Dear renegades, mavericks and deviants,

Gartner recently dropped a report telling security leaders to “ditch security awareness and adopt secure behaviour management” (SBM), (which, for them, is something of a bombshell. 😉)

If you’ve been following our industry over the last couple of years, you’ve probably got major category fatigue. First it was security awareness, then Forrester called it human risk management (HRM), now Gartner wants us calling it SBM.

So, is this just another analyst buzzword battle, or is there any actual substance here?

Here’s a summary of my (characteristically unfiltered) take, the full (detailed, juicy, no-holds-barred) version of which you’ll find here.

(Yes, just when you thought it was safe to go back in the water, there are more opinions. …We’re going to need a bigger boat.🦈)

The short answer? The analysts agree on more than they admit.

Whether you prefer Forrester’s term (HRM) or Gartner’s (SBM), both firms reached the same baseline conclusion back in 2022: traditional security training gets you through an audit, but it barely changes what people do.

Both agree that real security progress requires:

• Tracking observed behaviour instead of quiz completion rates or test scores.
• Delivering targeted nudges to specific people at critical moments.
• Measuring real-world risk outcomes instead of module clicks.

My hot take? I don’t actually think you need to pick a side between HRM and SBM.

And as regular readers will know …I love to pick a side, no matter how unpopular that side may be. But on this one? Sit on that fence. Gather those splinters. Be Switzerland.

There is one debate worth having here, though: terminology/lingo/the name.

Gartner analyst Richard Addiscott raised a fair point on this …if you launch a programme by telling your employees they’re “human risks,” you immediately make your job harder.

And if enough people interpret that term negatively, it becomes a distraction, whether they’re right or not. …I don't think they’re right in this instance, but I do think arguing about semantics won't change what they hear, which is in large part why I really welcome ‘secure behaviour management’.

After all, it describes the actual work: i.e. helping people work safely - and focusing on behaviour as the fulcrum. Plus, as AI agents start taking actions on behalf of employees, “behaviour” easily covers both humans and agents without stretching the word to its (somewhat inevitable) breaking point.

The trap most behaviour programmes fall into

Here’s where most modern vendors and tools drop the ball: they focus heavily on how to manage behaviour, but stay completely silent on which behaviours to target.

And without a clear strategy, it’s too easy to fall into the new-tech trap:

1. Run generic awareness training.
2. Throw in some flashy AI phishing simulations.
3. Send automated notifications on Teams when someone clicks a link (call them behaviour nudges even though they aren’t ;-).
4. Call it all ‘secure behaviour management’.

That’s just putting shiny AI paint on the same old broken loop. And we all know where that leads you (if anyone’s unsure, Google the term “AI slop”).

But phishing isn't your only exposure. What about employees pasting sensitive code into unapproved AI tools? Reusing breached passwords across corporate accounts? Sharing files through personal Cloud drives? None of these show up in a phishing simulation.

Why training alone keeps failing (a quick behavioural science reality check)

COM-B, a model developed by behavioural scientists at University College London, proves that human action requires three things: capability, opportunity and motivation.

Standard security awareness training only really addresses capability.

If six employees are reusing passwords, sending them all the same 5-minute training module only helps the one person who genuinely didn’t know it was dangerous. It does zero for the employee who doesn't have a password manager, or the one under extreme deadline pressure who took a shortcut.

How to stop guessing and build a real programme

If you want to move past awareness vanity metrics, here’s the 5-step framework we use at CybSafe:

1. Start with the harm: Work backwards from board-level impact (financial loss, regulatory fines, operational downtime). Identify the specific behaviours driving those vulnerabilities.
2. Diagnose the root cause: Use behavioural science, surveys, and telemetry to figure out why a behaviour is happening (Is it a lack of knowledge, high friction, or bad motivation?).
3. Match the fix to the cause: If it's a knowledge gap, train. If it's friction, fix the workflow or add a nudge.
4. Prove it worked: Measure actual behavioural telemetry – ideally through controlled trials – to verify your fix caused the drop in risk.
5. Shift focus, rinse and repeat: Once a behaviour is under control, move to the next highest-exposure risk.

The bottom line

At CybSafe, we’ve always built toward this model – from our open-source Security Behaviour Database (SebDB) to Project NEXUS.

Call it human risk management, call it secure behaviour management. Honestly, I don’t care either way. At the end of the day, category labels describe the market full spectrum behaviour change is the actual work.

Agree with me? Great.

Disagree with me? Also great.

Either way, there’s more where this came from on this topic, right here. And either way, I’d love to hear what you think.

I’ll leave you with two questions to bring to your next team meeting:

• Which three behaviours carry the highest financial exposure in your organisation right now?
• Can you prove to your board that any of them changed last quarter?

Hit reply and let me know how your team is tackling this. I’d love to hear your thoughts.

Book in time with me and let’s discuss it.

Until next time.

Oz Alashe

CEO and Founder, CybSafe

What did you think of today's email?

Your feedback helps me create better emails for you!

Was this email forwarded to you? Sign up here.