Living Security Launches 2026 State of Human Risk Report at HRMCon 2026

Living Security's 2026 human-risk study, based on telemetry from more than 100 organizations and nearly 5 million verified workforce identities, found that 73% of risky behavior is attributable to the riskiest 10% of employees. However, two-thirds of this year's highest-risk users were not high-risk users the prior year, supporting the company's case for continuous rather than annual cyber-risk assessment. Employees completing targeted action plans spent 68% less time in risky states, with improvement sustained for 12 months; the findings were released at the company's HRMCon 2026 conference.

Analysis

This is a category-validation event rather than a near-term public-equity catalyst: Living Security is private, and its telemetry is self-reported platform data rather than independently audited incident-loss data. The investable implication is that security budgets may continue shifting from broad compliance-training spend toward identity, behavioral analytics and automated response—areas with clearer linkage to breach prevention and board-level cyber-loss metrics. Public beneficiaries are likely CrowdStrike (CRWD), Okta (OKTA), Microsoft (MSFT), Zscaler (ZS) and Palo Alto Networks (PANW), but the revenue effect is likely immaterial over the next quarter absent evidence of incremental enterprise contract activity.

The second-order risk is that AI-agent adoption expands the addressable identity perimeter faster than security teams can govern it. That favors vendors with integrated identity telemetry and endpoint/network control planes over standalone awareness-training vendors; it may also pressure smaller point solutions as CISOs rationalize vendors into platform bundles. Over 6-18 months, a sustained increase in credential misuse or AI-agent-related security incidents would support higher attach rates for identity governance, privileged-access management and continuous monitoring, benefiting CYBR and OKTA more directly than legacy training providers.

Consensus should avoid treating “human risk management” as a discrete, durable software category yet. A vendor’s ability to demonstrate reduced risky behavior does not establish reduced breach frequency, lower cyber-insurance premiums, or willingness to pay at scale. The key falsifier for the platform-consolidation thesis is enterprise security spending rotating back to lower-cost point products or large vendors reporting weaker net retention and security-module attach rates despite elevated identity threats.

Key Decisions for Investors

• No immediate directional trade on this release; monitor HRMCon customer announcements, named integrations and funding/contract disclosures over the next 30 days before assigning revenue significance.
• Maintain a 6-12 month quality bias toward PANW and CRWD versus standalone security point solutions: both can bundle identity, endpoint and AI-security functions into existing enterprise relationships. Reassess if FY2027 billings growth or remaining-performance-obligation trends decelerate by more than 5 percentage points.
• Watch OKTA and CYBR as higher-beta identity-perimeter expressions over 3-6 months. Upgrade only after evidence that AI-agent governance is producing measurable module attach or raised ARR guidance; execution risk remains materially higher than for diversified platforms.
• Potential pair watch: long PANW / short a cybersecurity basket (HACK) if vendor-consolidation evidence emerges in upcoming earnings calls. Target a 10-15% relative move over 6-12 months; stop if PANW’s platformization bookings or NGS ARR commentary weakens relative to peers.