The 7 vendor clusters you need to know
1. Human risk intelligence & behavioral management platforms
These are broad-spectrum HRM platforms that go well beyond training and phishing sims. The most effective ones:
- Map behaviors to risk using structured models and real-world data
- Measure a wide range of behaviors via integrations with security tools
- Deliver data-driven behavioral interventions — not just training content
- Automate intervention delivery using workflows to scale outcomes
These solutions usually meet the SAT compliance requirement — but they go beyond that. They measure a broader set of security behaviors and aim to demonstrate risk reduction by improving them.
2. Email security platforms with bolt-on security awareness
These vendors started life solving email threats — especially phishing — and later added awareness training as a feature. The result is often siloed, email-centric human risk coverage with little behavioral depth. (Note: KnowBe4 went the other way — training first, then added email tools.)
Buyers often see these as “HRM” tools too. But in reality, they address only a narrow slice of the broader human cyber risk surface.
3. Engagement-driven training & phishing simulation vendors
These platforms are designed around content delivery and phishing (smishing, vishing, quishing, etc.) simulations. The goal is often to boost training engagement metrics. They tend to promise “behavior change” — but in practice, they measure little beyond clicks, completions, and report rates.
These tools are great for awareness campaigns or checking the compliance box. But they don’t measure behavior change in any meaningful way beyond phishing. Nor do they help with real-time risk reduction.
4. Developer-centric secure coding & application training
These platforms focus on changing the behaviors of developers and engineering teams. They offer secure coding labs, challenges, and skills development.
Crucial for application security — but they don’t help you manage organization-wide human cyber risk.
5. Lightweight, embedded training for modern workflows (Slack, mobile)
These tools prioritize delivery convenience — offering nudges or microlearning via Slack, Teams, or mobile. They often have great UX and high engagement.
Useful for just-in-time learning — but light on behavioral analytics, risk visibility, or impact measurement.
6. Deepfake, AI phishing & social engineering simulation tools
These vendors are focused on highly specific and emerging threats — like deepfakes, AI-generated voice attacks, or video impersonation. Their simulations are often advanced and novel.
These tools are increasingly relevant and can complement an HRM strategy. But they aren’t full-featured HRM platforms.
7. Browser-based behavior nudging tools
These tools offer nudges or prompts directly in the browser, often at the moment of risky behavior (e.g., entering a sensitive site, sharing credentials). They act as real-time interventions.
Great for in-the-moment friction. But they’re limited to browser-detectable behavior and don’t provide insight into the broader behavioral landscape or risk models.
