Human Risk Management: Your Questions Answered

9 July 2025

Jul 09 2025

HRM is now an essential component of business cybersecurity. If it’s not yet part of your business’s protection suite, here’s what you need to know to get started.

Firstly, what do you mean by ‘human risks’?

As a business leader, you’re managing risks everyday across finance, operations and compliance. These risks are generally well-understood; you can predict potential consequences, and they’re fairly stable over time. You can assign proportionate systems and policies to keep these risks in check.

Human risks are different. They’re unpredictable, fast-evolving, and harder to measure.

In a cybersecurity context, human risk refers to actions your team members might take that unintentionally expose your business. Phishing emails present a major human risk right now, designed to trick well-meaning employees into providing access or sensitive information. These attacks exploit the human tendency for trust, curiosity, and distraction.

And they’re very effective. In fact, human risks were ranked the #1 concern by Chief Information Security Officers in a recent global survey.

So, what’s HRM in a practical sense?

Human Risk Management (HRM) empowers your people to provide a strong first-line of defense against these threats.

It includes a set of complementary tactics:

Cybersecurity awareness training: Ongoing, bite-sized learning modules tailored to real-world threats.
Phishing simulation: Realistic test emails that check whether training sticks in practise.
Data Analytics: Dashboards to track completion and provide insights into your team’s progress.

Importantly, modern HRM solutions keep pace with new threats, so your team’s skills don’t fall behind.

Will my team hate it?

Not if it’s done well. Most modern HRM programs are far from the dry, checkbox training of the past. The content is short, relevant, and often video-based, designed to respect your team’s time while keeping them sharp. Phishing simulations land in inboxes like regular emails at a manageable frequency, are can be actioned by your team in a few clicks.

With the right internal comms, staff see HRM as an important development opportunity, not a trap.

How does phishing impact smaller businesses?

Proofpoint research found 70% of Australian businesses experienced email compromise attacks in 2023, and small businesses don’t get off lightly.

In FY23-24, the average cyberattack cost:

$49,600 to small businesses, per attack.
$62,800 to medium businesses, per attack.

20% of reported cybercrimes was via email compromise (though many go unreported).

With smaller teams, tighter budgets, and fewer internal controls, SMEs are often more exposed to threats than enterprise businesses. HRM helps close that gap.

What’s made HRM essential now?

Historically, cybersecurity focused on device-based threats: viruses, network hacking and software exploitation. With the general shift from physical infrastructure to the cloud – accelerated by remote work – our digital identities have become a primary target. Login credentials and access rights are the new keys to the castle. Plus, paired with advances in automation and AI, phishing attacks now occur at massive scale.

The most advanced firewall in the world can’t stop someone from clicking the wrong link. That’s why HRM is now considered a critical layer of protection.

While identity fundamentals like password policies and MFA are still essential, HRM addresses the human behaviours that identity protection tools can’t cover alone.

How does HRM fit within my overall security strategy?

Every business is unique, so your cybersecurity strategy should be matched to your priorities, risk profile and budget.

For many Australian businesses, this involves alignment with the Essential Eight Maturity Model. Maturity Level 1 requires users to be trained to identify common threats like phishing, malicious links, or unsafe attachments. HRM directly addresses this.

Cyber insurance is also increasingly requiring evidence of HRM as a condition of cover.

If you’re taking a more tailored approach to your cyber strategy, consider how you’re protecting both device and identity vectors for your business. At Bigfish Technology, we separate our cybersecurity offerings for devices and users, helping you see clearly how each layer of protection works for your business.

Human Risk Management doesn’t have to be complex or time-consuming, but it does need to be intentional.

In a landscape where identity is the new attack surface and phishing is more sophisticated than ever, empowering your team is one of the smartest moves you can make. HRM gives your people the knowledge, tools, and confidence to make secure choices every day.

At Bigfish, we’re here to help you find the right-sized approach for your business. Get in touch if you’d like to begin the conversation.