Awareness still matters. Human Risk Management gives it a bigger job to do.
Security awareness did not suddenly become obsolete because the industry discovered a new three-letter acronym. Organizations still need people who can recognize manipulation, handle information safely, report suspicious activity, understand security expectations and make better decisions when something does not look quite right. Good learning, communications and practice remain some of the most useful tools we have for building that capability.
What has changed is the size of the question security teams are trying to answer.
Security awareness is primarily an intervention: it helps people develop the knowledge, capability and confidence to behave more securely. Human Risk Management is the wider operating capability used to understand human-related cyber risk, decide where and how to intervene, measure whether something meaningful changed, and adapt the program over time.
That means security awareness belongs inside Human Risk Management rather than sitting on the losing side of some imaginary SAT-versus-HRM cage fight. The evolution is not from training to no training. It is from delivering security activity to operating a risk capability.
If you are already exploring the technology side of that shift, our guide to what a Human Risk Management platform should actually do looks at the capabilities a modern HRM platform needs to support.
The simplest distinction looks something like this:
| Security awareness asks | Human Risk Management adds |
|---|---|
| What do people need to know? | Where does human-related cyber risk exist, and what is contributing to it? |
| How can we build cybersecurity capability? | Which populations or risk conditions need attention? |
| How can people practice safer decisions? | Which intervention is appropriate for the problem? |
| Did people complete or understand the learning? | Did the relevant condition, behavior or outcome actually change? |
| Are people recognizing and reporting threats? | What else is shaping the behavior: culture, context, role, pressure, systems or exposure? |
| How do we improve the awareness program? | How do we prioritize, operate and continually adapt the wider human-risk capability? |
There is deliberate overlap. A sophisticated awareness program can measure competency, use behavioral data, tailor learning, support culture and respond to changing risk. That does not make the distinction meaningless; it means good awareness is already doing some of the work needed for mature HRM.
NIST's current guidance reflects that evolution. NIST SP 800-50 Rev. 1 describes cybersecurity and privacy learning as a lifecycle program that should encourage behavior change as part of risk management, contribute to security and privacy culture, and use measurement and evaluation to improve over time. In other words, modern awareness was already growing beyond the annual-course model before the HRM label arrived.
This is where some of the category conversation gets muddled.
Security awareness has improved enormously. Continual learning, microlearning, role-based education, realistic simulations, adaptive experiences, better storytelling and more thoughtful use of behavioral science can all make awareness programs substantially more effective. Cybermaniacs has spent years working on exactly those problems because badly designed learning does not become more useful simply because somebody has renamed the surrounding platform.
But better awareness is still better awareness.
Human Risk Management begins to add something materially different when the organization can use evidence to understand what problem it is trying to change, decide whether learning is the right response, examine the wider conditions influencing the outcome and determine whether the thing it cared about actually moved afterward.
That shift matters because not every insecure behavior begins with a knowledge gap.
Someone may know perfectly well what the policy says and still work around it because the secure process takes three times longer, because their manager rewards speed above everything else, because everybody around them does the same thing, because the technical control creates impossible friction, or because asking for help is culturally more dangerous than taking the risk.
At that point, sending the course again begins to acquire a certain Groundhog Day quality.
This is an important distinction because the phrase behavior change is now used so freely in cybersecurity that almost any employee activity can apparently qualify.
Learning absolutely can change behavior. It can provide better mental models, improve recognition, build confidence, create opportunities to practice and help people understand why a particular action matters. Phishing and social-engineering simulations can likewise create useful behavioral evidence and help people rehearse detection and reporting.
But behavior is influenced by far more than information.
The UK's National Cyber Security Centre makes this unusually explicit in its people-centered security guidance. It argues that behavior also depends on factors such as what people value, how they feel, the time and effort available, their capabilities, the surrounding environment and whether they feel able to seek help. Crucially, the NCSC advises organizations that where people already have the necessary information and insecure practices continue, simply providing more training will not address the underlying problem. NCSC: Putting people at the heart of cybersecurity
That is almost a perfect illustration of the boundary between awareness and HRM.
Awareness asks how we can better prepare the person.
Human Risk Management also asks whether the system around the person is helping or hindering the behavior we want.
Sometimes the answer will still be learning. Sometimes it will be better practice. Sometimes the intervention belongs in the process, the technology, the team, the manager, the communications strategy or somewhere else entirely.
The important thing is being able to tell the difference.
Culture is another place where category language gets stretched.
A learning program can absolutely influence security culture. It creates shared language, makes security visible, reinforces expectations and can change whether employees see cybersecurity as relevant, approachable and part of everyday work. The tone of the program itself also sends cultural signals: whether security treats people as capable partners or occasionally as malfunctioning firewall components with payroll numbers attached.
But culture is larger than education.
The NCSC defines cyber security culture as the collective understanding of what is normal and valued in the workplace with respect to cybersecurity. Its current principles emphasize leadership, social norms, trust, psychological safety, organizational conditions and the environment surrounding secure behavior. We unpack that framework in NCSC Cyber Security Culture Principles: What They Are and Why They Matter, including where we think the NCSC guidance is especially useful and where Cybermaniacs extends the thinking by treating culture as a wider system.
That matters because someone can know the official secure behavior and still learn very quickly that the real organizational rule is different. If the policy says “report mistakes immediately” but the first person who reports one gets publicly grilled for an hour, the culture has just delivered a much more memorable piece of training than the LMS ever could.
Our article Security Culture Is a System, Not a Vibe explores that wider territory. The HRM implication is straightforward: awareness can contribute to culture, but understanding and changing culture sometimes requires working on the conditions surrounding behavior rather than simply producing another learning asset.
Traditional security awareness has produced useful but relatively narrow measures for years: completion, assessment results, phishing clicks, reports, repeat failures and campaign engagement.
Those metrics are not useless. They answer real questions.
The problem comes when we ask them to answer questions they were never designed to answer.
Completion tells us that somebody completed something. A quiz tells us something about knowledge or competency under particular conditions. A simulated phishing event tells us what happened in that simulation. None automatically becomes a complete measure of human cyber risk simply because several of them have been placed on the same dashboard.
Human Risk Management therefore demands more discipline around what evidence means.
As our guide on how to measure human cyber risk explains, the useful progression is from individual events toward meaningful signals, patterns and risk. The point is not to gather every possible employee data point; it is to build enough relevant evidence to understand where attention is needed and what action can legitimately follow.
NIST's Human-Centered Cybersecurity program takes a similarly broad view of the problem, explicitly focusing on empirical evidence and the relationship between people, processes and technology. Its goal is not simply to make people more security-aware, but to create systems that work securely in practice and make secure behavior easier to achieve. NIST Human-Centered Cybersecurity
That is much closer to the problem HRM is trying to solve.
This may be the most useful way to understand the category shift.
Security awareness gives an organization a powerful intervention capability.
Human Risk Management adds the machinery for deciding when, where, why and how to use it. At a deliberately high level, that means being able to:
Understand what is happening and where meaningful human-related risk may exist.
Decide what deserves attention and what kind of response is appropriate.
Intervene through learning, communications, simulations, changes in process, leadership activity, technical improvements or other appropriate actions.
Measure whether the condition or outcome the organization cared about changed.
Adapt the program as evidence, risks, technology and the organization itself change.
That is not a proprietary recipe for Human Risk Management. It is the difference between running a collection of activities and managing something deliberately.
Our guide to Human Risk Management as an operating model, not just a SaaS platform goes further into that point. A platform can provide the data, workflow, analytics and intervention capability; somebody still has to turn those capabilities into an operating discipline.
No, and organizations should be suspicious of anyone pretending it does.
You still need people who understand cybersecurity. You still need strong learning. You still need phishing and social-engineering practice. You still need communications, reminders, role-specific support and timely information as technology and threats change.
In fact, a mature Human Risk Management program should make those interventions better targeted and more useful, because the organization has more context about what different populations need and why.
Cybermaniacs' Cyber Learning Experience (CLX) is built around continual competency development rather than treating awareness as one annual compliance event. Our managed phishing capability provides another form of learning and behavioral evidence, with an emphasis on understanding susceptibility and strengthening reporting rather than simply collecting click rates.
Those remain important HRM tools.
They are simply no longer expected to be the entire toolbox.
There is a danger in making Human Risk Management sound so sophisticated that a security team with one practitioner, half a budget and seventeen other responsibilities decides to lie quietly under the desk until the category passes.
That would be a mistake.
A strong security awareness program can be an excellent foundation for Human Risk Management. It can establish a continual learning rhythm, improve reporting and threat recognition, begin generating useful evidence, introduce segmentation and help normalize cybersecurity as part of everyday work.
For many smaller or less mature organizations, that is exactly where I would start.
Our guide on how to choose security awareness training takes that pragmatic view: build a program that works now, but avoid creating a dead end that prevents you from adding richer measurement, context and intervention later.
Maturity should add capability because the organization's questions are becoming more sophisticated, not because somebody has announced that everyone must reach Level Five by Christmas.
AI brings the distinction between awareness and Human Risk Management into sharper focus.
Employees unquestionably need education around AI-enabled social engineering, sensitive data, approved tools, verification, shadow AI, safe prompting and the changing nature of digital deception. A modern cybersecurity curriculum that ignores AI is increasingly teaching people about the workforce they had rather than the one they are entering.
But training is only one part of AI workforce risk.
As organizations move from experimentation into broad adoption of Copilots and increasingly agentic systems, questions emerge around readiness, confidence, trust, delegation, supervision, judgment, accountability, workflow, organizational norms and whether people know when not to rely on the machine.
Those are Human Risk Management questions too.
Cybermaniacs treats AI Workforce Risk Management as an extension of HRM rather than a separate universe. Our AI Enablement & Change Management (AIECM) work helps organizations understand workforce readiness, capability, adoption barriers and emerging human risk, while Agentic Readiness & Change (ARC) extends the problem into human-agent roles, supervision, workflow, judgment and governance.
If an HRM strategy has no way to expand into AI-enabled work, it may be building an impressively modern solution for yesterday.
Cybermaniacs did not arrive at Human Risk Management by deciding security awareness was passé and throwing the learning platform into the sea. We came at it from the opposite direction: if you care about whether learning actually works, you eventually need better ways to understand the people, behaviors, culture and risk surrounding it.
That is why the pieces connect.
ASSURE helps organizations establish a deeper diagnostic view of human risk and determine where attention is needed. CLX develops cybersecurity competency through continual learning. managed phishing provides realistic testing and behavioral evidence. MANAGE supports the strategy, operating model and ongoing HRM program around those capabilities. When the right intervention needs to be something particular to the organization, CHANGE supports custom content, communications and campaign work. And AIECM and ARC take the same human-risk thinking into AI-enabled and agentic work.
The point is not that every organization needs every capability simultaneously. It is that Human Risk Management needs more than one lever.
Sometimes people need to learn something.
Sometimes they need to practice.
Sometimes the program needs better evidence.
Sometimes the organization needs to change the environment around the behavior.
The mature question is no longer simply, What training should we send?
It is, What are we trying to change, and what gives us the best chance of changing it?
Security awareness remains essential because people cannot make good security decisions without knowledge, capability, confidence and opportunities to learn. That work has not become less important as Human Risk Management has emerged.
It has become more connected.
HRM places awareness inside a wider system of diagnosis, context, measurement, intervention and continual adaptation. It recognizes that behavior can be influenced by learning while also being shaped by technology, process, leadership, norms, pressure, role and organizational conditions. It gives practitioners more ways to act when another course is not the answer.
So the transition is not:
security awareness → Human Risk Management
as though one replaces the other.
It is closer to:
security awareness → awareness as part of Human Risk Management
That may be a less dramatic category story.
It is also a much more useful one.
Security awareness focuses primarily on developing employees' cybersecurity knowledge, capability and confidence through learning, communications and practice. Human Risk Management places those interventions inside a broader system for understanding human-related cyber risk, selecting appropriate responses, measuring change and continually adapting the program.
No. Security awareness remains an important intervention within Human Risk Management. HRM expands the scope by adding richer measurement, organizational context, culture, behavioral evidence, additional interventions and risk-management decision-making.
No. Security awareness can contribute to behavior change, but behavior is also influenced by factors such as organizational norms, leadership, processes, technology, incentives, workload and context. When lack of knowledge is not the underlying problem, more training may not be the appropriate intervention.
Yes. Security culture affects what behaviors are considered normal and valued within an organization and can support or undermine secure behavior. Learning can influence culture, but culture is also shaped by leadership, trust, social norms, organizational conditions and working practices.
Yes, when lack of knowledge, capability or practice contributes to the risk being addressed. A mature HRM program should also recognize when other conditions are driving the risk and use different interventions where appropriate.
Not necessarily in its most sophisticated form. A strong continual security awareness program can provide an excellent starting point. Organizations can add deeper measurement, segmentation, culture, behavioral analysis and broader interventions as their risk, size and program maturity grow.
AI expands the human-risk landscape beyond traditional security awareness. Organizations need to address AI-related capability and safe use, but also workforce readiness, trust, judgment, delegation, oversight, cultural conditions and the changing relationship between people and AI systems.