The attack surface has changed.

It is no longer just systems, networks, and data.

Cyber risk is increasingly driven by human decisions, delegated actions, and AI-enabled workflows.

What employees click.

What they share.

What they configure.

And increasingly, what they delegate to AI systems and autonomous agents.

That is why Living Security’s Human Risk Management Maturity Model is timely.

The shift is simple but important:

💡 Move from security awareness to risk visibility.

💡 Move from training completion to measurable outcomes.

💡 Move from generic intervention to targeted action.

This matters because AI and automation increase the blast radius of human decisions.

An AI agent can access data, trigger workflows, and act across systems at machine speed. If the underlying behavior, access, or intent is risky, the agent does not remove the risk. It can amplify it.

The practical takeaway for business and technology leaders: Do not treat AI governance as a standalone policy exercise. Connect it to identity, access, behavior, data exposure, and operational risk.

The organizations that get this right will not just have a better training program. They will understand where risk lives, who or what is creating it, and which actions actually reduce exposure.

What do you think: should AI agents be governed more like software, or more like employees?

#HumanRiskManagement #AIGovernance #Cybersecurity #AgenticAI #Automation