We Have More Behavioral Data About Employees Than Ever. That Doesn't Necessarily Mean We Understand Why They Behave the Way They Do.
Security teams have never had more data about people. We can see who clicked, who reported, who completed training, who failed an assessment, who has privileged access, who triggered an event, who repeatedly violates a control, and increasingly which employees or populations appear to carry more human-related risk.
Some of this is genuinely transformative. For years, security awareness programs were forced to make decisions with remarkably little evidence. Training completion, phishing simulation results and perhaps an annual survey were often the entirety of the human-data universe. Better behavioral telemetry, identity intelligence, security events and organizational data give us a much richer picture.
The risk is that visibility can begin to feel like understanding. Once enough measures are assembled in one place, thresholds are applied, trends are color-coded and the dashboard looks coherent, it becomes very easy to feel that the culture itself has somehow been captured.
If every indicator is green, either you have achieved organizational enlightenment or somebody has been very selective with the conditional formatting.
The dashboard may be perfectly accurate and still be incomplete, because culture is not simply an event stream. It is the organizational environment in which those events occur, and that environment shapes how people interpret risk, pressure, responsibility and what they believe they are actually expected to do.
What Is Cybersecurity Culture Actually Trying to Explain?
The useful purpose of cybersecurity culture is explanatory. It helps us understand why particular patterns of security behavior become normal inside an organization: why people report in one team and stay quiet in another, why a cumbersome control is tolerated somewhere and routinely bypassed elsewhere, or why one manager creates confidence around escalation while another makes employees reluctant to raise anything that might slow the work down.
MIT Sloan's work on cybersecurity culture describes culture through the values, attitudes and beliefs that drive secure behavior, operating across leadership, group and individual levels. That framing matters because it moves the discussion beyond whether an individual knows what the policy says and toward the conditions surrounding the moment when somebody actually has to make a decision. (mitsloan.mit.edu)
A major 2025 evidence review in Computers & Security came to a similarly broad view. After screening 1,768 records and synthesizing 59 studies, the researchers found cybersecurity culture spanning employee attitudes, policy compliance, education and awareness, behavioral monitoring, management commitment and wider organizational support. Their conclusion places cybersecurity culture firmly inside the management system of the organization rather than leaving it as a narrow awareness problem. (sciencedirect.com)
That breadth is precisely what makes culture difficult to compress into one gauge. We do not have a shortage of things to count. We have a harder problem: understanding the relationships between what people believe, what they experience, what they do, and the environment in which all of that takes place.
The Dashboard Is the Map. It Is Not the Territory.
There is an old idea in semantics, associated with Alfred Korzybski, that the map is not the territory. Maps are useful because they simplify reality. A map that reproduced every tree, curb, pothole, conversation and traffic jam would become unusable.
Dashboards work the same way. They reduce complexity so that somebody can see what matters quickly, which is useful and often necessary. CISOs need ways to identify movement, concentration, exceptions and emerging problems without commissioning an ethnographic study every Monday morning.
The simplification becomes dangerous only when we forget that simplification has taken place.
Imagine an organization with an excellent enterprise phishing-reporting rate. At the aggregate level, the picture looks strong. Underneath that average, the engineering organization may report almost everything suspicious because managers actively encourage escalation. Finance may report much less because employees receive frequent urgent requests from senior people and have learned that slowing one down creates more social risk than processing it. A recently acquired business may use a completely different reporting route that barely appears in the central data.
The enterprise metric can be mathematically correct while concealing three quite different cultural realities. That is why averages need interpretation, segmentation and context. Culture is experienced locally before it is reported corporately.
Every company has a security culture on the intranet. The interesting one appears when the release is late on Friday.
That is when employees discover which rules are genuinely important, which ones are negotiable, whose approval matters, whether raising a concern is welcomed, and what happens when security collides with delivery pressure. A final transaction may tell us what occurred, but it rarely contains the whole story of how the organization arrived there.
Behavioral Data Is Valuable, but It Still Needs Interpretation
One of the biggest advances in modern Human Risk Management has been the move toward behavioral evidence, and that shift should continue. If somebody repeatedly interacts unsafely with suspicious messages, circumvents a control, mishandles privileged access or consistently demonstrates strong reporting behavior, those observations are more useful than relying exclusively on whether the person completed a course.
Behavioral data also lets us identify patterns over time, compare populations and move closer to risk-based interventions. Where the interpretation becomes harder is in understanding why the behavior occurred.
Suppose an employee always follows a security control. They may understand and value it, they may have a manager who strongly reinforces it, the system may make non-compliance technically impossible, or they may simply have learned that violating it produces consequences. The observable outcome can look identical across all four situations while the cultural conditions underneath it are very different.
That distinction matters when behavior changes. If compliance suddenly declines, the appropriate response depends heavily on what was holding the behavior in place in the first place. In one environment, education may help. Somewhere else, the problem may sit in workflow design, leadership, incentives, policy, technical controls or local management practice.
Observed behavior gives us evidence. Turning that evidence into a sensible intervention still requires explanation.
Culture Lives in the Conditions Around the Decision
NIST's Human-Centered Cybersecurity work is useful here because it places cybersecurity behavior inside the realities of human needs, motivations, abilities, limitations, systems and workflows.
Its current program describes security culture through organization-wide values, attitudes and beliefs, while also emphasizing human-system interaction, workflow friction, psychology and the need to make secure behavior easier in practice. (csrc.nist.gov)
Many human-risk problems emerge in precisely that interaction between the person and the environment.
Take an employee who bypasses a security process. A dashboard can record the bypass. Identity systems can tell us who did it. Security telemetry may tell us what tool or resource was involved, and threat intelligence may help establish the potential exposure. Those are all useful pieces of evidence, but they still leave a practical question unanswered: why did the employee go around the process?
Perhaps they did not know an approved route existed. Perhaps they had used it before and found it painfully slow. Their manager may have told them to get the job done, the business may have been under unusual pressure, or the workaround may already have become normal inside the team. It is also possible that the formal process simply failed to support legitimate work.
Each explanation changes how the risk should be understood.
This is why we have argued throughout our work on cybersecurity culture assessment that culture needs to include leadership, norms, confidence, psychological safety, friction, organizational practices and lived experience alongside observable behavior. The event is important, but the surrounding conditions are often what tell us where intervention will have the greatest effect.
Be Careful When a Measurement Becomes the Goal
Metrics have another interesting property: people adapt to them.
Economist Charles Goodhart's observation about economic indicators later became widely summarized by anthropologist Marilyn Strathern as: “When a measure becomes a target, it ceases to be a measure.” The principle has travelled well beyond economics because organizations are exceptionally good at optimizing whatever number leadership decides to watch. (cambridge.org)
Cybersecurity has the same problem.
If phishing failure becomes the dominant measure of human risk, enormous effort will naturally go into reducing phishing failure. That may be worthwhile, but it can also produce an increasingly polished phishing program without telling us whether employees are becoming better at handling the broader risks the organization actually faces.
The same dynamic appears elsewhere. If training completion is the headline metric, completion will improve. If a culture score becomes the target, teams may become increasingly skilled at improving the things known to move the score.
None of that requires manipulation or bad intent. It is simply what organizations do when measures become important.
The practical question is whether movement in the metric still represents movement in the underlying condition that mattered when the metric was chosen. Human Risk Management needs a coherent measurement model partly because attractive numbers are very easy to collect and surprisingly easy to mistake for the risk itself.
A Culture Score Can Be Useful. It Just Needs an Explanation.
There is nothing inherently wrong with a cybersecurity culture score. Scores can help leaders see movement, establish baselines, highlight variation and create a manageable way to communicate a complex body of assessment findings.
The difficulty appears when the summary begins carrying more meaning than the evidence underneath it can support.
Suppose an organization's culture score rises from 71 to 76. That may be encouraging, but the change still needs to be explained. Trust may have improved, employees may have become more confident reporting, one business unit may have shifted significantly, the respondent population may have changed, or the survey itself may have changed. Workforce composition can move as well, and familiarity with the questions can influence how people respond over time.
Those possibilities do not make the score useless. They make interpretation part of the job.
A five-point increase should open a useful conversation about what changed and why. We see the same issue with Human Risk Management more broadly. A single human-risk score can be useful for prioritization or orientation, but it should not relieve the organization of the responsibility to understand what is producing the risk.
Precision can make a number feel authoritative long before the organization has earned the explanation behind it.
The Most Interesting Finding May Be Where the Data Disagrees
One of the reasons Cybermaniacs favors triangulation in culture measurement is that different forms of evidence often disagree, and those disagreements can be diagnostically useful.
Imagine survey data showing that employees feel highly confident about reporting suspicious events while operational data shows surprisingly little reporting. That mismatch gives us something worth investigating. Employees may understand what to do while encountering friction when they try. Their confidence may hold in a survey and weaken under real pressure. People may be using informal channels that the formal reporting system cannot see, or perhaps the relevant events simply are not occurring frequently.
A similar tension can appear in the opposite direction. A team may demonstrate strong compliance while reporting weak trust in the security function. The controls may be doing their job, while the cultural condition underneath them remains fragile.
This is why our Guide on how to measure cybersecurity culture recommends combining perception, qualitative evidence, behavioral evidence and organizational context. When multiple sources point in the same direction, confidence in a finding can increase. When they diverge, the divergence itself may tell us where to look next.
A mature measurement system should be able to remain curious when the evidence refuses to line up neatly.
Culture Is Also About What the Organization Makes Easy
Cybersecurity has spent decades telling employees what they should do. Human-centered security adds a more practical question: what has the organization made realistic?
NIST explicitly includes human-system interactions and workflow friction within its Human-Centered Cybersecurity work and argues that secure behavior should be easier in practice, with recovery possible when things go wrong. (csrc.nist.gov)
That framing changes how some apparently human problems should be interpreted.
An employee who repeatedly circumvents an exception process may have a knowledge problem, but they may also be responding rationally to a process that takes two weeks while their customer expects an answer tomorrow. A manager who discourages escalation may genuinely value security while operating against incentives that reward delivery speed and punish delay. A workforce that rarely reports mistakes may need education, or it may have learned through experience that admitting a mistake produces blame.
These conditions belong inside the human-risk conversation because people do not make security decisions in laboratory settings. They make them inside organizations, surrounded by deadlines, hierarchies, incentives, local norms, technical friction and the memory of what happened the last time somebody raised their hand.
Dashboards are excellent at showing what we decided to count. They are slightly less forthcoming about what we forgot to ask.
That missing question is often where culture begins.
AI Makes the Context Problem More Important
The expansion of AI and agentic work makes the distinction between observed behavior and surrounding context more important because employees are being asked to make unfamiliar judgments at increasing speed.
They need to decide when an AI-generated output can be trusted, when it requires verification, what information can safely be shared with a system, when an agent should be allowed to act, when something should be escalated, and when human intervention is genuinely necessary.
Some of those decisions will become visible through telemetry. The organizational conditions shaping them may be much harder to observe directly.
An employee may understand that they are allowed to challenge an AI-generated recommendation while simultaneously believing that leadership expects rapid adoption and few delays. A manager may publicly support human oversight while privately treating escalation as evidence that somebody is not sufficiently comfortable with the technology. People may also begin to internalize speed as the valued behavior even when the formal governance framework says that verification matters.
As NIST's 2026 work continues to develop the Human-Centered Cybersecurity discipline, it is emphasizing approaches grounded in empirical evidence and the realities of human interaction with systems. (nist.gov)
Human Risk Management needs the same discipline. As technology becomes more capable, treating human behavior as a context-free event stream becomes less convincing, because the surrounding system increasingly determines what judgment was possible in the first place.
So What Should a Human Risk Dashboard Actually Do?
A useful human-risk dashboard should help leaders see what deserves attention. It can identify trends, anomalies, concentrations, emerging exposures and differences between populations. It can show whether interventions appear to be moving relevant measures and where a deeper investigation may be warranted.
That is already a valuable job.
A mature Human Risk Management capability then needs a way to interpret what the dashboard has surfaced by combining behavioral evidence with culture, organizational context, threat, role, access, business consequence and qualitative understanding where necessary.
Some of that interpretation can be automated. Some will require practitioners, analysts, managers or subject-matter experts who understand the organization and can recognize when a number is hiding a more interesting problem underneath it.
Sometimes the next step will be another dataset. Sometimes it will be an interview, a focus group, an observation or simply asking a better question of the people doing the work.
The goal is not to abandon dashboards because culture is complicated. It is to use dashboards for the thing they are good at and preserve enough intellectual discipline to know when explanation requires more.
Why Cybermaniacs Looks Beyond the Dashboard
Cybermaniacs has spent years working at the intersection of cybersecurity, psychology, behavioral science, organizational culture and Human Risk Management because human-related risk rarely arrives as one tidy variable.
We use assessments, behavioral and organizational evidence, qualitative research, security data and contextual analysis to understand the conditions behind the numbers. That gives organizations a better basis for deciding what may actually need to change, whether the answer lies in capability, communication, leadership, workflow, controls, culture, training or some combination of them.
Our work on cybersecurity culture measurement, security culture assessment, and the distinction between culture assessment and human risk assessment all reflects the same approach: better evidence gives us more to work with, but interpretation is what turns that evidence into Human Risk Intelligence.
A dashboard can point us toward something worth understanding.
The real work begins when we ask what is happening underneath it.
