Your technical controls are measured, tested and reported on every month. The people using them usually are not. A human risk assessment gives you a defensible score for employee cyber risk, broken down by department, role and behaviour, plus a roadmap that says exactly what to fix first.
A human risk assessment is a structured review of how your employees actually behave around information, systems and access, rather than how your policies say they should. It combines several evidence sources into a single picture: a knowledge and attitude survey across the workforce, observed behaviour from simulated attacks, access and privilege data from your systems, and structured interviews with the departments that handle the most sensitive information.
Those inputs produce a human risk score for the organisation, and the same score broken down by department, location, role type and seniority. Alongside the score sits the reasoning, so you can see whether a high score is being driven by weak knowledge, poor process, excessive access, unrealistic workload, or simply nobody having told people what good looks like.
The assessment runs over four to six weeks and is deliberately non-invasive. We do not read employee email, monitor keystrokes or track individuals. Reporting is aggregated to group level, which keeps the exercise proportionate under the PDPA and keeps staff cooperating with it.
Most organisations can tell you their patch compliance percentage to one decimal place and have no idea whether their finance team would wire money on the strength of a WhatsApp message from someone claiming to be the managing director. That asymmetry is where the losses come from.
Boards and audit committees are increasingly asking for human risk to be reported the same way as any other risk category: quantified, trended, owned and mitigated. Under the amended PDPA, an organisation that suffers a personal data breach has to notify the Commissioner and, in serious cases, the affected individuals. The question that follows is always whether the organisation had taken reasonable steps. A documented human risk assessment is a direct answer to that question.
There is also a budget argument. Human risk assessment usually shows that the workforce is not uniformly risky. Once you know which three departments carry most of the exposure, you can spend intensively where it matters rather than thinly everywhere.
Six evidence streams feed the score. Each one is weighted, documented and repeatable, so a reassessment twelve months later is genuinely comparable.
A structured survey across the workforce covering password practice, device handling, data sharing habits, use of personal cloud accounts, remote working patterns and confidence in recognising an attack. Short enough that people finish it, long enough to be meaningful.
What people do, not what they say they do. We correlate survey responses against observed behaviour from phishing simulation results and, where available, from your existing security tooling. The gap between stated confidence and actual behaviour is often the single most useful finding.
A composite score built from knowledge, behaviour, access sensitivity and exposure. Each component is visible, so nobody has to take the headline number on trust, and you can see which lever moves it.
Scores are compared across departments, branches, seniority bands and tenure groups, and set against anonymised context from organisations of similar size and sector. Managers respond very differently to a number when they can see where they sit relative to their peers.
Risk is behaviour multiplied by access. We map which roles can reach personal data, financial systems and privileged accounts, so a moderately risky behaviour in a highly privileged role is scored as the serious issue it is.
The assessment ends with a sequenced twelve-month plan: what to do in the first ninety days, what follows, who owns each item, and the expected effect on the score. Not a list of good ideas, a plan with dates.
The assessment turns an uncomfortable unknown into a managed risk with an owner, a number and a direction of travel.
A single score with a documented method means human risk can sit on the risk register and in board papers next to credit, operational and regulatory risk, instead of being a topic nobody knows how to quantify.
When the assessment shows procurement and accounts payable carrying three times the risk of engineering, the training plan and the budget can reflect that instead of treating all departments the same.
A high score in one team often turns out to be a broken approval workflow or an impossible turnaround expectation rather than careless staff. Those findings are usually the cheapest and fastest to fix.
A dated, methodical assessment demonstrates that the organisation identified and acted on human risk. That is exactly the evidence sought during a Commissioner enquiry, an ISO 27001 certification audit or an enterprise client's vendor due diligence questionnaire.
The first assessment is the reference point. Every subsequent campaign, training session and policy change can be judged on whether it actually moved the number.
Cyber insurers increasingly price on demonstrated control maturity. Documented human risk measurement and remediation is a stronger position at renewal than an assertion that staff receive annual training.
Four to six weeks from kickoff to board presentation, with roughly two hours of time required from each participating department.
We agree the population, the departments in scope, the data sources available and how findings will be handled. We also agree the privacy position up front: what is collected, how it is aggregated, how long it is retained and what individuals will be told. Getting this right is what makes the rest of the exercise run smoothly.
The workforce survey goes out, typically taking staff eight to twelve minutes. In parallel we gather access and role data from your systems and, where relevant, run a short simulated phishing campaign to capture observed behaviour rather than self-reported behaviour.
We sit with department heads and a sample of frontline staff in the highest-exposure functions. This is where the reasons emerge: the workaround everyone uses, the shared login nobody has mentioned, the approval step that gets skipped when a deal is closing.
Inputs are weighted and scored against our framework, then cross-checked for anomalies. Where a department scores unexpectedly well or badly we go back and verify before it reaches a report, because a wrong number destroys the credibility of the whole exercise.
We produce the full assessment report, the department benchmark pack and a board summary, then present them. The debrief is a working session, not a handover: department heads should leave knowing what their number means and what they own.
We agree the twelve-month improvement roadmap and set a reassessment date. Organisations that want the score tracked continuously rather than annually move onto our human risk management programme.
Six documents, each written for a specific audience, because the report that persuades a board is not the report that helps an IT manager plan a quarter.
The full document: methodology, evidence sources, organisational score, component breakdown, findings and supporting data.
One page per department showing its score, its position relative to the rest of the organisation, the specific behaviours driving it and the two or three actions that would help most.
A single-sheet scorecard suitable for the risk register, with the score, its components, the owner and the target for the next assessment.
Two pages for directors and the audit committee: where the organisation stands, what the exposure means in business terms, and what is being done about it.
Sequenced actions across training, policy, process and technical controls, with owners, effort estimates and expected score impact.
The scoring framework and survey instruments documented so the assessment can be repeated consistently, whether by us or by your own team.
It suits organisations that already have technical controls in reasonable shape and have realised the remaining exposure is behavioural.
Sectors handling volumes of personal or financial data get the most from it, particularly where a regulator or a major client audits their controls.
Below about fifty staff the assessment is usually run as a single cohort. Above five hundred it is segmented so each business unit gets its own actionable view.
The assessment covers the whole workforce, but these functions carry the concentrated exposure and receive the deepest analysis.
A risk score is only useful if the people it describes trust the method and the people who have to act on it can see what to do.
We assess human risk as a governance problem: it belongs on the risk register, with an owner, a target and a review cycle, and our reporting is built to slot straight into that structure. The assessment is designed to be defensible in front of an auditor or a regulator, not just persuasive in a sales meeting.
Findings are written as actions somebody can take next quarter, with the effort honestly estimated. Where the right answer is a process change rather than more training, we say so, even though process changes are not something we sell.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Where the roadmap calls for structured training, it can be delivered as an HRD Corp claimable programme through our registered training arm, so levy-contributing employers can fund the remediation as well as the diagnosis. See HRD Corp claimable cybersecurity training.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
