Understand how prepared your organisation is to manage human risk – and what to do next.

Your organisation is at a Baseline stage, where human security is not yet managed as a distinct focus. Awareness, reporting, and behavioural signals are limited, making human risk largely invisible and decisions reliant on assumptions or technical controls rather than real insight.

Recommended next steps

• Establish a structured awareness baseline
• Clarify ownership for human risk management
• Introduce simple and accessible reporting mechanisms
• Begin tracking basic behaviour and engagement signals

Your organisation is at a Foundational stage, where security awareness and basic practices exist but are largely compliance-driven, generic, and reactive. Human risk is partially visible, but not yet well understood, and secure behaviour can break under pressure or competing priorities.

Recommended next steps

• Move beyond generic training with role-based, contextual content
• Identify where behaviour breaks in real-world scenarios
• Improve ease and confidence in threat reporting
• Start connecting awareness, behaviour, and reporting signals

Your organisation is operating at a Proactive stage, where human security is actively managed through regular programs, simulations, and reporting practices. While risk is increasingly visible and better understood, it is not yet consistently controlled — and gaps in reinforcement or behaviour under pressure may still expose the organisation to avoidable incidents.

Recommended next steps

• Strengthen consistency of secure behaviours across teams
• Improve feedback loops for reported threats
• Focus interventions on high-risk behaviours and groups
• Reduce friction in security tools and workflows

Your organisation is operating at an Adaptive stage, where human security is embedded into day-to-day operations. Behavioral and threat signals are continuously used to guide actions, reinforce secure habits, and respond to evolving risks. The focus now shifts to scaling consistency, prioritising effectively, and adapting without introducing friction or fatigue.

Recommended next steps

• Use signals to prioritise interventions at scale
• Continuously adapt content and reinforcement strategies
• Strengthen peer-led behaviours and security champions
• Connect human risk insights to broader business and risk outcomes