Human Risk Management: The Missing Link in Cybersecurity and Governance
Dr Jenny Tan7 May 2026 · 1 min read · First published by Institute of Risk Management (IRM)
Written in Jenny's capacity as Chair of the IRM Singapore Group, this article argues that the most important vulnerability in any organisation is not a server or a firewall — it is people. Research consistently shows that the vast majority of breaches involve some human action or mistake, yet security programmes continue to concentrate almost entirely on technology.
Jenny applies the classic Fraud Triangle to cybersecurity. Misconduct and risky behaviour rarely come from a single trigger; they emerge when pressure, opportunity and rationalisation coincide. Toxic cultures and 'win at all costs' mentalities quietly normalise the behaviours that eventually cause incidents.
The answer is a multi-layered response that treats human behaviour as something that can be shaped: strong internal controls and independent audit, whistle-blowing channels and a genuine speak-up culture, continuous training that changes habits rather than ticking boxes, and ethical leadership that earns trust.
Despite widespread recognition that human capital risk is a top concern, fewer than 15% of Asia-Pacific organisations effectively quantify cyber risk. Jenny's closing message is practical: organisations should not wait for perfect readiness. Start from where your maturity is today, and build from there.
Key takeaways
- Most breaches involve people — so human behaviour must be a first-class element of cyber risk management.
- Pressure, opportunity and rationalisation together explain most misconduct; culture is a control.
- Combine controls and audit with speak-up culture, continuous training and ethical leadership.
- Start now, at your current maturity — postponement is the costlier choice.
Enjoyed this article?
Subscribe for new articles, or invite Jenny to speak on this topic at your next event.
Comments