Why it's time to re-envision security behavior management

Only 8% of users cause 80% of security issues. While all users should be mindful of potential cyberattacks during the conduct of their daily tasks, the fact remains that organizations must properly identify the users that pose the most risk, and be able to take action.

Organizations tend to invest in disconnected security point products, and while some invest in legacy security awareness training, they should be ensuring that their investment dollars are going towards security behavior management.

Security awareness training vs. security behavior management

Security awareness training focuses on informing employees—delivering knowledge about threats, policies, and best practices through courses, videos, and phishing simulations. Success is typically measured by completion rates and quiz scores. It answers "do people know what to do?"

Security behavior management goes further, focusing on actually changing what people do. It uses behavioral science, personalized nudges, real-time interventions, risk scoring, and ongoing measurement of actual actions (not just knowledge) to drive lasting habit change. Success is measured by observed behavior—fewer risky clicks, faster reporting, better password hygiene—rather than course completion.

Organizations tend to unwittingly create an environment with security professionals who cannot differentiate risk across employees because they lack the right tools to do so, and frustrated end users who ignore continuous security warnings and bypass disparate controls.

Ours is an increasingly connected world and employees have access to a myriad of collaboration tools and unlimited access to organizational data, making them prime targets for complex attacks such as phishing and other forms of business email compromise (BEC). In addition, they are constantly multi-tasking and have multiple tools open at the same time. All of these factors make users more prone to errors, and traditional security measures often fall short in addressing these human-centric risks, leading to significant vulnerabilities.

A command center for human risk
Traditional security behavior management only measures simulated risk and training engagement – it doesn't measure real risk. To effectively manage human risk, security teams need visibility into employees' real actions, not just simulated phishing and training engagement metrics. Fortunately, at the time when it is needed most, an evolution of risk mitigation – the Mimecast Human Risk Command Center – addresses many of these issues.