Skip to content
Book a demo

For GRC and risk teams

Audit evidence on demand.Human risk you can measure.

Training and simulation records mapped to the clauses your auditors ask about, ready to export, plus a measured view of human risk to put on the register next to every other risk.

Risk and compliance teams at

  • Unilever
  • Northwestern Mutual
  • Merck
  • Lockheed Martin
  • Ford
  • Target

Two audiences, one record

Auditors ask for evidence.The board asks if risk went down.

Answer both from the same data, without a week of spreadsheets before every audit.

Three-quarters

of risky behavior comes from 10% of the workforce. Treat the risk where it sits.2026 Human Risk Report

68%

Less time in a risky state after targeted action.2026 Human Risk Report

25–30%

Drop in the share of risky users in the first six months.2026 Human Risk Report

Compliance frameworks

Evidence for the frameworks you report against.

Training, simulations and their records, mapped clause by clause to the security awareness requirements you carry. Playbooks assign on a schedule, so the record builds itself.

PCI DSSHIPAAISO/IEC 27001SOC 2NIST CSF 2.0GDPRNIS2DORA
  • Assigned and completed: who got which training, and when they finished.
  • Reminders that skip finishers, and a completion credential for every finisher.
  • Simulations and results: phishing, SMS and voice, with each person’s outcome.
A playbook in the Living Security Platform, Executive Vigilant Reminders: it starts on the first of every month at 09:00, assigns three training modules, then ends.

A real playbook: training assigned on the first of every month, with no one scheduling it.

Accountability

Moving the needle,or checking a box?

See your evidence pack, your risk register and the trend your board will ask about, built from your own data.

Book a demo Get a quote

“I wanted to be held accountable—are we actually moving the needle, or just checking a box?”

Terry SmithProgram Director for Security Awareness, Blackbaud
Read the Blackbaud story

“With security threats always looming in the background, it's essential that our workforce understands the risks. Rubrik puts a great deal of effort into ongoing trainings and we wanted to do it right.”

Vinitha VaradarajanSenior Director, Information Security, Rubrik
Read the Rubrik story

Risk register and reporting

A measure behind the word “high”.And a trend for the audit committee.

Breach scenarios with an accountable owner, a level in words and the treatment running, in the shared language of the open Human Risk Management Framework: signals, cohorts, sequences and breach scenarios.

Human risk on the register.

An owner for every cohort, playbook and AI agent. Levels in words with the evidence, and no ranking of individuals.

Report the trend, not a completion rate.

Fewer risky users and less time in a risky state, with the actions behind the change, in the executive and board scorecard next to your evidence pack. See executive reporting

  1. 01 · Map

    Map the requirement

    Each clause to the training and simulations that meet it.

  2. 02 · Assign

    Assign by role and risk

    Playbooks assign, remind and follow up.

  3. 03 · Track

    Track every record

    Completions, results and credentials, timestamped.

  4. 04 · Export

    Export on demand

    The evidence pack and the board report, from one place.

AI governance

Turn your AI use policy into a control you can show.

Upload your AI acceptable use policy. Livvy proposes which AI tools are approved or not, quoting the exact line as evidence, and an admin approves each entry. Conflicts between documents are flagged for a person to settle.

  • Every AI agent tied to an accountable owner, with unowned agents flagged for review.
  • AI use that breaks the policy shows up on the person’s risk profile, next to phishing and training.

See your own evidence pack and risk register. Or price training on its own first.

Book a demo Get a quote

Questions

Human risk for GRC teams, answered.

What audit evidence does Living Security provide?

Timestamped records of who was assigned which training, who completed it and when, reminders sent, phishing and other simulations run, and each person’s results, mapped to the security awareness clauses your auditors ask about. Export the evidence pack when the auditor asks.

Which frameworks can the evidence support?

The security awareness and training requirements in frameworks such as PCI DSS, HIPAA, ISO/IEC 27001, SOC 2, NIST CSF 2.0, GDPR, NIS2 and DORA. The training and the records give you evidence for the requirement; your auditor decides compliance. See the clause-by-clause table on the security awareness and compliance page.

How does human risk fit on our risk register?

Living Security measures human risk from real signals and groups it into breach scenarios, such as payment fraud through social engineering or credential compromise, each with an accountable owner, a level in words, a trend and the treatment running. It sits on the register next to every other risk.

Can we enforce our AI use policy?

Upload your AI acceptable use policy and Livvy proposes which AI tools are approved or not, quoting the exact policy line as evidence. An admin approves each entry, conflicts between documents are flagged, and AI use that breaks the policy shows up as a signal on the person’s risk profile.

How do we report to the board and the audit committee?

With the trend: the share of risky users and the time people spend in a risky state, month by month, the cohorts behind it and what the program did about it. Levels are in words with the evidence attached, and the board sees cohorts and business units, never a ranking of individuals.

Can we buy training on its own?

Yes. Security awareness training with Content Studio and the library can be quoted on its own, and the rest of the platform can be added when you are ready.

Customer proof

A story you can showwith numbers.

Blackbaud replaced manual reporting from threat detection and data loss prevention with one measurable view of human risk.

“We've got a great story to tell, and now we can show it to leadership with quantifiable metrics.”

Terry SmithProgram Director for Security Awareness, Blackbaud
Read the Blackbaud story

Evidence on demand.Risk you can measure.

See the evidence pack, the risk register and the board report, built from the tools you already run.

Book a demo Take the 4-minute assessment
Get a quote Book a demo