Clear, steady, fully present — that's the state where the right calls get made, the mistakes get caught, and your best people stay. It's the one layer of your risk no tool reaches and no training installs — and it can be built.
It's easy to shrink this down to cyberattacks. It's much bigger. Human risk is the wire sent to the wrong account, the control signed off without the verification behind it, the deal approved without the scrutiny it deserved, the system left misconfigured, the detail missed under a deadline — and, yes, the click on the bad link. Different outcomes, one root: a capable person, at a moment, in a particular state.
The clearest numbers come from the loud version — breaches. The human element is in the majority of them, and when security professionals are asked why organizations actually get hit, the top reasons aren't sophisticated attacks. They're the state a person is in:
And that same state sits behind the quieter losses, too — the errors, the missed controls, the call made too fast. Not what people know; the state they're in when it counts.
Here's why that matters for everything you've already built: every control, policy, tool, and training you run rests on a silent assumption — that the person using it is clear, steady, and at their best. That assumption is the layer beneath all of it, and it's the one none of them reach. Build that layer — the state your people bring to the moment — and every control on top of it works better. Leave it undeveloped, and it quietly becomes the weakest point in all of them.
Your people don't just learn about human risk — they see it in themselves, and begin to change how they show up when it counts. They come away understanding the science behind it, recognizing the patterns behind the real losses, and holding a first, practical way to steady the state behind a decision. It stands on its own, and it opens the door to what follows.
The program is where the capability is built — your people learning to read their own state and hold clear judgment when it counts, until steadier decisions aren't an effort, but simply how they work.
Delivered in person or online, and scoped to your organization — your people, your risk, your goals.
Human risk feels unmeasurable, so it goes unmanaged. The Human-Risk Surface is our lens for seeing where it actually concentrates — built on three factors:
Where high consequence meets heavy load and low resilience — on the same person, at the same time — that overlap is your Human-Risk Surface. Your hot zones. It makes visible the layer your other models can't reach, and points you to exactly where it matters most.
Under load, the brain does something automatic: it shifts toward its fast, reactive system and away from the slow, deliberate part that catches the error. Attention narrows, judgment dips, a familiar-looking request slips through — not carelessness, just how the nervous system is wired. And here's the part that matters, and the whole point of this work: the same circuitry that learned those fast patterns can be retrained to hold steadier ones. The state isn't a fixed trait. It's trainable.
Your people already know the policy. They know the control, the callback, the "don't rush." Knowledge isn't the gap — and no amount of it closes one that was never about knowing.
Security awareness training is good, and worth keeping: it teaches people what to do. But what fails under load isn't what they know — it's the state they're in when they have to use it. That's the layer this works on. Not another course to complete or module to click through, but the capacity that decides whether everything you've already taught actually holds when it counts.
So this doesn't replace what you run. It's the layer underneath it — and the reason the rest of it pays off.
It's tempting to picture human risk living within a few high-privilege roles — IT, security, and finance. And those aren't the only places. It lives wherever a person can make a consequential decision or take an action that matters — which is nearly everyone.
The finance lead with wire authority. The sales director holding client data. The engineer shipping under a deadline. The assistant who runs an executive's inbox. Leaders, too — seniority isn't immunity.
It isn't about rank. It's about consequence — and consequence runs through your whole organization.
The expensive errors — and the breaches that begin with a single person — happen far less often when that person is steady and clear. And the same steadiness that prevents the miss sharpens the decisions that follow: risk down and performance up, from one root.
A focused conversation about where your human risk concentrates — and what steadying it could do.