Human risk management platform
Human risk managementthat proves risk went down.
Living Security finds the few people, and AI agents, driving most of your risk. It acts on them automatically, with a person approving what matters, and proves the risk went down.
Rated 5.0 out of 5 from 3 reviews on Gartner Peer Insights.
Security teams at
%20--%3e%3csvg%20version='1.1'%20id='Layer_1'%20xmlns='http://www.w3.org/2000/svg'%20xmlns:xlink='http://www.w3.org/1999/xlink'%20x='0px'%20y='0px'%20viewBox='0%200%20185.6%2073.2'%20style='enable-background:new%200%200%20185.6%2073.2;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill:%2300095B;}%20%3c/style%3e%3cg%20id='Ford_Script'%3e%3cpath%20class='st0'%20d='M185.5,22c0.2-0.4,0-0.6-0.5-0.6c-2.4,0-5.5,0-8,0c-0.6,0-0.9,0.1-1.2,0.6c-0.9,1.8-12.1,18.5-14.2,21.8%20c-0.4,0.5-0.8,0.4-0.8-0.1c-0.2-1.9-1.9-4.2-4.5-5.2c-2-0.8-4-1-6-0.7c-3.7,0.5-7,2.4-9.8,4.6c-4.3,3.3-8.1,7.6-12.9,10.7%20c-2.6,1.7-6.3,3.2-8.7,1c-2.2-2-1.9-6.5,1.4-10c0.3-0.4,0.8-0.1,0.7,0.3c-0.3,1.6,0.1,3.1,1.3,4.2c1.5,1.3,3.5,1.5,5.3,0.6%20c2.1-1,3.3-3.1,3.7-5.4c0.6-3.6-2.2-6.7-5.6-6.9c-2.8-0.2-5.5,0.8-8.1,2.9c-1.3,1.1-2,1.9-3.2,3.5c-0.3,0.4-0.7,0.4-0.7-0.1%20c0.1-4.6-1.7-7.1-5.5-7.2c-2.9-0.1-6,1.5-8.5,3.5c-2.7,2.1-5,5-7.5,7.7c-0.3,0.3-0.6,0.3-0.7-0.3c-0.1-3-0.8-5.9-2.2-8%20c-0.5-0.7-1.5-1.1-2.4-0.6c-0.4,0.2-1.8,0.9-2.8,1.7c-0.5,0.4-0.7,1-0.5,1.8c1.3,4.5,1,9.6-0.8,14c-1.7,4-4.9,7.5-8.8,8.8%20c-2.5,0.8-5.2,0.4-6.8-1.8c-2.2-3.1-1.3-8.5,2-12.9c2.9-3.9,7.2-6.4,11.4-8c0.5-0.2,0.6-0.5,0.5-0.9c-0.2-0.7-0.6-1.6-0.7-2.1%20c-0.4-1-1.5-1.2-2.8-1.1c-3.1,0.4-5.9,1.4-8.6,2.9c-7.2,3.8-10.8,11.3-12.4,15.3c-0.8,1.9-1.4,3.1-2.2,4.2c-1.1,1.4-2.6,2.7-5.2,5%20c-0.2,0.2-0.4,0.6-0.2,1c0.3,0.5,1.6,2.5,2,2.6c0.4,0.2,0.9-0.1,1.1-0.2c1.8-1.2,4-3.2,5.1-4.5c0.4-0.4,0.8-0.3,1,0.4%20c1,3.5,3.6,6.4,7.2,7.7c6.6,2.2,13.4-1,18.6-6.6c3.3-3.6,4.5-5.8,5.7-7.4c2.1-2.6,6.3-8.5,11.3-12.3c1.8-1.4,4-2.5,5.1-1.8%20c0.9,0.6,1.2,1.9-0.2,4.4c-5.1,9.3-12.6,20.3-14,22.9c-0.2,0.5,0,0.8,0.4,0.8c2.7,0,5.3,0,7.7,0c0.4,0,0.6-0.2,0.8-0.5%20c3.9-6.1,7.6-12,11.5-18c0.2-0.4,0.4-0.1,0.4,0.1c0.1,1.4,0.4,3.3,1.3,4.6c1.5,2.3,3.6,3.3,6,3.3c1.9,0,2.8-0.3,4.8-1%20c1.6-0.6,3-1.4,4-2.1c0.6-0.4,0.7,0.3,0.7,0.4c-0.9,4.9,0.2,10.6,5,13c5.8,2.8,12.1-1.2,15.8-4.8c0.4-0.3,0.7-0.3,0.8,0.4%20c0.1,1.4,0.7,3,1.8,4.2c3.1,3.1,9.2,1.9,15.5-2.9c4-3.1,8.2-7.4,11.9-12c0.1-0.2,0.2-0.5,0-0.7c-0.6-0.6-1.4-1.3-2-1.8%20c-0.3-0.2-0.6-0.2-0.9,0c-3.9,3.7-7.3,7.9-12.4,11.3c-1.7,1.2-4.4,2.1-5.6,0.5c-0.5-0.6-0.4-1.5,0.1-2.7%20C161.1,59.5,184.3,24.1,185.5,22z%20M154.9,51.7c0.1,0.3,0.4,0.5,0.7,0.7c0.1,0,0.2,0.1,0.1,0.4c-1,2.1-1.9,3.3-3.1,5.2%20c-1.1,1.7-2.4,3-4,4.3c-2.3,1.9-5.6,4-8.3,2.6c-1.2-0.6-1.7-2.3-1.7-3.6c0.1-3.8,1.7-7.7,4.9-11.5c3.8-4.7,8-7.1,10.8-5.8%20c2.9,1.4,1.9,4.7,0.7,7.3C154.8,51.3,154.8,51.5,154.9,51.7z'/%3e%3cpath%20class='st0'%20d='M17.2,71.8C8.6,71.8,1,66.5,0.1,57.2c-0.5-5.1,1-9.7,3.9-13.5c2.6-3.3,6.9-6.1,10.6-6.8%20c1.2-0.2,2.8-0.1,3.5,0.7c1,1.2,0.7,2.5-0.3,3.1c-2.8,1.4-6.2,3.9-7.9,7.2c-1.4,2.7-1.6,6,0.4,9.2c3.5,5.2,13.2,5.4,22.2-3%20c2.2-2,4.2-4,6.2-6.3c4-4.5,5.3-6.2,10.6-13.5c0.1-0.1,0.1-0.2,0.1-0.2c0-0.1-0.1-0.1-0.3-0.1c-3.5,0.1-6.6,1.1-9.6,3.4%20c-0.9,0.6-2.1,0.5-2.6-0.3c-0.6-0.9-0.2-2.1,0.8-2.8c4.8-3.3,10-3.9,15.4-4.8c0,0,0.4,0,0.7-0.4c2.2-2.8,3.9-5.4,6.2-8.2%20c2.4-2.9,5.4-5.5,7.7-7.5c3.2-2.8,5.3-3.7,7.4-4.9c0.6-0.3-0.1-0.6-0.2-0.6C63.1,5.5,50.8,2.6,39,7c-8.1,3-11.7,9.5-10,13.8%20c1.2,3.1,5.2,3.5,9,1.7c3.1-1.5,6-4,8.1-7.2c1.1-1.8,3.6-0.5,2.3,2.6c-3.4,8.1-10,14.5-18,14.8c-6.8,0.2-11.2-4.8-11.2-11%20c0-12.2,13.6-20.2,27.8-21.4c17.2-1.4,33.4,3.1,50.5,5.2c13.1,1.6,25.6,1.6,38.7-1.4c1.5-0.3,2.6,0.6,2.5,2.2%20c-0.1,2.3-1.9,4.4-6.2,6.8c-4.9,2.7-10.1,3.5-15.4,3.6c-13,0.1-25.1-5-37.6-7.7c0,0.5,0.2,1.2-0.3,1.5C72.3,15.7,66,20.9,61.8,28.2%20c-0.1,0.2-0.1,0.3,0.2,0.3c3.6-0.2,6.9-0.3,10.3-0.6c0.6,0,0.6-0.2,0.6-0.6c-0.3-2.5,0.4-5.4,2.6-7.4c2.3-2,5.1-2.3,7-0.8%20c2.1,1.7,1.9,4.7,0.8,6.9c-1.2,2.3-3.1,3.5-5,4.1c0,0-0.4,0.1-0.3,0.4c0.1,0.6,2.6,2,2.9,2.4c0.2,0.4,0.1,0.9-0.3,1.3%20c-0.3,0.3-0.7,0.6-1.2,0.6c-0.4,0-0.7-0.2-1.3-0.5c-1.1-0.6-2.6-1.6-3.6-2.9c-0.3-0.4-0.5-0.4-1.3-0.4c-3.7,0.2-9.4,0.8-13.3,1.2%20c-0.9,0.1-1.1,0.3-1.3,0.6c-6.2,10.2-12.8,21.3-20.1,28.6C30.6,69.6,24.1,71.7,17.2,71.8z%20M76.4,26.3c0.1,0.5,0.3,0.6,0.5,0.6%20c1.2-0.2,2.5-1.2,3.2-2.3c0.7-1,1-2.5,0.3-3.1c-0.6-0.5-1.6-0.4-2.4,0.3C76.6,23.1,76.2,24.9,76.4,26.3z'/%3e%3c/g%3e%3c/svg%3e){kind=small}
%20--%3e%3csvg%20version='1.1'%20id='Layer_1'%20xmlns='http://www.w3.org/2000/svg'%20xmlns:xlink='http://www.w3.org/1999/xlink'%20x='0px'%20y='0px'%20viewBox='0%200%20300%20299.9'%20style='enable-background:new%200%200%20300%20299.9;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill:%23CC0000;}%20%3c/style%3e%3cpath%20class='st0'%20d='M0.1,150C0.1,67.1,67.2,0,150,0c82.8,0,150,67.1,150,150c0,82.8-67.2,150-150,150C67.2,299.9,0.1,232.8,0.1,150%20z%20M150,249.9c55.2,0,100-44.8,100-100c0-55.2-44.8-100-100-100C94.8,50,50,94.8,50,150C50,205.2,94.8,249.9,150,249.9z%20M200,150%20c0,27.6-22.4,50-50,50s-50-22.4-50-50s22.4-50,50-50S200,122.4,200,150L200,150z'/%3e%3c/svg%3e){kind=small}
What is human risk management?
Find the few.Act on them. Prove it.
Human risk management finds the people, and the AI agents, most likely to cause a breach, and acts on that risk before it becomes an incident. It measures what people actually do across your security tools, and proves the risk went down.
01
Risk is concentrated.
Three-quarters of risky behavior comes from 10% of the workforce. Training everyone the same way spends most of the effort where the risk isn’t.
02
The workforce now includes AI.
People run AI tools and agents with real access to company systems. Each one needs to be seen, scored and owned by a person.
03
Completions prove nothing.
A finished course says nothing about the next payment approval. Leadership wants to know whether risk went down.
74.8%
of risky behavior comes from 10% of the workforce.2026 Human Risk Report
68%
Less time in a risky state after targeted action.2026 Human Risk Report
25–30%
Drop in the share of risky users in the first six months.2026 Human Risk Report
How Living Security does it
Predict. Guide. Act.Then prove it.
One loop runs the program. Every action reports back to the Human Risk Index, so the next decision starts from what just worked.
-
Predict
Find the few
The Human Risk Index scores every person from hundreds of signals.
-
Guide
Know why, and what next
Livvy explains the risk and recommends the action.
-
Act
Run the right product
Playbooks act, and a person approves what matters.
-
Prove
Show it went down
Risk trends and board reporting, from the same data.
Predict · Human Risk Index
See who is driving your risk, and why, from the tools you already run.
The Human Risk Index scores every person from hundreds of behavioral, identity and threat signals: who attackers target, what access they hold, and what they do with it. It groups the few behind most of the risk into cohorts you can act on, people and AI agents alike.
- Hundreds of human risk signals from the security and HR tools you already use.
- Levels in words, with the evidence. High, Elevated or Low, and the signals behind each one.
- People and AI agents in one model. Agents and the AI tools people use are scored next to the people who own them.
Guide · Livvy
Livvy explains the risk and recommends the action. A person approves.
Ask Livvy, our AI security analyst, why risk is building anywhere in the workforce. Livvy answers in plain language, cites the evidence, and proposes the action that fits each person: a simulation, a short module, a nudge, a team experience or an access change.
- Livvy proposes, a person approves. Nothing that matters runs without a person’s approval.
- Evidence, not guesses. Every answer points to the signals behind it.
- Board-ready summaries of the trend and what changed, when you need them.
Act · playbooks
Playbooks run the right product for each person, automatically.
A playbook turns a recommendation into action across every product on the platform. The person who approves payments gets the voice phishing test. The team that keeps clicking gets an escape room. The admin with odd sign-ins gets step-up MFA.
- Phishing, vishing and SMS phishing aimed by risk, on the channel attackers use.
- Training made for the moment in Content Studio, or from the library.
- Team experiences with CyberEscape Online and VTX, the Virtual Tabletop Experience.
- Access changes through your identity provider, and tickets in the tools your teams use.
See the loop on your own risk. A demo starts from the tools you already run.
Prove · reporting
Show leadership that human risk went down.
Report what changed: fewer risky users, less time in a risky state, and the actions that got you there. The same data runs the program and the board report.
- 68% less time in a risky state after targeted action, in the 2026 Human Risk Report.
- 25–30% fewer risky users in the first six months.
- Board reporting with the trend, the cohorts behind it and what you did about it.
- Employee, manager and executive scorecards, including each person’s own score, if you choose to share it, and a view of each business unit for the leaders who own its risk. See reporting and scorecards
The products
Every way to act on human risk.One platform aims them all.
Each product runs on its own, and each one reports back to the same Human Risk Index, so the next action is aimed better than the last.
The analyst lens
Human risk management andsecure behavior management (SBM).
Secure behavior management is Gartner’s term for moving from security awareness to behavior change. Its September 2026 research note is titled “Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management”.
On Living Security, SBM is part of human risk management: everything it calls for, plus the context that tells you which behavior matters most.
| Secure behavior management | Human risk management on Living Security |
|---|---|
| Measure behavior from real signals, not course completions | The Human Risk Index scores every person from hundreds of signals in the security and HR tools you already run. |
| Personalize interventions with AI | Livvy explains each person’s risk and recommends the right action. A person approves. |
| Automate the program | Playbooks run phishing, training, team experiences and access changes on their own. |
| Measure outcomes | Time in a risky state and the share of risky users, month by month, in a report for the board. |
| HRM adds: identity, access and threat context | A click matters more from someone who approves payments, holds admin rights or is being targeted right now. |
| HRM adds: AI agents | Agents and the AI tools people use sit in the same risk model as your people. |
| HRM adds: an accountable owner | Every cohort, playbook and AI agent has a named person who answers for it. |
| HRM adds: an open framework | The Human Risk Management Framework is published under CC BY 4.0, so you can measure your program against it. |
Gartner is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally.
The open framework
We wrote the open framework for human risk management.
The Human Risk Management Framework is free to use under CC BY 4.0: the signals to measure, the cohorts to act on, the playbooks to run, and a maturity model to grade your program.
Analyst recognition
Leader
Named Leader in the Forrester Wave™: Human Risk Management Solutions, Q3 2024.
Questions buyers ask
Human risk management, answered.
What is human risk management?
Human risk management (HRM) is the practice of finding the people, and now the AI agents, most likely to cause a security incident, acting on that risk, and proving it went down. It measures behavior, access and the threats people face from the security and HR tools a company already runs, and aims action at the few who drive most of the risk instead of sending everyone the same training.
How is human risk management different from security awareness training?
Security awareness training teaches everyone the same thing on a calendar and counts completions. Human risk management measures what people actually do, finds the small group behind most risky behavior, and sends each person the action that fits: a simulation, a short module, a team experience or an access change. Training becomes one of several actions, and success is measured as less risk.
What is secure behavior management (SBM)?
Secure behavior management (SBM) is the term Gartner uses for moving from security awareness programs to changing secure behavior, powered by AI. Its September 2026 research note on the shift is titled "Ditch Security Awareness and Adopt AI-Powered Secure Behavior Management".
Is human risk management the same as secure behavior management?
They overlap. Both replace awareness for its own sake with measured behavior change. Human risk management covers what SBM asks for and adds identity, access and threat context, AI agents in the same risk model, an accountable owner for each risk, and an open framework to measure the program against. On Living Security, secure behavior management is part of human risk management.
How do you measure human risk?
From real signals, not course completions. The Human Risk Index scores every person from 0 to 1,000 from hundreds of behavioral, identity and threat signals in the security and HR tools you already use, and explains each level in words with the evidence behind it. Programs track the share of risky users and the time people spend in a risky state, and report both to the board.
How fast do you see results?
In the 2026 Human Risk Report, targeted action cut the time people spent in a risky state by 68%, and the share of risky users fell 25–30% in the first six months.
How do employees experience human risk management?
As coaching, not punishment. A click on a simulation opens a teachable moment that shows the exact cues they missed, and any follow-up is a short module matched to that lure. People who report a phish are thanked, and their risk profile improves. Each employee sees their own scorecard, managers see their team’s, and executives see the trend. Livvy proposes every intervention, and a person on your team approves it before it runs.
Do employees see a risk score?
Yes, if you choose. Many customers share each person’s Human Risk Index, or a behavior score they define, on that person’s own scorecard: where they stand, why, and how to improve. It’s one of the strongest drivers of behavior change and ownership we see. You can also show levels in words only. Either way it’s coaching, never punishment, and never a public ranking.
Find the few.Prove the risk went down.
See the people and AI agents driving your risk, the action that fits each one, and the report that shows it worked.