Page 1 of 2

Human Risk Readiness Assessment

How Human-Risk Ready Is Your Organization?
Complete 15 scored questions across five domains and two short context questions. Receive your readiness index, maturity tier, and domain profile.
This self-reported screening tool is not a formal audit or independently validated industry benchmark. Indicate your confidence in the information you provide.

Which workforce best describes your organization?

Primarily desk-based or office employees

Primarily frontline, field, or non-desk employees

A mix of desk-based and frontline employees

Not sure / prefer not to say

How confident are you in the information you can provide?

High — I can verify most practices.

Moderate — some practices need verification.

Low — many responses are estimates or assumptions.

Section 1: Governance & Strategy

Q1. How does your organization assign responsibility for cybersecurity awareness and human risk management?

No one is formally responsible.

Responsibility is handled informally or as needed.

An individual or team is assigned responsibility, but duties are not formally documented.

Responsibilities are documented and supported by leadership.

Responsibilities are formally established, regularly reviewed, and integrated into organizational risk management.

Unable to assess — needs verification

Q2. How is human cybersecurity risk incorporated into your organization's security strategy?

Not formally considered.

Addressed reactively after incidents or compliance demands.

Recognized but not consistently aligned with organizational risks.

Aligned with identified organizational risks and business priorities.

Integrated into risk management with defined objectives and leadership oversight.

Unable to assess — needs verification

Q3. How are security awareness objectives established and reviewed?

No objectives are defined.

Objectives are informal or reactive.

Objectives are documented but rarely reviewed.

Objectives are reviewed periodically and aligned to business risks.

Measurable objectives are routinely reviewed using risk and performance data.

Unable to assess — needs verification

Section 2: Security Awareness & Education

Q4. How frequently do employees receive cybersecurity education?

No consistent education is provided.

Training occurs only after incidents or when required.

Standard annual training is provided.

Regular role-relevant education is provided.

Continuous, risk-informed education is tailored and evaluated.

Unable to assess — needs verification

Q5. How is training tailored to different employee roles and threats?

Training is not provided.

The same generic material is occasionally shared.

General training is delivered to most employees.

Training is adapted to key roles and relevant threats.

Training is tailored using role-specific risk and observed behavior.

Unable to assess — needs verification

Section 3: Security Behaviors

Q6. How does your organization help employees recognize and report suspicious activity?

No clear reporting guidance exists.

Employees receive occasional reminders.

A reporting process is documented and communicated.

Employees practice reporting and receive feedback.

Reporting is easy, reinforced regularly, and evaluated.

Unable to assess — needs verification

Q7. How are risky employee behaviors identified and addressed?

Risky behaviors are not assessed.

Issues are addressed only after incidents.

Some behaviors are monitored, with ad hoc follow-up.

Risk patterns inform targeted coaching and interventions.

Behavioral evidence drives measured interventions and improvement.

Unable to assess — needs verification

Q13. Do employees feel safe reporting mistakes and suspicious activity?

Employees fear blame or retaliation.

Reporting is possible but employees often hesitate.

Employees are encouraged to report without blame.

Managers reinforce prompt reporting and constructive follow-up.

Reporting confidence and effectiveness are measured and improved.

Unable to assess — needs verification

Q14. How do leaders model secure behavior?

Leaders do not visibly support secure practices.

Support is occasional or compliance-driven.

Leaders communicate security expectations.

Leaders model practices and provide time and resources.

Leaders model, reinforce, and review behavioral security outcomes.

Unable to assess — needs verification

Q8. How does your organization reinforce secure decisions in daily work?

No reinforcement exists.

Occasional reminders are shared.

Recurring communications encourage secure behavior.

Managers and champions reinforce behaviors in work contexts.

Reinforcement is embedded in workflows and its impact measured.

Unable to assess — needs verification

Section 4: Workforce Accessibility

Q9. Can frontline and non-desk employees access security education?

Many employees cannot access training.

Access depends on ad hoc arrangements.

Most employees can access standard training.

Accessible channels accommodate frontline and non-desk roles.

Access barriers are systematically identified, addressed, and measured.

Unable to assess - needs verification

Q10. How are language, device, shift, and accessibility needs addressed?

These needs are not considered.

Needs are handled only when issues arise.

Some accommodations are available.

Delivery is designed for common workforce needs.

Accessibility and reach are evaluated across workforce groups.

Unable to assess - needs verification

Q15. How well do security procedures fit employees' real working conditions?

Procedures frequently conflict with daily work.

Workarounds are common and rarely addressed.

Some workflows have been reviewed for usability.

Employee feedback informs practical procedures.

Security friction and workarounds are measured and reduced.

Unable to assess - needs verification

Section 5: Measurement & Continuous Improvement

Q11. What does your organization measure beyond training completion?

Nothing is measured.

Only completion is tracked occasionally.

Completion and basic simulation results are tracked.

Reporting, repeat behaviors, and role-level trends are measured.

Behavioral and risk outcomes consistently inform decisions.

Unable to assess - needs verification

Q12. How are human risk findings used to improve the program?

Findings are not reviewed.

Changes occur only after incidents.

Results are reviewed irregularly.

Results inform scheduled improvements and leadership discussions.

Actions are prioritized, owned, measured, and reassessed.

Unable to assess - needs verification

Optional: Request your detailed HumanWise report

Your readiness results are free. If you would like a more detailed PDF summary, share your contact details below. We will prepare and email it manually. Providing contact information is optional.

Your name (optional)

Business email (optional)

Organization (optional)

Would you like HumanWise Security to email you a detailed PDF summary?

Yes, please email my detailed report.

No, just show my results here.

If you request a PDF, please provide your business email above. Your details will be used to fulfill your report request; a separate opt-in is needed for marketing communications.