The human risk business case: what to bring to the board

The bottom line: the human risk business case is not the cost of the course, it is the cost of the breach that does not happen

The criterion that weighs most when someone builds the business case for human risk management (HRM) is not how much the training costs, but how much the breach you prevent costs. A security leader who walks into the boardroom holding the invoice for an awareness program loses the argument before it starts, because they have turned it into an expense to be cut. The same leader who arrives with two numbers, what a human-origin breach costs and how much that probability falls when behavior is actually validated, changes the conversation from spending to measurable risk reduction.

That is the frame for this whole piece. The case rests on an idea leadership already finds familiar: most breaches begin with the human factor, those breaches are expensive, and what lowers their probability is not completing a course but proving that behavior changed under real pressure. The data the board needs to hear and the metrics that actually hold up the argument all organize themselves around that idea.

What a human-origin breach costs today, and why it drops when you react fast

The first number is the cost of the breach. According to IBM's Cost of a Data Breach 2025 report, the global average cost of a data breach was 4.4 million dollars, a 9 percent drop from the prior year, driven by faster identification and containment. That figure tells the board two useful things at once. First, that a single serious breach outweighs entire years of the budget spent on people. Second, and less obvious, that the cost drops precisely when the company detects and contains sooner: speed of response is not a technical luxury, it is a direct lever on the number leadership fears.

The second number is where that risk comes from. Cisco's 90-5-5 framework estimates that close to 90 percent of breaches involve a human factor. And the entry point is still email: according to CISA, more than 90 percent of successful cyber-attacks start with a phishing email.

This is not about a careless employee or a fault you can pin on the person, it is about people who are the deliberate target of an attack designed to deceive them. An honest business case blames no one: it recognizes that if nine of every ten incidents touch a person, that is where an investment pays off. The same holds for the most expensive frauds, such as business email compromise (BEC), where the attacker breaks no system, they convince a person.

The market already validated the category: why it grows and who is adopting it

It reassures a board to know it is not funding an experiment. The category already has size and a track record. According to Mordor Intelligence, the security awareness training market is valued at 6.74 billion dollars in 2026, up from 5.77 billion in 2025, and is projected to reach 14.66 billion by 2031, with a compound annual growth rate near 16.82 percent. That sustained growth is not a fad: it reflects that cyber insurers began demanding proof that employees are prepared, and that AI-driven attacks lowered the cost of producing convincing deception.

The same analysis notes that small and midsize companies are the fastest-growing segment by organization size, as cloud delivery lowers the cost and deployment barriers. For a midsize company this matters: you no longer need a large enterprise's budget to run a serious program. The conversation with leadership stops being "can we afford it" and becomes "which one do we choose and how do we measure that it works". If you want to settle the pricing part first, it is worth reviewing separately how much a human risk management platform costs today for the 25-to-500-employee range.

Building the case for leadership: from a compliance expense to measurable risk reduction

The most common mistake is to present human risk as a compliance obligation. Meeting a regulation is necessary, but as an argument to the board it is weak, because it invites the question of the minimum you can spend to tick the box. The strong case is built the other way around: you start from the expected cost of a human-origin breach, estimate how much of that risk depends on behaviors that go unvalidated today, and present the investment as the way to reduce that exposure in a provable manner.

In practice, the argument is built in three layers. Current exposure, meaning how many of the team's credentials are already leaked and how many people fall for a realistic deception today. The cost of that risk materializing, anchored to the breach figure we already saw. And the expected reduction, expressed not as "people will take more courses" but as "fewer people fall, and we prove it by testing them again". That last layer is what separates a credible business case from a wish list. A solid set of questions to separate vendors who deliver that reduction from those who only claim it lives in ten questions to ask a human risk vendor.

The metrics that hold up the argument: validated behavior, not completed courses

Here is the heart of the case, and also where most programs go wrong. The metric most people bring to the board is the training completion rate, and it is the wrong one. There is peer-reviewed evidence (Ho et al., IEEE Symposium on Security and Privacy 2025; Lain et al., 2022) that completing training does not by itself predict a reduction in real failures. Put another way: a dashboard showing 98 percent of courses completed can coexist with a team that still falls for the first well-crafted email.

What does hold up the argument is testing behavior and testing it again. The distinction is simple to explain to leadership:

The left column measures activity. The right column measures outcome. The retest, testing the person again weeks later with an equivalent but different deception, is what turns a promise into evidence: it validates that they learned the lesson, not that they remembered one specific email. When the board sees that second column, the investment stops looking like a human resources expense and starts looking like a risk control with its own measurement.

Presenting the investment in terms the board understands

A board does not decide on phishing templates or per-person risk scores. It decides on exposure, probability and cost. Presenting the case in its language is what unlocks the budget:

Open with real exposure, not with the solution. How many of the team's credentials are already circulating and what percentage of people fall for a realistic deception today. That is the number that creates the productive discomfort that moves a decision.

Translate the risk into money with a single defensible figure. The average cost of a breach against the annual cost of the program. The comparison stands on its own when the first figure comes from a neutral source and the second is your invoice.

Commit to an outcome metric, not an activity one. Instead of "we will train 100 percent", offer "we will reduce this group's failure rate and prove it with a fresh test in X weeks". That gives leadership something it can audit.

Framed this way, the human risk business case stops competing with other spending lines and starts competing with the cost of not doing it. And that is a field where the human factor, at last, wins the argument.

At Fensivo we address exactly that use case: we continuously monitor whether the team's credentials appear in breaches, we send email phishing simulations personalized per person, we deliver microlearning within minutes to whoever falls, and, above all, we validate the change with a later retest, so the report to leadership shows proven behavior rather than completed courses. It is built for companies of 25 to 500 employees, with a first executive report within the first 48 hours. If you want to see how that translates into a concrete case, review our use cases.

Which of the two numbers does your team bring to the board today: how many courses were completed, or how many people fell again when you tested them anew?

Sources and references

• IBM, "Cost of a Data Breach Report 2025": https://www.ibm.com/reports/data-breach
• Cisco, "The 90-5-5 Concept: Your Key to Solving Human Risk in Cybersecurity", May 27, 2025: https://blogs.cisco.com/security/the-90-5-5-concept-your-key-to-solving-human-risk-in-cybersecurity
• CISA, "4 Things You Can Do To Keep Yourself Cyber Safe": https://www.cisa.gov/news-events/news/4-things-you-can-do-keep-yourself-cyber-safe
• Mordor Intelligence, "Security Awareness Training Market Size & Share Analysis (2026-2031)": https://www.mordorintelligence.com/industry-reports/security-awareness-training-market
• Ho, G. et al., "Understanding the Efficacy of Phishing Training in Practice", 2025 IEEE Symposium on Security and Privacy: https://ieeexplore.ieee.org/document/11023357
• Lain, D., Kostiainen, K. and Čapkun, S., "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study", 2022 IEEE Symposium on Security and Privacy: https://ieeexplore.ieee.org/document/9833766