A practical framework for identifying the cyber incidents that matter most, then building a Human Risk Management program that delivers measurable results across humans and AI agents
AUSTIN, TX / ACCESS Newswire / July 30, 2026 / Living Security, the leader in Human Risk Management (HRM), today introduced Start With the Why, a new framework that helps organizations build security programs around preventing specific cyber incidents instead of measuring security awareness activities. CEO Ashley Rose will present the framework during the upcoming Cognitive Security Conference (CSC 2026).
As organizations contend with increasingly sophisticated phishing, identity attacks, insider threats, and AI-driven deception, Start With the Why encourages security leaders to begin with a single question:
What breach do we refuse to accept?
Rather than starting with security awareness training, phishing simulations, or technology purchases, the framework helps organizations define the business outcome they want to prevent and then align behavioral signals, identity intelligence, security controls, and targeted interventions around reducing measurable human cyber risk.
“Security teams have spent years optimizing activities instead of outcomes,” said Ashley Rose, CEO and co-founder of Living Security. “Most programs begin by asking what platform to buy or what training to deploy. We believe Human Risk Management should begin by identifying the preventable breach that matters most to the business. Once you define that outcome, every decision, from identity and behavior to policy, training, and governance, becomes aligned around reducing measurable risk.”
Every Breach Begins Before the Incident
The Start With the Why framework is built on a simple premise: every cyber breach has two beginnings.
The first is the breach every organization investigates. The second begins days or weeks earlier, when behavioral and threat signals quietly accumulate across identity providers, email systems, SaaS applications, endpoint tools, and other security technologies.
While organizations have invested heavily in detecting attacks already in progress, many still struggle to connect these signals into actionable intelligence. As a result, security teams often lack the context needed to prioritize the right interventions across humans and AI agents before incidents occur.
By continuously correlating behavior, identity, and threat intelligence, Human Risk Management enables organizations to predict risk before incidents occur and prioritize interventions where they will have the greatest business impact.
A New Operating Model for Human Risk Management
The framework provides security leaders with a practical operating model for reducing human cyber risk:
-
Name the preventable breach the organization refuses to accept.
-
Find the workforce cohort whose behavioral, identity, and threat signals indicate elevated risk.
-
Act through targeted interventions, including coaching, security awareness training, targeted phishing simulations, policy updates, access controls, and automated playbooks.
-
Prove success by measuring reductions in Human Risk Index (HRI) and demonstrating business outcomes tied to the original incident.
Together, these four steps provide a repeatable operating model for connecting behavioral signals to measurable business outcomes.
Rather than treating every employee the same, the framework enables organizations to focus resources where they will have the greatest impact.
Human Risk Isn’t Evenly Distributed
One of the core principles behind the framework is that human cyber risk is highly concentrated.
Research conducted with the Cyentia Institute found that approximately 10% of users account for 73% of measurable human risk, allowing organizations to prioritize interventions for the individuals most likely to contribute to future incidents rather than applying identical controls across the entire workforce.
“The goal isn’t to train everyone more,” Rose said. “It’s to identify the people and behaviors trending toward a specific incident, intervene before that incident occurs, and demonstrate measurable risk reduction. That’s the promise of modern Human Risk Management.”
From Security Awareness to Human Risk Management
The introduction of Start With the Why reflects the market’s evolution beyond traditional security awareness training toward Security Behavior Management and comprehensive Human Risk Management.
Rather than measuring course completions or phishing click rates alone, modern Human Risk Management combines behavioral, identity, and threat intelligence to continuously identify workforce risk and prioritize interventions where they will have the greatest impact across both humans and AI agents.
Presented at the Cognitive Security Conference
Ashley Rose will present the Start With the Why framework during her session at the Cognitive Security Conference, demonstrating how organizations can transform Human Risk Management from a compliance exercise into an operational discipline focused on preventing measurable cyber incidents.
Download the Human Risk Management Command Kit
The free Start With the Why Human Risk Management Command Kit helps organizations put the framework into practice and includes:
-
The Top 10 Preventable Human Risk Incidents
-
Executive workshop guides
-
Human Risk Management planning exercises
-
Team alignment worksheets
-
Practical frameworks for measuring business outcomes
Organizations can download the free Human Risk Management Command Kit at livingsecurity.com/command-kit.
About Living Security
Living Security is the global leader in Human Risk Management (HRM), helping organizations identify, measure, and reduce human cyber risk across humans and AI agents. Its AI-native Human Risk Management platform combines behavioral, identity, and threat intelligence to predict risk, guide response, and prevent cyber incidents before they occur. By connecting security data to measurable business outcomes, Living Security enables organizations to continuously reduce workforce risk while strengthening organizational resilience.
Media Contact: media@livingsecurity.com
SOURCE: Living Security
View the original press release on ACCESS Newswire
Media gallery
