CISOs should report human cyber risk to the board as an enterprise risk that affects operational resilience, financial exposure, regulatory obligations, customer trust and the organization’s ability to execute safely. The board does not need a longer list of awareness activities. It needs a clear view of where human-related cyber risk exists, how that exposure is changing, whether controls and interventions are reducing it, and where management needs a decision, investment or acceptance of residual risk.
That distinction matters.
Completion rates, phishing simulation results and learning participation can all provide useful evidence. They become much less useful when they are presented as if they represent the organization's human cyber risk in their own right. A board should be able to look at human risk reporting and understand the same things it expects to understand about other material risks: our exposure, what is driving it, what we are doing about it, whether those actions are working, where the risk is moving and what requires oversight.
At Cybermaniacs, we believe this is one of the most important shifts Human Risk Management needs to make. Human risk reporting has to mature from reporting security-awareness activity toward reporting risk conditions, meaningful change and organizational resilience.
A useful human cyber risk report should answer five questions.
| Board question | What the CISO should be able to show |
|---|---|
| Where are we exposed? | Material human-related risk conditions, populations, roles, business processes or scenarios requiring attention |
| Why does that exposure exist? | Relevant behavioral, competency, cultural, organizational, technological or threat conditions contributing to the risk |
| What are we doing about it? | Controls, learning, communications, process changes, technical interventions or other treatments |
| Is it working? | Evidence that the underlying risk condition, behavior, capability or outcome is changing |
| What does the board need to know or decide? | Material residual risk, resource requirements, significant trends, escalation points and strategic implications |
This puts human cyber risk into the language of governance.
That direction is consistent with broader guidance on cybersecurity reporting. The National Association of Corporate Directors' 2026 cyber-risk guidance recommends that boards receive standardized reporting tied to business, financial and operational consequences rather than primarily technical measures. NACD also emphasizes trends, risk exposure, resilience, investment effectiveness and alignment with enterprise risk management.
Deloitte makes a similar distinction in its guidance for CISOs, arguing that board reporting should connect cybersecurity risk and mitigation with enterprise strategy, risk reduction and resilience rather than treating cybersecurity as a separate technical concern.
Human cyber risk belongs inside that same reporting architecture.
There is nothing inherently wrong with reporting phishing data or training completion. The problem arises when activity measures become proxies for risk.
A 98% training completion rate tells you that an intervention reached most of the intended population. It does not tell you whether an important capability improved, whether risky behavior changed, whether an underlying organizational condition remains unresolved or whether the organization's exposure to a material threat decreased.
The same problem applies to phishing simulations. A declining click rate can be encouraging evidence, but its meaning depends on the population tested, scenario difficulty, reporting behavior, attack context and many other factors. Even a well-designed phishing metric represents one part of a much larger human-risk environment.
This is why Cybermaniacs argues that a score is a representation of selected evidence, not the risk itself. Human cyber risk emerges from the interaction between people, their work, the technology and processes around them, the access and authority they hold, organizational conditions, security controls and the threat environment.
Our guide on how to measure human cyber risk explores this measurement problem in more depth. We also examine the limitations of collapsing a multidimensional human-risk problem into a single number in Human Risk Scores: What They Tell You — and What They Don’t.
For the board, the practical implication is simple: report the risk story, not just the available data.
There is no universal set of human risk metrics that every CISO should put into a board pack. Organizations have different workforces, threats, business models, regulatory environments and risk appetites.
There are, however, several categories that can provide a useful board-level view.
Exposure metrics help explain where the organization may be vulnerable and where the potential consequences matter most.
Useful measures might include concentrations of human-related risk in critical roles, privileged populations, sensitive business processes or high-risk operating environments. They can also include meaningful trends in security events involving workforce behavior, patterns associated with sensitive data, repeated policy exceptions or other evidence relevant to the organization's threat model.
The important point is not to count every human-related event. It is to identify which evidence helps management understand material exposure.
A finance team with access to payment systems, an engineering population with access to production environments and an executive team routinely targeted by sophisticated impersonation attacks do not necessarily present the same risk simply because they completed the same awareness program.
Board reporting should preserve that context.
Enterprise averages are particularly dangerous when risk is concentrated.
An organization can have excellent average training scores while a small population with substantial authority, access or exposure creates a significantly different risk profile. Likewise, an enterprise-wide phishing rate can improve while one business unit, location, role or process continues to show a persistent problem.
The board usually does not need employee-level data. It needs to understand whether material concentrations of risk exist, whether those concentrations are growing or declining and whether management has a credible response.
This moves the conversation from "How did the workforce score?" toward "Where does human-related cyber risk matter most?"
Human Risk Management involves intervention. Training is one intervention. So are communications, process redesign, technical controls, simulations, coaching, changes to defaults, role-specific capability building and adjustments to the working environment.
Board reporting should therefore show whether significant interventions appear to be changing the conditions they were designed to change.
If a high-risk population received targeted support following a documented risk condition, what happened afterward? If reporting behavior was a concern, did it improve? If a recurring unsafe practice was identified, did its frequency decline? If employees lacked confidence handling a particular scenario, did that capability change?
The board rarely needs the mechanics of the campaign. It needs evidence that management can identify a problem, act on it and evaluate whether the action worked.
That closed-loop approach is part of what separates Human Risk Management from a calendar of security-awareness activities. Cybermaniacs explores that broader operating discipline in our guide to Human Risk Management as an operating model.
Boards need trends more than snapshots.
A human risk metric becomes more informative when the board can see whether exposure is improving, deteriorating or remaining stubbornly unchanged. Trend reporting also helps distinguish temporary noise from persistent organizational conditions.
For each important risk area, a CISO should ideally be able to explain the current position, previous position, expected direction, relevant intervention and whether observed change is consistent with expectations.
This is also where targets need care. A target such as "zero phishing clicks" may sound desirable while providing little useful governance information. A better target is tied to a meaningful risk outcome or control objective and recognizes the context in which the metric operates.
NACD's 2026 guidance similarly recommends that boards examine improvement, stability or deterioration over time and consider whether the pace of change aligns with the organization's risk appetite.
Human cyber risk reporting should not stop at prevention.
Some attacks will get through. People will encounter situations that were never covered in training. Technologies, processes and threats will change. AI adoption will create new forms of ambiguity. Controls will sometimes fail.
The organization therefore needs people and systems capable of recognizing unusual situations, reporting concerns, escalating appropriately, recovering from mistakes and adapting when conditions change.
Human resilience can show up in measures such as reporting behavior, escalation quality, response speed, recovery capability, effective use of controls and evidence that teams can operate safely when normal conditions break down.
This is particularly important because modern cyber governance increasingly focuses on resilience as well as prevention. NACD's current board guidance explicitly includes resilience within cyber-risk oversight, while NIST Cybersecurity Framework 2.0 treats cybersecurity as a continuous system spanning Govern, Identify, Protect, Detect, Respond and Recover.
A board-level human risk scorecard does not need dozens of indicators. In many organizations, five or six well-chosen measures with context will be more valuable than a dashboard containing fifty.
A useful structure might look like this:
| Reporting area | Example board-level question | Example evidence |
|---|---|---|
| Material exposure | Where is human-related cyber risk currently greatest? | High-risk populations, scenarios, processes or material risk concentrations |
| Trend | Is that exposure getting better or worse? | Quarter-over-quarter or longer-term movement |
| Control effectiveness | Are our controls and interventions changing the risk? | Changes following targeted interventions or control improvements |
| Resilience | Can people recognize, report, escalate and recover when something goes wrong? | Reporting, escalation, response and recovery evidence |
| Program capability | Can management consistently identify and manage human risk? | Coverage, governance, measurement maturity and priority gaps |
| Residual risk and decisions | What remains materially exposed? | Accepted risk, unresolved conditions, investment needs or board decisions |
The metrics underneath those categories should vary according to the organization's circumstances.
This is important enough to repeat: Cybermaniacs does not recommend that every organization copy the same human risk dashboard.
The correct measure depends on the risk question.
Our public Human Risk Management Capability Map describes the broader capabilities organizations need to understand, influence, measure and operate human risk. The detailed measurement models, weighting, diagnostic logic and decision thresholds behind an organization's implementation should remain tailored to its environment rather than being reduced to a generic public formula.
This is often the hardest part of human risk reporting.
A board does not need to know that 14% of employees selected the wrong answer on Question 7 of an assessment. It may need to know that a critical business population shows insufficient capability to recognize a threat scenario that could lead to payment fraud, operational disruption, sensitive-data exposure or another material consequence.
The translation usually requires connecting three things:
Human evidence → risk context → business consequence.
Imagine that an organization identifies unusually low reporting behavior among employees in a business unit frequently targeted by social engineering.
Reporting "the reporting rate is 22%" leaves the board with an isolated metric.
Reporting that "employees in a business-critical population exposed to a rising impersonation threat are substantially less likely than expected to report suspicious activity, increasing the possibility that malicious activity remains undetected for longer" creates a risk statement.
Management can then explain what is being done about that condition and whether subsequent evidence shows improvement.
That is much closer to the way boards already discuss operational, financial and strategic risk.
NIST has increasingly emphasized this connection between cybersecurity risk, enterprise risk and workforce management. Its 2026 Cybersecurity Framework guidance specifically addresses communication between cybersecurity risk management, enterprise risk management and workforce decisions based on actual risk conditions.
The phrase risk reduction deserves more discipline than it sometimes receives.
Sending training does not prove that risk was reduced. Achieving 100% completion does not prove that risk was reduced. Producing a higher awareness score does not automatically prove that risk was reduced.
Risk reduction requires evidence that something relevant to the risk changed.
Sometimes that evidence will be behavioral. Sometimes it will involve competency, reporting, policy adherence, control use, security events or a change in organizational conditions. Sometimes management will have good evidence that an intervention improved capability while still being unable to quantify the exact reduction in financial exposure.
That is acceptable.
Good board reporting should distinguish what management knows, what the available evidence indicates, and what remains uncertain.
False precision is not maturity.
At Cybermaniacs, we advocate starting with the risk question and identifying the evidence needed to answer it rather than beginning with whichever metric happens to be easiest to extract from the available platform. That principle is discussed further in What Should Human Risk Management Actually Measure?.
AI makes this reporting problem significantly more important.
The human side of cyber risk is no longer limited to whether employees recognize phishing messages, handle passwords correctly or complete required training. People are increasingly selecting AI systems, sharing information with them, delegating work to them, reviewing machine-generated outputs, supervising agents, approving actions and remaining accountable for workflows they may no longer execute directly.
That changes the risk architecture of work.
A CISO, CAIO or risk leader may increasingly need to explain questions such as whether people understand when AI can be used, whether high-risk tasks are being delegated appropriately, whether human oversight is actually effective, whether escalation mechanisms exist, and whether employees can recognize when an AI-enabled process is behaving outside its intended boundaries.
These are not simply AI-literacy questions. They are questions about human capability, governance, accountability and resilience inside AI-enabled work.
Cybermaniacs describes this emerging challenge as requiring a broader view of the human layer: organizations need people who can continue to exercise appropriate judgment, supervision, intervention and recovery as work becomes increasingly AI-mediated.
Our guide to Human Resilience Engineering for Agentic AI explores the public-facing principles behind that shift without exposing Cybermaniacs' underlying assessment or measurement methodology.
For many organizations, human cyber risk should form part of the normal cybersecurity and enterprise-risk reporting cadence rather than appearing once a year as an awareness-program update.
Quarterly reporting is a useful starting point for strategic trends, significant exposures, intervention effectiveness and changes requiring oversight. Material developments should be escalated outside that cadence where appropriate.
The detailed operational measures used by the CISO and Human Risk Management team will naturally be reviewed more frequently.
This distinction matters because the board report and the operating dashboard serve different purposes.
Operational teams need enough detail to diagnose and manage problems. Boards need enough information to understand material exposure, challenge management, oversee risk and make decisions.
Deloitte recommends a similarly layered reporting model, with annual, quarterly and operational reporting serving different governance purposes.
For US public companies, this reporting also exists within a broader regulatory governance environment. SEC rules require covered registrants to describe their processes for assessing, identifying and managing material cybersecurity risks, management's role in those processes and the board's oversight of cybersecurity risk.
Human risk reporting should therefore integrate naturally into existing cyber-risk governance rather than becoming an isolated presentation from the awareness team.
A practical quarterly report can be relatively concise.
Start with the current human cyber risk position. Identify the few human-related risk conditions most relevant to the enterprise and explain whether they have materially changed.
Then show risk direction. What has improved, deteriorated or remained unresolved since the previous reporting period?
Next explain management action and effectiveness. What interventions or controls were applied, and what evidence indicates whether they are working?
Include emerging conditions that could materially alter exposure. These might include a changing threat pattern, transformation initiative, organizational change, AI deployment, acquisition, new technology or significant workforce change.
Finally, identify residual risk and decisions required. The board should leave knowing where management is comfortable, where it is not, and what needs attention.
A board report should therefore be able to tell a coherent story:
Here is where human cyber risk matters. Here is what is contributing to it. Here is what we are doing. Here is what changed. Here is what remains exposed. Here is what we need from you.
That is much more useful than presenting seventeen charts and hoping the board works out the story itself.
Board members do not need to become Human Risk Management practitioners. They should, however, be able to challenge management on whether the organization understands and manages the human dimension of cyber risk.
Useful questions include:
These questions change the tone of the conversation.
The board stops asking, "Did everyone take the training?"
It starts asking, "Do we understand the risk, and are we getting better at managing it?"
Good Human Risk Management reporting does not attempt to prove that human behavior can be reduced to one perfect number.
It creates enough visibility for leaders to make better risk decisions.
That means understanding relevant exposure, identifying meaningful patterns, recognizing where context changes interpretation, selecting appropriate interventions, measuring change and knowing when a risk condition requires action.
Cybermaniacs' view is that this is where Human Risk Management ultimately has to go. The discipline needs to connect awareness, capability, behavior, culture, organizational context and security evidence into a coherent management system capable of answering the questions the enterprise actually cares about.
Our Human Risk Management strategic advisory work helps organizations build that capability across program strategy, measurement, governance, culture and execution.
The board does not need more human-risk data.
It needs to understand whether the organization's human layer is becoming safer, more capable and more resilient — and whether management can prove it.
CISOs should report human cyber risk as an enterprise risk, showing material exposure, contributing conditions, risk trends, control and intervention effectiveness, resilience, residual risk and decisions required from the board. Training and phishing metrics may contribute evidence, but they should not be treated as complete measures of human cyber risk.
Useful board-level measures can include human risk exposure, material risk concentrations, changes over time, control and intervention effectiveness, reporting and escalation behavior, resilience indicators and significant residual risk. The correct metrics depend on the organization's business model, workforce, threats, risk appetite and operating environment.
Phishing simulation results can provide useful behavioral evidence, but they should be presented with context rather than used as a standalone measure of human risk. Boards need to understand what the metric indicates about material exposure and whether the underlying risk condition is changing.
Training completion is primarily an activity or coverage measure. It shows whether an intervention was delivered or completed, but does not by itself demonstrate increased capability, changed behavior or reduced cyber risk.
Human cyber risk can usually be incorporated into the organization's regular cybersecurity or enterprise-risk reporting cadence, often quarterly, with significant developments escalated when necessary. Operational Human Risk Management metrics should generally be reviewed more frequently by management.
AI expands human cyber risk into areas including AI use, delegation, human oversight, decision-making, escalation, accountability and recovery. Boards increasingly need visibility into whether people can safely operate and supervise AI-enabled work as well as protect themselves from AI-enabled threats.
Security awareness reporting typically focuses on activities such as learning, campaigns and phishing simulations. Human risk reporting uses relevant evidence from those activities and other sources to explain material risk conditions, exposure, change, intervention effectiveness and organizational resilience.