Stop measuring just phishing clicks. Map every way humans could fail in your organization, including what you can't measure yet. This inventory of blind spots shows where you need better controls or data.
Again, because we've done this kind of thing before and you think about the easy ones, right? Oh, we can measure phishing emails and click rates. And yeah, that's great. Let's do that. But there's so much out there. And if you just sort of take some time and, you know, I think I would go back to, this would be my call as, hey, you should go do this. Take some time and decompose every single aspect of human risk that you can possibly think of in your organization. Like, what are all the possibilities out there? And then, how might you measure that and know if it's going on in your organization? Just a thought exercise. You know, it might even be good training for your people just to walk through all of that. Can we see this? Can we not? How well? How would we see it? What would we need to add? Where are we blind? All of those kinds of things. And I think, I think that's a very helpful— I don't think that all organizations can measure all aspects of that right now. They don't have the data. But if you organize it and keep a catalog of where you're blind, then that can lead— all right, we've got to do something there. I think would be a very healthy place to start and also would be enlightening in terms of potential data sources to understand the problem better.
The Future of Cybersecurity: How AI Is Exploiting Technical, Behavioral, and Process Vulnerabilities
