0 / 24

Model 49 of 74 · Cybersecurity

Human Behaviour Security Maturity Assessment

Assess how well your organisation measures and strengthens human security behaviour.

Pillars & areas

Prepare

Educate the people

  1. 01Security Awareness & Training Effectiveness
  2. 02Phishing & Social Engineering Resilience

Observe

Measure the behaviour

  1. 03Insider Threat Management
  2. 04Security Culture & Psychological Safety

Embed

Strengthen the instincts

  1. 05Decision-Making Under Pressure
  2. 06Human Risk Measurement & Analytics

Levels

  1. 1Compliance-DrivenCheckbox awareness
  2. 2Behaviour-InformedMeasured & targeted
  3. 3InstinctiveEmbedded & reflexive

01 Security Awareness & Training Effectiveness

Does the organisation design, deliver, and measure training that actually changes behaviour — not just completion rates?

0/4 answered

AT-1How does your organisation design security awareness training content?

Think about whether training is a generic slide deck applied to everyone, or whether content is tailored to the risks each role actually faces.

AT-2How does your organisation measure whether security training changes behaviour?

Consider whether you track completion rates alone, or whether you have evidence that training leads to different actions in day-to-day work.

AT-3How frequently and consistently does your organisation deliver security awareness activities?

Think about whether awareness is a once-a-year event or an ongoing programme with regular touchpoints throughout the year.

AT-4How does your organisation ensure training genuinely engages people rather than being passively consumed?

Consider whether people actively participate and think during training, or whether they click through slides as fast as possible to get back to work.

02 Phishing & Social Engineering Resilience

Can your people recognise and resist manipulation through phishing, vishing, pretexting, and other social engineering techniques?

0/4 answered

PE-1How does your organisation test employee resilience to phishing attacks?

Think about whether phishing simulations are conducted, how realistic they are, and whether difficulty increases over time.

PE-2What happens when someone falls for a phishing simulation or reports a real phishing attempt?

Consider whether clicking a simulated phish leads to punishment or coaching, and whether reporting a real phish results in feedback.

PE-3Does your organisation test resilience to social engineering beyond email phishing?

Think about whether you test for vishing (phone), smishing (SMS), physical pretexting, or other non-email manipulation techniques.

PE-4How does your organisation track and use social engineering resilience data over time?

Consider whether you can show trends — are click rates falling, reporting rates rising, and response times improving?

03 Insider Threat Management

Can the organisation identify, monitor, and respond to threats from within while maintaining employee trust and privacy?

0/4 answered

IT-1Has your organisation defined what constitutes insider threat behaviour and who is responsible for managing it?

Think about whether there is a clear definition of insider threat types (malicious, negligent, compromised) and an owner for the programme.

IT-2How does your organisation detect behavioural indicators of insider risk?

Consider whether you monitor for patterns like unusual data access, off-hours activity, or policy violations that could indicate insider risk.

IT-3How does your organisation balance insider threat monitoring with employee privacy and trust?

Think about whether staff know they are monitored, whether monitoring is proportionate, and whether there are safeguards against misuse.

IT-4How does your organisation handle insider threat investigations and outcomes?

Consider whether investigations are conducted fairly, whether there is a process for different outcomes, and whether lessons are fed back.

04 Security Culture & Psychological Safety

Do people feel safe reporting security mistakes, and does leadership model the behaviours it expects from everyone else?

0/4 answered

CS-1How does your organisation respond when someone reports a security mistake they made?

Think about what actually happens when someone admits they clicked a phishing link, shared credentials, or bypassed a control — are they helped or punished?

CS-2How do senior leaders demonstrate their personal commitment to security behaviour?

Consider whether executives follow the same security rules as everyone else, or whether they demand exceptions and shortcuts.

CS-3How does your organisation encourage people to challenge suspicious requests, even from authority figures?

Think about whether staff feel empowered to question an urgent request from a senior executive if something feels wrong, or whether hierarchy overrides caution.

CS-4How does your organisation make secure behaviour easy and convenient?

Consider whether security controls create so much friction that people work around them, or whether secure options are the path of least resistance.

05 Decision-Making Under Pressure

Can your people make sound security decisions when time is short, situations are unfamiliar, and social pressure is high?

0/4 answered

DP-1Does your organisation prepare people for security decisions they may face in high-pressure situations?

Think about whether staff have practised scenarios like urgent wire transfer requests, credential challenges, or suspicious visitor encounters before they happen for real.

DP-2How does your organisation help people handle novel or ambiguous security situations they have not been trained for?

Consider what happens when someone encounters a situation that does not match any training scenario — do they have a framework for making a safe decision?

DP-3How does your organisation address cognitive biases that attackers exploit?

Think about whether people understand how urgency, authority, reciprocity, and social proof are used against them in social engineering attacks.

DP-4How clear and accessible are escalation paths when someone faces a security decision they are unsure about?

Consider whether people know exactly who to contact and how quickly they can get guidance when something does not feel right.

06 Human Risk Measurement & Analytics

Does the organisation quantify human security risk and use data to drive decisions about where to invest in people-focused controls?

0/4 answered

HR-1Does your organisation maintain a quantitative measure of human security risk?

Think about whether you can put a number on how much risk your people represent — not just how many completed training, but how likely they are to cause or prevent an incident.

HR-2How does your organisation identify which teams or roles represent the highest human security risk?

Consider whether you can point to specific departments or functions where human risk is concentrated, and whether you act on that information.

HR-3How does your organisation demonstrate the return on investment of its human security programme?

Think about whether you can show that money spent on awareness, training, and culture actually reduces incidents — or whether the budget is justified by faith alone.

HR-4How does your organisation use human risk data to inform broader security strategy?

Consider whether human risk metrics feed into security investment decisions, architecture choices, and board reporting alongside technical risk data.

Self-assessment report

Human Behaviour Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Human Behaviour Security maturity model

People are simultaneously the largest attack surface and the most powerful defensive asset in any organisation. Firewalls, encryption, and endpoint detection are critical — but every one of those controls can be bypassed by a single person making a poor decision under pressure, falling for a well-crafted social engineering attack, or simply choosing the convenient path over the secure one. The uncomfortable truth is that most breaches involve a human element, yet most organisations invest overwhelmingly in technology and treat people as an afterthought.

Traditional security awareness programmes fail because they measure completion, not behaviour. Passing a quiz does not mean someone will challenge an unusual wire transfer request on a Friday afternoon. This model measures what people actually do when facing security decisions — not what they know in a classroom. It draws on behavioural science principles: that habits, cognitive biases, environmental cues, and organisational culture shape security outcomes far more than knowledge alone.

The goal is to shift from compliance-driven awareness to evidence-based human risk management. Organisations that measure human security behaviour quantitatively — and intervene where the data points — build a workforce that acts as a genuine last line of defence, not a liability waiting to be exploited.

The Human Behaviour Security maturity model assesses six areas across 24 questions, focusing on how organisations understand, measure, and strengthen the human element of cybersecurity. It goes far beyond awareness training to examine phishing and social engineering resilience, insider threat management, the psychological safety needed for a genuine reporting culture, how people make security decisions under pressure, and whether the organisation uses data to quantify and reduce human risk.

This assessment is designed for any organisation that recognises people as a critical security control. Whether you have a mature security awareness function or are just starting to think about the human side of security, the questions surface the gap between what your people know and what they actually do — and whether your organisation is set up to close that gap systematically.

Who this assessment is for

  • CISOs and security leaders who want to move beyond checkbox awareness training
  • Security awareness and culture programme managers measuring programme effectiveness
  • HR and people leaders partnering with security on insider risk and culture initiatives
  • Risk managers quantifying human risk as part of enterprise risk management
  • Compliance officers assessing whether human security controls meet regulatory expectations
  • Consultants and advisors evaluating the people side of an organisation's security posture

The three maturity levels

  • Level 1 — Compliance-Driven: Security awareness exists to satisfy regulatory or audit requirements. Training is generic, annual, and measured by completion rates. There is no behavioural data — the organisation cannot say whether training changes how people act. Phishing simulations, if they exist, are infrequent and results are not acted upon. Insider threats are not formally addressed. Reporting is discouraged by a blame culture, and security decisions under pressure are left to individual judgement with no support structure.
  • Level 2 — Behaviour-Informed: The organisation measures human security behaviour and uses the data to target interventions. Training is role-relevant and reinforced throughout the year. Phishing simulations run regularly with progressive difficulty, and results drive coaching. Insider threat indicators are monitored with appropriate privacy safeguards. A reporting culture is actively cultivated, and staff receive guidance for making security decisions in ambiguous situations. Human risk is tracked at a departmental level.
  • Level 3 — Instinctive: Secure behaviour is embedded in organisational culture and reinforced by environment, process, and leadership. The organisation quantifies human risk across every team and uses predictive analytics to intervene before incidents occur. People report suspicious activity reflexively, challenge anomalies without hesitation, and make sound security decisions under pressure because they have been trained in realistic scenarios. Insider threat management balances detection with dignity. Human risk metrics sit alongside technical metrics in security dashboards and board reporting.

The 6 areas assessed

1. Security Awareness & Training Effectiveness

How the organisation designs, delivers, and measures security training. This area examines whether training is a passive compliance exercise or an active behaviour-change programme — whether content is relevant to each role, whether engagement is genuine, and whether the organisation can prove that training changes what people do, not just what they know.

2. Phishing & Social Engineering Resilience

How resilient the workforce is to manipulation through phishing, vishing, pretexting, and other social engineering techniques. This area assesses whether the organisation tests its people realistically, tracks results over time, increases difficulty progressively, and uses reporting rates — not just click rates — as the measure of success.

3. Insider Threat Management

How the organisation identifies, monitors, and responds to threats originating from within — whether malicious, negligent, or compromised. This area examines whether behavioural indicators are defined and monitored, whether investigations are handled proportionately, and whether the programme balances security with employee privacy and trust.

4. Security Culture & Psychological Safety

Whether the organisation has built a culture where people feel safe reporting mistakes, challenging suspicious requests, and raising security concerns without fear of blame. This area examines leadership behaviour, incentive structures, and whether the cultural conditions exist for security controls to actually work.

5. Decision-Making Under Pressure

How well people make security-relevant decisions when under time pressure, in unfamiliar situations, or when social dynamics push them toward unsafe choices. This area assesses whether the organisation prepares people for real-world decision points — wire transfer requests, credential challenges, physical tailgating — through scenario-based training and clear decision frameworks.

6. Human Risk Measurement & Analytics

Whether the organisation quantifies human security risk and uses data to drive decisions. This area examines whether behavioural metrics exist, whether risk is scored at individual and departmental levels, whether trends are tracked over time, and whether programme investment is justified by measurable outcomes rather than assumptions.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • NIST SP 800-50 Rev. 1 / SP 800-16 — guidance on building cybersecurity and privacy learning programmes and role-based training
  • SANS Security Awareness Maturity Model — a five-level model for benchmarking security awareness programme maturity
  • Carnegie Mellon CERT Insider Threat Program — a framework for establishing and maturing insider threat programmes
  • ENISA Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity — guidance from the European Union Agency for Cybersecurity on the human element in cybersecurity
  • ISO/IEC 27002:2022 Clause 6 — people controls within the information security management standard

Frequently asked questions

What is the Human Behaviour Security maturity model?

Assess how well your organisation measures and strengthens human security behaviour. It is an original, simplified model with three maturity levels (Compliance-Driven, Behaviour-Informed and Instinctive), assessed through 24 questions across 6 areas: Security Awareness & Training Effectiveness, Phishing & Social Engineering Resilience, Insider Threat Management, Security Culture & Psychological Safety, Decision-Making Under Pressure and Human Risk Measurement & Analytics.

How long does the Human Behaviour Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Compliance-Driven), 2 (Behaviour-Informed) or 3 (Instinctive). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.