Not a checkbox anymore | Welcome to the Era of Human Risk Management

When Canadian small and medium-sized businesses (SMBs) talk about cybersecurity, the conversation often starts with tools: endpoint protection, email filtering, backups, and maybe a SOC. But the data keeps pulling us back to a more uncomfortable truth, people remain one of the biggest “attack surfaces” in every organization.

Verizon’s 2025 Data Breach Investigations Report (DBIR) found that human involvement in breaches remains about 60%, with a significant overlap between social engineering and credential abuse. That’s not a “user error” story, it’s a modern security story, where identity is the perimeter and attackers increasingly succeed by persuading someone to click, approve, share, or pay.

From Toronto financial firms to manufacturing companies in Alberta, organizations across the country are realizing that technical controls alone aren’t enough. The new perimeter isn’t your firewall, it’s your people. It means security awareness training can’t be an annual compliance video. It needs to be part of an operational program called Human Risk Management.

Recent threat research reinforces what many we at ALCiT see daily:

• Arctic Wolf’s 2026 Threat Report found that business email compromise (BEC) accounts for more than 1 in 4 Incident Response engagements, with 85% tied to social engineering.
• Nearly two-thirds of IT leaders admit they’ve clicked a phishing link at some point.
• Half of employee’s report doing the same.

These aren’t edge cases, they’re normal human workplace moments being weaponized.

Translation for you and your business: if your security strategy focuses only on technology, you’re defending the doors while attackers are walking in with stolen badges.

What Is Human Risk (and Why It’s Not Just “User Mistakes”)?

Human Risk (Simple Definition)

Human risk is the measurable likelihood that everyday employee actions—intentional or accidental—create security exposure. In a cloud-and-SaaS world, that often means:

• Credentials entered into a fake sign-in page.
• MFA approvals granted under pressure (“MFA fatigue”)
• Sensitive data shared with the wrong person, tool, or inbox rule.

Why It’s Not “User Error”

When breaches involve a person, organizations sometimes default to blame. But human-driven incidents usually succeed because processes and controls aren’t designed to support good decisions, such as:

• Weak verification steps for payment changes (classic BEC)
• Inconsistent MFA enforcement
• Overly complex reporting processes that discourage fast escalation

The goal isn’t to “fix the humans.” It’s to reduce the probability and blast radius of human-triggered events, just like patching reduces the probability of exploit-driven incidents.

Want to Reduce Human Risk in Your Organization?

Here’s what we recommend for business looking for outcomes, not checkboxes:

1)Train continuously, in small doses

Monthly micro-learning beats annual marathons. “Keep it current” matters because tactics evolve fast.

2) Make it role-based

BEC thrives on workflows and executive authority. Arctic Wolf’s reporting shows how persistent BEC remains in real incident response work.

3) Run phishing simulations with coaching

Simulations shouldn’t be “gotcha” moments. They should generate insights: who needs help, what lures are working, and which departments are trending risky.

4) Pair training with identity controls

At minimum:

1. MFA everywhere
2. Conditional access policies (geo/risk-based)
3. Least privilege and admin separation

5) Build a reporting culture that rewards speed
If the human element remains involved in around 60% of breaches, the solution isn’t to lecture employees, it’s to make them part of the security stacks.

Human risk will never disappear, but it can be measured, managed, and reduced. With the right strategy, training, and cybersecurity partnership, you can turn employees from an attack surface into a frontline defense.

If you’re ready to take human risk seriously, we’re here to help.