Human Risk Management: The Missing Link in Cybersecurity and Organisational Resilience

Jenny turned her presentation at the Trueventus CRO Summit 2026 into this article, shared on LinkedIn in June 2026. Her starting point is that as organisations speed up digital transformation and adopt AI, most risk still comes from people rather than technology, as breaches such as Capital One in 2019 and the social engineering attack on Marks & Spencer in 2025 show. Human capital risk ranks among the top organisational risks in the IIA's Risk in Focus 2026 report, yet it is usually assessed through policy compliance rather than actual behaviour, and few organisations have a formal human risk management programme.

She looks at three sources of human risk. Insider threats come from trusted employees, contractors and partners whose access makes them hard to detect; their common root causes are financial pressure, dissatisfaction at work, lack of awareness and excessive access rights. Fatigue and cognitive overload slow reactions, cloud judgement and make phishing more likely to succeed, especially as AI adoption and restructuring add to workloads. Decision biases, such as deference to authority, confirmation bias, overconfidence and the normalisation of deviance, are exactly what social engineers exploit.

Human risk management changes the response. It treats people not as the weakest link but as contributors to resilience whose behaviour can be understood and influenced, and it reads errors as signs of systemic problems such as heavy workloads or poorly designed processes, not only individual failings. In place of one-off training it offers continuous, personalised and supportive interventions. Jenny argues for moving from combined assurance to continuous assurance, with business, risk, cybersecurity, HR and audit teams watching for behavioural warning signs together.

Her caution is that none of this means heavy monitoring or punitive risk scores. The aim is a risk-aware culture built on trust, transparency, ethical monitoring and respect for privacy. With most breaches still involving a human element, organisations that understand their people's behaviour, engagement and risk-taking will be the more resilient ones. The article develops a theme she also explored in May 2026 for the Institute of Risk Management.

Read the full article at LinkedIn