.svg)
.svg)
.svg)
.svg)
.svg)
In phishing simulations covered by the Verizon 2026 Data Breach Investigations Report, the median click rate on mobile lures such as text messages and voice calls is 40% higher than on email. A company-wide average cannot show who receives those lures or what they can reach if one works. This post is for CISOs and GRC leads who need a human risk assessment they can run across departments and turn into a plan.
In short: Map roles by what they can reach, collect behavior signals per department, score exposure and behavior together, then convert the ranked gaps into owned actions with dates. Repeat the cycle so the assessment stays current.
What a Human Risk Assessment Should Answer
A human cyber risk assessment is a structured look at how people's behavior and access combine into risk for the organization. It should answer three questions for each group: what could this role do that causes harm, how does this group behave when targeted, and what is already in place to limit the damage.
Most teams can answer the second question for the whole company and none of the first for any single team. That gap is why the output of a first assessment often reads as a table of averages, and why nobody owns the next step.
If you already have a per-person number, the Human Risk Score post covers what should go into it. This post covers the layer above it, which is how you read many scores across roles and departments and decide what to do first.
Map Roles by What They Can Reach
Start with access, not with the org chart. An accounts payable clerk who can release a payment, an IT administrator with privileged accounts, an executive assistant who manages a director's inbox and a new joiner with default permissions are four different risk positions, even if all four sit in one email domain.
For each role, record the systems and decisions it touches. Keep it short enough to finish in a week.
- Money movement. Who can approve payments, change bank details or release vendor invoices.
- Sensitive data. Who handles customer records, health data, designs or contracts.
- Privileged access. Who administers systems, mailboxes or identity.
- Public profile. Whose names, titles and travel appear online, which is what an attacker researches first.
This list is the criticality side of an employee cybersecurity risk assessment. It tells you how costly a mistake is before you have measured how likely one is.
Collect Signals Department by Department
Likelihood comes from behavior. For each department, gather what you already hold: simulation click and reporting rates, time to report, repeat behavior, training completion and policy acknowledgement. Reporting matters as much as clicking, because a team that reports quickly gives your security operations team a warning.
Compare departments against each other and against themselves over time. Finance may click less than sales and still be the larger concern because of what it controls. The role map from the previous step is what lets you read the two side by side.
Mobile and voice lures deserve their own line. The 2026 Data Breach Investigations Report found that in phishing simulations the median click rate on voice and text lures is 40% higher than on email, so a department that has only ever been tested by email has a blind spot in its data.
Fold language and working pattern into the picture too. A team that works mainly in Arabic, or on shifts away from a desk, needs simulations and training in the same language and on the same channels it uses at work.
This is the work that continuous scoring automates. Dynamic Human Risk Modeling in Fraus combines behavioral signals, role and exposure into a continuous risk score, and Odin keeps an individual threat profile for each employee, so the department view is built from current data and not from a yearly snapshot.
Turn Findings Into a Plan
Rank groups by exposure multiplied by behavior, then look at the top five. For each one, write a single action with an owner and a date. Vague actions such as raising awareness do not survive the next quarter.
Match the action to the gap you found:
- Low reporting rate: run simulations that ask for a report as the success condition, and tell people what happened to their report.
- High click rate on one channel: add that channel to the simulation mix at the right difficulty for that role.
- High criticality, thin controls: add a process control such as call-back verification for bank-detail changes.
- Repeat behavior: assign short, targeted training right after the event, not at the next annual cycle.
Simulation and training sit inside the plan, not beside it. Whitebait runs phishing simulations in Arabic and English, including QR code and credential harvesting scenarios, and tracks reporting rate next to click rate, which is the pairing this step depends on. The comparison with generic programs is covered in Human Risk Management vs Security Awareness Training.
Plan for repetition. NIST SP 800-50 Revision 1 introduces a life cycle model for learning programs that allows for ongoing, iterative improvement and sets out how to approach measuring their impact. A quarterly cycle of assess, act and reassess puts that model into practice and gives the board a trend instead of a one-off number.
Run the First Assessment Next Month
Return to the finance clerk from the role map, the one who can change a bank detail. Pick that team and one other as pilots. Map their access, pull the last two quarters of signals, set one action each and put a date on the review. NIST's SP 800-50 Revision 1 is a useful reference for structuring the cycle.
Once the pilot teams show a clear before and after, extend the same template to the remaining departments in order of exposure.
Frequently Asked Questions
How often should we run a human risk assessment?
Reassess on a fixed cycle, quarterly for most organizations, and also after a role change, a reorganization or a real incident. Continuous scoring keeps the data current between cycles, so the quarterly review focuses on decisions and not on collecting numbers.
What is the difference between a human risk assessment and a phishing simulation?
A simulation produces one kind of behavioral signal. The assessment combines that signal with role criticality, access, training and reporting data to rank groups by risk and decide on actions. Simulations feed the assessment and then act on its findings.
Who should own the assessment, security or HR?
Security or GRC usually owns the method and the data. Department heads own the actions for their teams, and HR supports on role data and training time. A named owner per action matters more than where the program sits on the org chart.
Can one employee cybersecurity risk assessment cover every department?
One method can cover all of them, but the inputs differ. Finance is assessed on payment controls, IT on privileged access, and customer-facing teams on data handling. Use the same scoring structure so results can be compared across the company.
.png)
.png)
.png)
