI is accelerating this shift because it is changing the role people play inside many workflows.
Employees are increasingly delegating tasks, reviewing machine-generated work, supervising automated processes, deciding when to trust recommendations and approving actions they did not construct themselves. In many cases, responsibility remains with the person even as direct involvement in execution declines.
Agentic systems push this further. A person may define a goal and allow an agent to carry out a series of actions before returning with an outcome. The human remains accountable while becoming more distant from the steps that produced the result.
We are entering a period in which the human role may increasingly resemble the person in the control room rather than the person turning every individual dial.
That sounds efficient until you remember that control rooms only work if the person watching them knows what normal looks like, can recognize when something has gone sideways, and still has enough authority and context to intervene.
Otherwise we are edging toward the cybersecurity version of 2001: A Space Odyssey: everything appears calm, the system is functioning beautifully, and somebody eventually has to ask whether HAL should really be making that decision.
The joke lands because the underlying governance problem is real.
NIST’s AI Risk Management Framework explicitly calls for clear human roles and responsibilities in AI decision-making and oversight, recognizing that human-AI configurations can range from direct human control to substantial system autonomy. (nvlpubs.nist.gov)
As AI takes on more of the execution, organizations therefore have to become much more precise about what they expect the remaining human to do. “Human in the loop” is not much of a control description if nobody has defined what the human is supposed to notice, know, decide, challenge or stop.
These are difficult situations to capture through traditional awareness measures because they depend on supervision, judgment, confidence, context and the quality of the surrounding system.
We explore those issues more deeply in our work on Human Resilience Engineering for Agentic AI. The broader implication for board reporting is that organizations need to understand whether people can operate safely inside increasingly AI-mediated work, not simply whether they completed training about AI.
What a Better Board Conversation Could Look Like
Consider a CISO reporting on a population involved in high-value financial transactions.
The organization is seeing increasing impersonation attempts. Training completion is high, and employees generally understand the relevant policy, so management does not believe the primary problem is a lack of basic knowledge.
The more useful finding is that verification behavior becomes inconsistent when requests arrive through trusted internal channels. Employees tend to report obviously suspicious messages, but they are less likely to escalate requests that appear credible and come from people or systems they recognize.
That gives the board a clearer picture of the risk condition.
Management can then explain what it changed. Perhaps the response combined role-specific practice, adjustments to approval workflows and stronger controls around high-consequence transactions. Over the following quarter, verification behavior improved and the relevant incident pattern declined, although one business unit continued to show materially different results.
The board can now see what management observed, what it did and what changed.
If the CISO then explains that residual exposure remains elevated because AI-enabled impersonation is increasing the realism and volume of attempts, the conversation can move toward the next control decision or investment requirement.
There may be several phishing measures underneath that analysis. Those measures are useful because they contribute evidence to the risk story rather than carrying the story by themselves.
This Requires More Than a Better Board Deck
Reporting improves when the operating model underneath it improves.
If a Human Risk Management program primarily delivers learning, runs phishing simulations and collects statistics, its reports will naturally be dominated by learning, phishing and statistics. The dashboard is simply reflecting the system that produced it.
A more mature capability has to do more. It needs to understand the organization, identify meaningful risk questions, gather appropriate evidence, interpret that evidence in context, decide where intervention is needed and then determine whether the condition changes.
That is why we describe Human Risk Management as an operating model rather than simply a SaaS platform. Technology plays an important role because it can connect evidence, automate work, deliver interventions and help teams operate at scale. Its greatest value comes when it supports a coherent risk-management approach rather than becoming the source of the model itself.
This way of working also requires some comfort with uncertainty.
Human behavior rarely offers the kind of precision organizations might prefer. A three-point movement in one measure does not necessarily translate into an exact financial reduction in enterprise risk, and forcing that relationship can create a false sense of certainty.
Boards deal with uncertainty all the time. Cybersecurity leaders can do the same by being explicit about what is known, what the evidence suggests, where confidence is limited and what management intends to learn next.
That is a stronger basis for governance than precision the evidence cannot justify.
Better Measurement Should Lead to Better Risk Decisions
The phishing click rate has survived for good reasons. It is simple, widely understood and easy to trend over time. Fewer clicks generally feels preferable to more clicks, and the measure can be useful when interpreted appropriately.
The problem is that human cyber risk has become substantially more complicated than the metric.
People are working inside increasingly complex systems. AI is redistributing tasks and accountability. Attackers are exploiting trust, authority, workflow and organizational friction alongside familiar technical weaknesses. Human behavior is shaped by the environment around the person as much as by what they remember from training.
Our measurement needs to account for that reality.
There is still value in measuring phishing, training, reporting and capability. The important discipline is to keep asking what each measure tells us about the underlying risk, how confident we are in that interpretation and what management should do differently as a result.
When Human Risk Management develops that discipline, board reporting changes with it.
The CISO can move beyond reporting whether the workforce participated in the security program and start showing whether the organization understands its human exposure, whether it can respond intelligently to what it learns and whether people are becoming more capable of operating safely as the environment around them changes.
That is the progress worth putting on the board deck.
Why Cybermaniacs Takes a Different Approach to Human Risk
That is also why Cybermaniacs has built its work around more than awareness delivery alone. We help organizations understand human risk in context, measure the conditions that matter, develop capability, influence behavior and culture, connect evidence across the business, and turn those findings into interventions that can actually be operated at scale. The goal is not to generate more data about people. It is to give CISOs, risk leaders and practitioners a clearer way to understand where human-related risk is emerging, what is changing it, and whether the organization is becoming more resilient as work, technology and threat continue to evolve.
