Cybersecurity teams measure human risk by counting phishing clicks and training compliance, but these metrics are too shallow. A better framework extends traditional likelihood-and-impact risk quantification to actually capture how humans create security vulnerabilities.
How do we quantify risk today? Likelihood and impact, right? And so how then can we quantify human risk in the form of likelihood and impact? And so that was really like the basis of where we started. And so we said, well, what are we learning from our metrics today? What's the propensity of somebody to click on a phishing email potentially? Because, you know, these are also simulations, they're not real, but like it's giving us some signal. And then are they taking their training and are they compliant? And like, that's really not a lot of depth, right? When we're thinking about risk quantification.
