Most organizations can already measure AI adoption.
They know how many employees have licenses, which tools are being used, how many people completed AI training and, increasingly, how many agents have been deployed. Some can measure time saved, productivity gained or the volume of work completed with AI assistance.
Those are useful measures. They are not measures of human risk.
As AI becomes part of operational work, CISOs and AI leaders need a different kind of visibility: whether people can use, supervise and challenge AI appropriately; whether reliance is changing behavior; whether important human capabilities are weakening; whether employees understand where their authority ends; and whether the human controls embedded in AI governance actually work.
At Cybermaniacs, we use Human-AI Risk Intelligence to describe the evidence organizations need to understand how human capability, behavior, psychology, culture, authority and working conditions interact with AI risk.
The aim is not to produce a single score declaring the workforce “safe” or “unsafe.”
It is to make the human side of AI visible enough to manage.
The most useful starting point is the work, not the training program.
Ask where AI now influences consequential decisions, where employees supervise AI-generated work, where agents operate with delegated authority and where the organization relies on people to identify or correct something the technology may get wrong.
Those environments create several different forms of human risk.
An employee might lack the knowledge needed to use a system appropriately. Another may understand AI risks perfectly well but rely too heavily on a familiar tool. A supervisor may possess the right expertise but have too much AI-generated activity to review properly. Someone else may recognize a problem and still hesitate to intervene because they are unsure whether they have the authority.
Those are not interchangeable problems, which is why measuring “AI awareness” alone tells an incomplete story.
Cybermaniacs approaches the problem through the wider human system: competency, behavior, psychology, culture and organizational conditions. AI changes how those factors appear, but it does not make them disappear.
No.
AI literacy is an important foundation. Organizations should know whether people understand approved use, limitations, data handling, hallucination, verification and relevant AI policy.
But a knowledge assessment mainly tells you what someone knows.
It does not necessarily tell you what they will do when an AI recommendation looks credible, the deadline is approaching and questioning the output means slowing down the work.
Our Guide to AI Literacy vs AI Judgment separates those two capabilities. AI literacy helps people understand the technology. AI judgment concerns when, whether and how AI should influence a real-world decision.
That distinction becomes particularly important in higher-consequence roles.
IBM's 2026 workforce research found that executives increasingly prioritize the ability to supervise, validate and override AI outputs, while employees place substantially less emphasis on judgment. The same research found concerns about skill erosion, unclear accountability and whether employees feel safe challenging AI-supported decisions. IBM's 2026 CHRO study is useful evidence that the human risk problem has already moved beyond basic tool literacy.
A workforce can know a great deal about AI and still make poor AI-supported decisions.
Yes, because reliance is one of the places where AI risk becomes behavioral.
People rarely make a conscious decision to become over-reliant on a system. Reliance tends to develop gradually as the technology performs well, familiarity grows and checking feels less necessary.
That may be completely appropriate.
A reliable AI system should eventually require less scrutiny for some low-risk activities. Human effort is expensive, and nobody benefits from asking employees to ceremonially recheck every harmless AI-generated sentence forever.
The risk lies in miscalibrated reliance: trusting AI more than the task, evidence or consequence justifies.
Organizations should therefore look beyond whether people use AI and ask how that use changes verification, independent thinking, escalation and decision behavior.
Our Guide to Reliance in Human-AI Work explores this relationship in more detail.
Useful evidence might include how employees approach ambiguous outputs, when they independently verify information, whether confidence changes after repeated successful use and whether reliance differs appropriately between low- and high-consequence work.
The objective is not to create a universal “trust AI less” metric. Good measurement should help determine whether reliance is calibrated to risk.
This is one of the most important questions for CISOs because AI governance increasingly depends on humans as controls.
A policy may require human review before a decision proceeds. An agent may be configured to escalate certain activity. A manager may retain accountability for an AI-supported outcome.
Those controls can exist without being effective.
Cybermaniacs uses human control effectiveness to describe whether a human control relied upon in an AI-enabled process can actually perform the risk-reducing function the organization expects from it.
Our Guide to How Do You Build Effective Human Oversight for AI? examines the design problem. Measurement asks whether the design survives contact with actual work.
That can mean looking at whether reviewers recognize situations requiring intervention, whether they understand what they are expected to notice, how often exceptions are escalated, whether overrides occur when appropriate and whether workload allows meaningful review.
NIST's 2026 work on monitoring deployed AI systems reinforces the broader need for post-deployment evidence. NIST notes that controlled pre-deployment evaluation cannot fully show how AI systems behave once they encounter dynamic real-world conditions and human interaction. NIST's report on monitoring deployed AI systems also highlights the continuing difficulty of understanding human-AI feedback loops and scaling effective monitoring.
The same logic should apply to human controls.
Do not assume they work because they were designed sensibly.
Measure what happens when people actually use them.
Agents create another layer of measurement because the human may no longer be approving every individual action.
The relevant questions become less about whether a person touched the workflow and more about whether delegated authority remains connected to meaningful human ownership.
Our Guide to What Is Human-Agent Accountability? describes the relationship among ownership, delegated authority, supervision, intervention and evidence.
Measurement should help answer questions such as whether accountable owners understand what agents can do, whether supervisors know when authority should return to a person, whether escalation routes are being used and whether people have sufficient visibility into consequential agent activity.
That can also reveal differences between governance on paper and behavior in practice.
An organization may have documented that a human remains accountable for an agent while the person has little idea which systems it accesses, what decisions it makes independently or how to interrupt it.
The ownership field in the inventory is complete.
The accountability system is not.
For some roles, yes.
The measurement problem is not whether every skill used before AI must be preserved indefinitely. Automation has always changed which capabilities matter.
The more useful question is whether AI is weakening a capability the organization will still need people to exercise later.
Microsoft's 2026 Work Trend Index describes advanced AI users as intentionally preserving human skills and deciding when work should remain human-led rather than automatically outsourcing more thinking to AI. Microsoft also found workers placing growing importance on quality control and critical thinking as AI assumes more execution. Microsoft's 2026 Work Trend Index frames that shift as people increasingly directing, evaluating and owning outcomes rather than performing every step themselves.
That makes skill preservation a risk question as well as a learning question.
If employees will still be expected to evaluate AI-generated analysis, they need enough underlying expertise to recognize weak analysis. If engineers remain responsible for recovering when an agent makes a bad change, organizations should care whether their independent technical capability remains viable.
Our Guide to Agentic Skill Atrophy examines this problem more closely.
Measurement can help identify where capability is growing alongside AI and where dependence may be slowly replacing it.
A human risk program that measures only the individual can miss the reason the individual behaves as they do.
Imagine an employee who recognizes that an AI-supported recommendation looks questionable but approves it anyway.
The obvious conclusion might be that they need better judgment training.
Perhaps.
They may also work in an environment where questioning the system requires an uncomfortable conversation with a senior leader who has spent six months championing AI adoption. They may have learned that escalation creates delays their team is punished for. They may believe they technically possess override authority while also understanding that nobody particularly wants them to use it.
IBM's recent workforce research makes this issue difficult to ignore. It found that 41% of CHROs believe employees may not feel safe challenging or overriding AI outputs, while employees report considerably greater confidence in organizations where decisions about what remains human-led are more deliberately shared and designed.
That is why Cybermaniacs includes psychological safety, leadership behavior, group norms and perceived control within our wider Human Risk Management view.
A behavior can look like an individual failure while being produced by the surrounding system.
Measurement should help distinguish between the two.
There is no universal dashboard that will make sense across every organization.
A legal team supervising AI-assisted contract work, a software engineering organization deploying coding agents and a call center using AI recommendations are creating different human-AI systems.
Their measurement should reflect that.
However, a useful executive view will usually need visibility across several categories rather than a single risk score:
Capability: Do people have the AI, domain and judgment capabilities their roles require?
Behavior: How are people verifying, relying on, escalating and intervening in AI-supported work?
Psychology: How do confidence, perceived risk, trust, self-efficacy and perceived control influence those behaviors?
Culture: Do leadership, norms and psychological safety support appropriate challenge and escalation?
Control effectiveness: Are humans relied upon in AI workflows actually performing the supervisory or risk-reducing function expected of them?
Work design: Are workload, visibility, authority and decision rights compatible with the responsibilities assigned to people?
Resilience: Are critical human capabilities being maintained as AI performs more execution?
The detailed relationships among those dimensions, the indicators used to assess them and the way they should be interpreted are where a measurement model becomes proprietary.
Cybermaniacs does not publish our full scoring logic, diagnostic mappings or assessment engine as an open recipe.
The important buyer question is whether the measurement approach can distinguish why human risk exists well enough to tell the organization what kind of intervention is appropriate.
Executives understandably like summary scores.
They make dashboards manageable and allow changes to be tracked over time.
The problem comes when the score hides the mechanism producing the risk.
Two groups could receive the same overall risk rating for completely different reasons. One may lack AI knowledge. Another may be technically capable but overloaded. A third may understand the risk and lack sufficient authority to act.
Giving all three groups more AI training would produce a pleasing amount of activity and very uneven improvement.
This is why our broader Human Risk Assessment & Assurance approach looks beyond a single measure.
The score can be useful as an executive signal.
The diagnostic structure underneath it is what helps an organization decide what to do.
Measurement earns its value when it changes a decision.
If data shows a literacy gap, learning may be the right intervention. If employees understand the risk but fail to verify important outputs, behavior and workflow need attention.
If supervisors cannot meaningfully oversee agent activity because of volume, the answer may involve better exception handling or changes to autonomy. If people hesitate to challenge AI, leadership and culture may matter more than another educational module.
This is where Human-AI Risk Intelligence becomes operational.
At Cybermaniacs, the purpose of the measurement layer is to connect evidence to the appropriate response across Human Risk Management, AI enablement, agentic readiness, learning, communications, culture, control design and assurance.
Our AI Enablement & Change (AIECM) work focuses on workforce readiness, capability, confidence, behavior and adoption as organizations introduce AI.
Agentic Readiness & Change (ARC) addresses the changing roles, workflows, supervision and accountability that emerge as agents gain more autonomy.
Human Risk Assessment & Assurance provides the deeper measurement and evidence layer needed to understand the human conditions underneath those risks.
The measurement model should help the organization decide which lever to pull.
Otherwise it is just a more sophisticated dashboard.
Not every measure needs to run continuously.
Some capabilities change slowly. Others can move quickly when a new tool, agent or workflow is introduced.
A practical approach is to combine periodic deeper assessment with lighter operational signals.
A baseline can establish capability, attitudes, behaviors and cultural conditions before or during a major AI rollout. Follow-up measurement can show how those conditions change as adoption grows.
Operational data can add another layer through escalation patterns, override activity, exception handling, incident data and other evidence produced by the work itself.
The frequency should follow the rate of change and consequence.
A workforce using AI primarily for low-risk productivity assistance may not require the same monitoring cadence as a team supervising agents with production access.
The important shift is from treating AI workforce measurement as a one-time readiness exercise to treating it as part of the operating model.
Measurement is what makes resilience manageable.
Our Guide to What Is Human-AI Workforce Resilience? defines the concept as the organization's ability to maintain the human capability, judgment, authority, adaptability and organizational conditions needed as AI assumes more responsibility for execution.
Without measurement, resilience becomes an aspiration.
Organizations need to know which capabilities are strengthening, which are eroding, how reliance is changing, whether accountability remains clear and whether the people serving as human controls can still perform the functions expected of them.
That is the role of Human-AI Risk Intelligence.
It connects what is happening in AI-enabled work to evidence about the people operating inside it.
AI creates human risk long before it creates an obvious human-risk incident.
It appears in small changes: people checking less carefully, judgment being exercised less often, supervisors receiving more work than they can reasonably review, employees becoming uncertain about authority, or important capabilities slowly moving from practiced skill to remembered skill.
Traditional awareness metrics will catch very little of that.
Organizations need measurement that can distinguish knowledge from judgment, adoption from reliance, accountability from actual authority and the existence of a human control from evidence that the control works.
That does not require turning every employee into a data point or measuring everything simply because it can be measured.
It requires enough intelligence to answer the questions that matter:
Where is human risk emerging as AI changes the work? Why is it emerging? And what should we change because of what we learned?
That is the purpose of Human-AI Risk Intelligence.