Phishing & social engineering
Develop the right reflexes when facing unusual messages and requests.
AWSMTECH
Human Risk Intelligence
Understand human risk, tailor your awareness training and turn your employees into active contributors to your cybersecurity.
Human factor
Turn the human factor into a genuine line of defence.
Security technologies keep getting more powerful. Yet attackers can still try to bypass these protections by targeting people directly: phishing, identity impersonation, fraud, unintentional information sharing or poor digital practices.
Human Risk Intelligence addresses this dimension in a structured way: identifying risky behaviours, targeting awareness training more effectively and measuring how your organisation's cyber culture evolves.
The goal is not to monitor your employees. It is to give them the right reflexes so they become an active part of your cybersecurity.
Everyday decisions
Behind every digital identity, there is a person
Businesses invest in firewalls, antivirus, MFA, backups and detection solutions. But every day, employees make dozens of decisions with a digital dimension:
- Is this link legitimate?
- Can I share this document?
- Does this request really come from my colleague?
- Can I use this AI tool with business data?
- What should I do with an unusual request?
Security therefore also depends on employees' ability to recognise an unusual situation and respond appropriately.
Definition
What is Human Risk Intelligence?
Better understanding human risk in order to better direct awareness efforts.
Rather than delivering the same generic training to the entire organisation, the idea is to build an approach based on different signals and awareness exercises to identify the topics that need particular attention.
Our model is built on four dimensions:
- 01
Observe
Identify the topics and behaviours that require more awareness.
- 02
Understand
Put results into context rather than focusing on a single indicator.
- 03
Raise awareness
Tailor content and exercises to the risks actually encountered.
- 04
Measure
Track maturity over time and identify the areas where efforts must continue.
- Observe
- Understand
- Raise awareness
- Measure
Before / after
From Security Awareness to Human Risk Management
Traditional awareness training
- Training
- Quiz
- Done
Human Risk Intelligence
- Measure
- Train
- Test
- Analyse
- Adapt
- Repeat
This moves you from an approach based mainly on distributing content to a process of continuous improvement of your cyber culture.
Beyond phishing
Phishing is only one part of human risk
Phishing simulations are an excellent awareness tool. But human risk is not limited to whether or not someone clicks on an email.
Identities & passwords
Strengthen behaviours related to accounts, passwords and authentication methods.
Data protection
Raise employee awareness of how company information is handled and shared.
Hybrid work
Maintain good reflexes when employees work outside the traditional office environment.
Artificial intelligence & Shadow AI
Help employees understand which information may be used with AI tools in line with the rules set by the organisation.
Incident reporting
Encourage users to report an unusual situation quickly rather than hide it for fear of having made a mistake.
Continuous cycle
Test. Raise awareness. Measure. Improve.
- 01
Assess
Identify the main human risk topics relevant to your organisation.
- 02
Raise awareness
Deliver content tailored to the issues encountered.
- 03
Test
Put certain reflexes to the test through controlled exercises, including phishing simulations.
- 04
Analyse
Review results at organisational level to identify the topics that need more attention.
- 05
Adapt
Evolve campaigns and content based on the findings.
- 06
Measure progress
Look at trends over time rather than considering a single campaign in isolation.
Awareness becomes a cycle, not an annual event.
The goal is not to train once. The goal is to build better reflexes that last.
Our stance
Employees are not “the weakest link”
Employees are not simply a risk to be controlled. They can become an extremely important line of defence when they understand threats and know how to respond.
Cybersecurity has long described users as “the weakest link”. That is not our approach.
Human Risk Intelligence should therefore help understand where the organisation can improve, not look for someone to blame.
We are not looking for who made a mistake. We are looking for why, and how to reduce the risk of it happening again.
Indicators
Indicators to improve, not to sanction
A Human Risk Intelligence programme should not become a ranking system for employees. We favour indicators focused on collective maturity and on improving the awareness programme. For example:
- Trends in phishing campaign results
- Topics requiring more awareness
- Progress in training
- Changes in certain measurable behaviours
- Organisation-wide trends
Measure to improve, not to sanction.
By role
Risk-based awareness training
Finance
May be particularly exposed to payment fraud attempts.
Management
May be targeted by impersonation or spear phishing campaigns.
Human resources
Handle particularly sensitive information.
IT teams
Potentially hold extensive access rights.
Not all employees face the same situations. This does not mean “grading” employees. It means awareness content can be tailored to the risks linked to roles and usage, where the organisation's framework allows it.
Generative AI
Human Risk Intelligence & Artificial Intelligence
Human risk evolves with usage.
The widespread arrival of generative AI creates new situations that employees must be prepared for. An employee may, for example, be tempted to submit to an AI tool:
- an internal document
- customer data
- a contract
- financial information
- code
- confidential information
The answer cannot simply be: “Don't use AI.”
AWSMTECH supports organisations in a more mature approach:
- Define authorised uses
- Raise awareness
- Support
- Evolve the rules
Defence in depth
Human Risk Intelligence and technical cybersecurity
The human dimension does not replace any technological protection. It complements them.
Human Risk Intelligence
→ Improve behaviours
MFA & identity protection
→ Strengthen access
Dark Web Monitoring
→ Monitor certain credential exposures
Vulnerability management
→ Reduce technical weaknesses
Rempart 24/7 SOC
→ Detect and respond to security events
A genuine defence-in-depth approach:
- People
- Identities
- Devices
- Data
- Detection
BeeSecure
An essential component of BeeSecure
Human Risk Intelligence is the human pillar of BeeSecure.
Protect people
Human Risk Intelligence
Protect identity
MFA + password management + Dark Web Monitoring
Protect devices
Endpoint security + vulnerability management
Detect threats
Rempart 24/7 SOC
BeeSecure thus becomes a protection architecture in which each component addresses a different dimension of risk.
Compliance
Human Risk Intelligence & compliance
Human Risk Intelligence helps structure, measure and document your awareness programme within the broader framework of your cybersecurity governance.
Awareness training and its documentation can form part of a broader cyber governance approach, but on their own they do not allow you to claim compliance with a regulatory framework.
Comparison
Phishing simulation or Human Risk Intelligence?
Phishing simulation
“How do our employees react to a phishing simulation?”
It is a targeted exercise.
Human Risk Intelligence
“How is our human risk evolving, and where should we strengthen our security culture?”
It is a continuous process.
- Phishing simulation = test
- Security Awareness = train
- Human Risk Intelligence = understand + adapt + measure
All three are complementary.
Why AWSMTECH
Why AWSMTECH?
A non-punitive approach
Awareness training is there to improve behaviours, not to single out culprits.
A continuous process
Cyber culture is built over time, not through a single annual training session.
A risk-based approach
Awareness actions can be directed towards the issues the organisation actually faces.
An IT + Cyber + Human vision
AWSMTECH connects human behaviours with the other protection layers of your environment.
Integration into BeeSecure
Human Risk Intelligence becomes one component of a broader cybersecurity strategy.
An approach suited to Swiss businesses
Particularly relevant for organisations that place great importance on confidentiality, governance and risk control.
Frequently asked questions
Frequently asked questions
Human Risk Intelligence uses various information from awareness activities and cyber exercises to better understand human risks and adapt training and prevention actions.
Training conveys knowledge. Human Risk Intelligence adds measurement, analysis and continuous adaptation of the awareness programme.
A phishing simulation is a specific exercise. Human Risk Intelligence is part of a broader approach that uses different signals to steer awareness training over time.
No. The information is used to reduce organisational risk and improve awareness in line with the applicable framework, not to establish intrusive monitoring of individuals.
Yes. Depending on the tools and campaigns used, various indicators make it possible to track trends and the evolution of the awareness programme.
Human Risk Intelligence
Make your employees a line of defence.
Technology protects your systems. Cyber culture helps your employees make better decisions when a threat targets them directly. With AWSMTECH, move from one-off awareness training to a continuous approach to understand, measure and reduce human risk.
Schedule a callA question about your teams' security awareness? Write to us