In Cybersecurity, Mitigating Human Risk Goes Far Beyond Training

**Executive Summary:** The commentary argues organizations should move beyond one-size-fits-all security awareness training and adopt a human-by-design, data-driven approach that quantifies individual user risk via security telemetry; it recommends using risk scores to deliver tailored training, adaptive nudges and controls for high-risk users, maintaining transparency with employees, and tracking measurable improvements to demonstrate ROI.