Despite increasing investment, security awareness training continues to deliver marginal benefits. With a focus on actions over knowledge, AI-based HRM can personalize training to improve employee behavior — and ROI.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Traditional security awareness training (SAT) faces a paradox: despite $6 billion in annual spending and regulatory requirements, it delivers marginal benefits due to compliance theater, the forgetting curve, and overconfidence. Human risk management (HRM) offers an alternative by focusing on actual employee behavior rather than knowledge. HRM integrates with security tools to identify vulnerabilities, measures risk using behavioral data, and applies targeted interventions like AI-powered micro-learning and personalized training. This approach enables organizations to track behavioral changes, demonstrate ROI through reduced incidents, and move beyond checkbox compliance toward meaningful security culture improvement.

Human risk management: CISOs’ solution to the security awareness training paradox