AUSTIN, TX / September 10, 2026 / Living Security, the global leader in Human Risk Management (HRM), today released The Moving Target: 2026 State of Human Risk, a longitudinal study showing that workforce cyber risk remains highly concentrated but continuously changes hands. The report is being unveiled at HRMCon 2026, Living Security's annual Human Risk Management conference, which security leaders worldwide can attend today through a free virtual livestream.
Drawing on seven years of de-identified telemetry from the Living Security Platform, the study examines workforce risk across more than 100 organizations. For the first time, Living Security followed the same employees across two years to measure not only where risk concentrates, but how people move into and out of risky states over time.
Human risk remains highly concentrated, but it does not remain concentrated in the same people. The study found that 73% of risky behavior traces to the riskiest 10% of the workforce, yet two in three of this year's highest-risk users were not on last year's list. The findings also show that targeted intervention works: employees spent 68% less time in a risky state after completing an action plan, with improvement sustained for 12 months.
"The riskiest 10% is not a fixed group of people; it is a state employees move into and out of as their roles, access, exposure and habits change," said Ashley Rose, CEO and Co-Founder of Living Security. "That makes annual assessments and one-size-fits-all training fundamentally insufficient. Security teams need continuous visibility into where risk is moving and the ability to intervene at the moment it matters. That is the shift we are putting into practice today at HRMCon."
2026 State of Human Risk Report Shows Why Continuous HRM Matters
The full report explores where workforce risk is most concentrated, how quickly new HRM programs can produce results, why security teams still struggle to see the full risk picture and how AI is changing the attack environment. It also includes the complete Human Risk Index signal taxonomy, category-level benchmarks and recommendations for building a continuous HRM program.
Together, the findings point to a clear operating model: security teams must continuously identify where risk is moving and apply targeted interventions before exposure compounds.
Join HRMCon 2026 Virtual Today
HRMCon 2026 takes place today, September 10, at The University of Texas Club in Austin, with a free virtual livestream available worldwide. The report's findings provide a data-driven foundation for the conference theme, Securing the Unified Workforce.
The full-day Human Risk Management conference brings together CISOs, practitioners, identity leaders, analysts and industry innovators to explore practical strategies for reducing incidents across a workforce increasingly composed of both people and AI agents. Virtual attendees can watch every session live, participate through a Q&A chat monitored throughout the day and receive access to session recordings after the event. Registration remains open, and teams can join from anywhere.
Download The Moving Target: 2026 State of Human Risk:
https://www.livingsecurity.com/2026-state-of-human-risk
Register for the free HRMCon 2026 virtual livestream:
https://www.livingsecurity.com/human-risk-management-conference-hrmcon-2026-living-security
2026 State of Human Risk Report Methodology
The Moving Target: 2026 State of Human Risk is based on de-identified telemetry from the Living Security Platform across more than 100 organizations and nearly five million verified workforce identities. Risk signals are weighted by their Human Risk Index impact. Longitudinal findings use consistent pseudonymous identifiers and compare employees against peers within their own organizations. The report includes the complete methodology and limitations behind each finding.
About Living Security
Living Security is the global leader in Human Risk Management (HRM), helping organizations identify, measure and reduce human cyber risk across humans and AI agents. Its AI-native Human Risk Management platform combines behavioral, identity and threat intelligence to predict risk, guide response and prevent cyber incidents before they occur. By connecting security data to measurable business outcomes, Living Security enables organizations to continuously reduce workforce risk while strengthening organizational resilience.
Media Contact: media@livingsecurity.com
