Research report · Vol. 02 14 min read

2026 State of Human Risk Report: The Moving Target.

Last year we published one uncomfortable statistic: 10% of users drive roughly three-quarters of risky behavior. Security leaders came back with the same question: is it the same 10%?

This year we can answer it. We followed the same workforce across two full years, spanning 100+ organizations, 4.9M verified identities and over 55M risk-signal detections, and watched human risk move.

2026 State of Human Risk Report: The Moving Target report cover
Free report

Get your copy

Complete the form for instant access to all 22 pages. No wait, no follow-up call required.

Living Security is committed to protecting and respecting your privacy, and we'll only use your personal information to administer your account and to provide the products and services you requested. From time to time we would like to contact you about our products and services, as well as other content that may be of interest to you.

You may unsubscribe at any time. For more information, review our Privacy Policy. By submitting this form, you consent to allow Living Security to store and process the personal information submitted above to provide you the content requested.

74.8%

of risky behavior still traces to the riskiest 10% of the workforce, a second year unchanged.

68%

less time in a risky state after completing action plans, up from 60% last year.

2 in 3

of this year's riskiest 10% are new faces who weren't on last year's list.

What's inside
Security and awareness teams working through workforce risk data

Seven questions security leaders keep asking

Last year we published one uncomfortable statistic. Leaders everywhere came back with the same follow-up: is it the same 10%? This report answers it, by following the same workforce through two full years.

01 What counts as human risk?
02 Is human risk still concentrated?
03 Is it the same 10%?
04 Can risky users actually be fixed?
05 How fast do new programs see results?
06 How visible is human risk?
07 How has AI contributed to attacks?
The finding in one line

Half of last year's risky users reformed. An almost equal number replaced them.

The riskiest 10% isn't a fixed cast of characters. It's a role different people rotate through as jobs, access, threats and habits change. That is exactly why point-in-time programs chase where the target was.

01 · Reform is real
46% of previously risky users flipped to vigilant

Risky is a state, not an identity

Among employees tracked across both years, 46% of those who were risky in 2024 became net-vigilant a year later.

02 · Attacks are increasing
2x real-phishing attempts

New roles, new access, new exposure

Real phishing attempts per employee roughly doubled from 2024 to today: a genuine rise in volume. Targeted employees now face about 14 attempts a year, up from 8.

03 · Where it concentrates
Top 10% carries nearly all of it

Deepest where the stakes are highest

Almost all data-loss and endpoint risk traces to a small, identifiable slice of people. The problem has an address.

Who it's for

Built for the people who own the number

CISOs and security awareness leaders use this data to defend a program budget, set a realistic baseline, and decide where intervention actually pays back. Every figure comes with its method, sample and window.

  • A benchmark you can hold your own program against
  • The full 400+ signal taxonomy, across six risk domains
  • What intervention changed, and the one category that resists it
Security and awareness teams reviewing workforce risk data together

Point-in-time programs chase where the target was.

Continuous programs track where it is. Get the data behind the shift.

Get the report