By 
For CISOs, IT, and compliance teams in LATAM, Human Risk Management brings together three layers that are often treated separately: standards require a continuous awareness and training program, not a one-off course; analysts and vendors describe HRM as continuous measurement of behavior and human risk; and the operational value appears when that measurement helps prioritize interventions, reallocate resources, and report to leadership with risk metrics, not just course completion.
What emerges when standards and operational HRM are compared
Placed side by side, the sources show something that is rarely stated outright: the regulatory minimum requires continuity and structure, while HRM adds the layer of behavioral quantification that enables concrete operational decisions. That difference separates a program that merely complies from one that actually manages human risk. According to Living Security, the State of Human Risk 2026 report analyzed 4.9 million identities and 55.9 million signals over two years, reinforcing the scale at which this problem is measured today.
| Subject | Type of requirement or approach | What is measured or expected | Frequency or time horizon | Decision or operation it enables | Source |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 clause 7.3 and Annex A 6.3 | Normative requirement for awareness and information security training | People must be aware of the policy, their contribution to ISMS effectiveness, and the implications of noncompliance; awareness and training must be maintained appropriately | Continuous, because the ISMS must be established, implemented, maintained, and continually improved | Demonstrate that there is a structured and continuous awareness and training program | clause 7.3 and Annex A 6.3 |
| ISO/IEC 27002:2022 control 6.3 | Control guidance for awareness, education, and training | People receive appropriate awareness, education, and training, with regular updates based on their role | Regular and role based | Design differentiated programs by function and maintain regular updates | |
| PCI DSS v4.0 requirement 12.6 | Normative requirement for a formal security awareness program | Implement a formal program that educates staff about information security and their responsibilities in protecting cardholder data | Continuous, managed program, not an isolated course | Prove the existence of a formal and structured awareness program | the requirement 12.6 calls for a formal security awareness program, not a standalone session |
| NIST SP 800-50 | Practical framework for awareness and training | Identify roles and responsibilities, define objectives and messages by audience, performance metrics, and periodically evaluate program effectiveness by role and audience | Periodic evaluation | Measure effectiveness by audience and adjust the program | |
| NIST Cybersecurity Framework v1.1 PR.AT | Awareness and training category within Protect | All users receive awareness and training on their specific responsibilities, and security staff maintain adequate skills | Implicit continuity through skill maintenance | Align human risk management with the Protect function | the PR.AT category establishes awareness for all users and skill maintenance for those with security responsibilities |
| Forrester HRM | Operational definition of an HRM solution | Detect and measure security behaviors, quantify human risk, trigger interventions, enable the workforce, and build a positive culture | Continuous and oriented toward behavior change | Use quantified risk to trigger interventions and guide culture strategy | regulatory awareness compliance is treated as a secondary use case |
| Adaptive Security HRM | Operational framework for continuous management | Phishing clicks, reports of suspicious activity, policy tracking, and dynamic risk scores per employee | Continuous, through Assess, Prioritize, Tailor, Track and behavior-triggered training | Prioritize interventions, report to the board, and justify investment | |
| Infosec Institute HRM | Scoring approach based on real signals | Integrate real-time data from SIEM, endpoint, and network to generate a more complete assessment; measure human errors, clicks, and suspicious reports | Real time and across the employee lifecycle | Continuously adjust the program with behavioral and technical evidence | HRM integrates real-time data from SIEM, endpoint, and network to generate a more complete risk score based on real behavior |
| Hoxhunt HRM | Outcome-oriented HRM for CISOs, SOC, and awareness | Behavioral measurement, reduced clicks on real phishing, increased valid reports, fewer data handling errors, and integration with the SOC | Continuous and outcome based | Demonstrate risk reduction, tailor training, and integrate employee reports into SOC workflows | HRM requires outcome-oriented metrics such as fewer clicks, more valid reports, and employee reports integrated with the SOC |
| Arctic Wolf HRM | Treating human risk as an operational component of total cyber risk | Correlate identity activity, access patterns, and behavioral signals to understand, prioritize, and reduce user-introduced risk | Continuous measurement over time | Prioritize training, reinforce controls, and change access based on risk profiles | human risk is treated as a measurable component of total risk by correlating identity activity, access patterns, and behavioral signals |
Do standards require awareness or human risk management?
The standards in the source speak first and foremost about awareness, education, training, and a formal program. ISO/IEC 27001:2022 clause 7.3 requires that people be aware of the policy, their contribution to the ISMS, and the implications of noncompliance; ISO/IEC 27002:2022 control 6.3 calls for appropriate awareness, education, and training with regular updates based on role; and PCI DSS v4.0 requirement 12.6 requires a formal security awareness program.
Whalemate's reading is that this regulatory minimum is not enough, by itself, to manage human risk. It is enough to show that a program exists, is continuous, and has structure. It does not automatically answer which people, teams, or third parties need priority intervention, or what evidence would show that human risk has actually declined.
Why does Forrester treat compliance as a secondary goal?
Forrester argues that an HRM solution should detect and measure security behaviors, quantify human risk, trigger risk-based interventions, and build a positive security culture. In that same line of thinking, meeting awareness requirements appears as a secondary use case compared with behavior change and culture.
The tension with ISO and PCI is not a standards conflict, but a difference in level. The standards set a floor. Forrester is describing what a program should do if the goal is not just to pass an audit, but to reduce exposure. For a CISO, that changes the primary KPI from completion and attendance to observable behavior and quantified risk.
What fails when a program measures activity instead of behavior?
Hoxhunt notes that many traditional awareness programs focus on activity metrics, such as course completion. Infosec Institute, by contrast, argues that HRM should be based on real user behavior and integrate real-time data from SIEM, endpoint, and network to build a more complete risk score.
Whalemate's reading is that measuring activity helps with administrative auditability, but not operational prioritization. Completing a course does not show whether a person reports phishing, avoids data-handling mistakes, or repeats risky behavior. HRM begins when the unit of analysis shifts from the course taken to the behavior observed.
What is actually measured in Human Risk Management?
The sources converge on a fairly concrete set. Adaptive Security talks about phishing clicks, reports of suspicious activity, policy tracking, and dynamic risk scores per employee. Hoxhunt adds outcome-oriented metrics such as reductions in clicks on real phishing attempts, more valid reports, and fewer data-handling errors. Infosec Institute adds fewer human errors, lower clicks in simulations, and more reports of suspicious emails. According to Living Security, 74.8% of risky behavior came from the riskiest 10% of the workforce, and two out of every three people in that 10% riskiest group in 2026 were new compared with the prior year's list.
The sources do not all use the same taxonomy, but they do share the same logic. Measurement stops being binary and starts tracking behavior, exposure, and response signals. That makes it possible to see risk by individual, by department, by role, or by employee lifecycle stage.
What does technical integration add beyond isolated awareness?
Infosec Institute describes HRM as a discipline that integrates real-time signals from SIEM, endpoint, and network devices. Living Security says HRM unifies behavior, access, identity, and threat exposure data into a single human risk view for each individual. Arctic Wolf proposes correlating identity activity, access patterns, and behavioral signals to treat human risk as a measurable component of total cyber risk.
Whalemate's reading is that this technical layer turns awareness into an operational security function. If the program stays isolated in an LMS, courses, or generic campaigns, it does not connect with identity, access, or telemetry. When it does connect, the team can decide more precisely where to train, where to harden controls, and where to review permissions or processes.
What does it mean for human risk to be continuous and not annual?
PCI DSS 12.6 requires a formal program, ISO/IEC 27002:2022 control 6.3 calls for regular updates based on role, and NIST SP 800-50 recommends periodically evaluating effectiveness. On the operational side, Adaptive Security proposes behavior-triggered training rather than calendar-driven training, while Mimecast describes an evolution toward continuous measurement and improvement cycles centered on the highest-risk users.
The tension is clear. Compliance is often organized around periodic milestones, frequently annual ones. HRM, by contrast, treats risk as something that changes with threats, habits, roles, and context. For IT and CISOs, this makes it possible to move from date-based campaigns to signal-based interventions. After completing action plans, employees spent 68% less time in a risky state; the improvement held for 12 months, according to Living Security.
