Forrester announced the shift of the legacy security awareness and training (SA&T) market in 2024 to human risk management (HRM), introducing a profound change of mindset, strategy, process, and technology for managing human-related breaches. These risks posed by and to humans continue to be expansive and include established and emerging attacks such as deepfakes, misuse of AI, and plain human error. AI adds a plot twist, threatening to exacerbate, extend and expand these breaches.  We are thrilled to be introducing Forrester’s Human Risk Management Solutions Landscape, Q4 2026 (Forrester clients only).  Forrester defines HRM solutions as:

Solutions that manage and reduce cybersecurity risks posed by and to humans by detecting and measuring security behaviors, including behaviors relating to interactions with and use of AI systems and agents; quantifying that risk; initiating policy and training interventions based on that risk; educating and enabling the workforce to protect itself and the organization against cyberattacks; and building a positive security culture.

In this research, we reveal that CISOs are now exploring how HRM can help protect people from the risks that agents, systems and relationships around them pose. At the same time, they are finally moving beyond asking who completed the training, towards asking outcome-led questions such as: what behaviors and risks have changed as a result of training? Which interventions lead to the greatest risk reductions? Also, forward-thinking security and risk leaders are ready to move away from static training and simulations toward continuous, contextualized human risk identification and response.

Five Themes Defining Human Risk Management In 2026

HRM is growing up.  Between The Human Risk Management Solutions Landscape, Q1 2024 and today , HRM has grown into a mature market where true HRM capabilities such as behavior identification, human risk quantification, and adaptive interventions are now on most vendors’ roadmap, and are required by many security leaders.  2026 deems early day SA&T functionality such as broad content libraries, perfunctory quizzes, static and generic simulations and completion metrics as irrelevant at worst, or commoditized at best. Five themes stand out in todays’ HRM market:

  • Evidence-based behavior change is finally having its moment. Training completion, engagement, and phishing simulation scores tell security leaders what people did, not whether their behavior changed. CISOs increasingly expect their HRM solutions to show which behaviors create risk, whether interventions change those risky behaviors, and ultimately reduce cybersecurity risk.
  • A flood of AI-generated content capabilities disguised as innovation. AI makes training, simulations, and interventions faster and more contextual. While important, HRM content creation features should not be mistaken for innovation. The real potential of AI in HRM lies in its impact on behavior change and risk reduction.
  • AI is challenging the traditional workforce, and expanding HRM’s scope. Human risk no longer stops with the actions people take directly. As employees increasingly use AI to perform work, HRM now accounts for the agents, systems, and relationships around the human workforce. HRM’s scope expands to include AI usage, agent activity, and human-agent relationships signals into HRM analysis and interventions, although many of these capabilities are still emerging or on product roadmaps.
  • A unified view of human risk across security . Security tools such as email, messaging, collaboration, and identity solutions detect behaviors and threats, but within the scope of their own technology. HRM solutions increasingly bring together behavioral, identity, threat, exposure, AI, and other security signals to create a unified view of human risk. Correlating these signals helps security leaders identify risks that individual tools cannot see and respond before risky behavior becomes a security incident.
  • Continuous and contextualized interventions. Periodic training and static simulations cannot keep pace with changing human risk. HRM solutions continuously monitor and quantify people’s behaviors, the threats they are susceptible to, their security knowledge, and other risk signals. This context allows security leaders to target interventions based on an individual’s risk, from adaptive training and coaching to policy changes of security controls such as access rights.

For HRM, growing up means leaving behind the idea that training completion, content consumption, and simulation scores demonstrate success. Mature HRM programs identify and quantify human risk, use context to determine the right intervention, and measure whether behavior and risk actually change, with AI raising the stakes. If your HRM program still measures success by who completed the training, it hasn’t grown up yet.

Connect With Us

Forrester clients who want to grow and mature their Human Risk Management program can schedule an inquiry or guidance session with Jinan Budge or Madelein van der Hout.

 

 

Share